CVE-2024-45806 Potential manipulate `x-envoy` headers from external sources in envoy
Attackers can manipulate x-envoy headers from external sources due to default internal trust boundaries, bypassing security controls and accessing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45806?
CVE-2024-45806 is a medium-severity vulnerability in Envoyproxy Envoy, published on 19 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's default configuration of internal trust boundaries, which considers all RFC1918 private address ranges as internal. The default behavior for handling internal addresses in Envoy has been changed. Previously, RFC1918 IP addresses were automatically considered internal, even if the internal_address_config was empty. The default configuration of Envoy will continue to trust internal addresses while in this release and it will not trust them by default in next release. If you have tooling such as probes on your private network which need to be treated as trusted (e.g. changing arbitrary x-envoy headers) please explicitly include those addresses or CIDR ranges into `internal_address_config`. Successful exploitation could allow attackers to bypass security controls, access sensitive data, or disrupt services within the mesh, like Istio. This issue has been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-639
Which versions are affected by CVE-2024-45806?
1 open source package ship an affected version, including envoy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
envoy Bitnami | All versions | 1.28.7, 1.29.9, 1.30.6, 1.31.2 |
Products include Envoyproxy Envoy.
How do I fix CVE-2024-45806?
Upgrade envoy to a fixed version for your release line: 1.28.7, 1.29.9, 1.30.6 or 1.31.2.
Is CVE-2024-45806 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-45806 exists.
Other vulnerabilities in Envoyproxy Envoy
Sources
Also known as BIT-envoy-2024-45806, CVE-2024-7207, GHSA-ffhv-fvxq-r6mf.