CVE-2024-23326 Envoy incorrectly accepts HTTP 200 response for entering upgrade mode

What is CVE-2024-23326?

CVE-2024-23326 is a medium-severity vulnerability in Envoyproxy Envoy, published on 4 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.7 a server sends 101 when switching protocols. Envoy incorrectly accepts a 200 response from a server when requesting a protocol upgrade, but 200 does not indicate protocol switch. This opens up the possibility of request smuggling through Envoy if the server can be tricked into adding the upgrade header to the response.

Weakness: CWE-444, CWE-391

Which versions are affected by CVE-2024-23326?

1 open source package ship an affected version, including envoy. It affects 1 product.

Products include Envoyproxy Envoy.

How do I fix CVE-2024-23326?

Upgrade envoy to a fixed version for your release line: 1.27.6, 1.28.4, 1.29.5 or 1.30.2.

Is CVE-2024-23326 being exploited?

There is no known exploitation of CVE-2024-23326 in the wild and no public exploit code.

Other vulnerabilities in Envoyproxy Envoy

• CVE-2022-29226 Trivial authentication bypass in Envoy Critical 10.0
• CVE-2019-18801 Memory corruption in n/a Critical 9.8
• CVE-2019-18802 Security feature bypass in n/a Critical 9.8
• CVE-2020-35470 Information disclosure in n/a High 8.8
• CVE-2024-23324 Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata High 8.6

All Envoyproxy Envoy vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-envoy-2024-23326, GHSA-vcf8-7238-v74c.