CVE-2023-35941
Envoy vulnerable to OAuth2 credentials exploit with permanent validity
HIGH 8.6
At a glance
- Source
- NVD
- EPSS
- EPSS 0.81 % · percentile 57 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Modified
Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to construct credentials with permanent validity in some specific scenarios. This is caused by the some rare scenarios in which HMAC payload can be always valid in OAuth2 filter's check. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a workaround, avoid wildcards/prefix domain wildcards in the host's domain configuration.
Weaknesses (CWE)
- CWE-116 — Improper Encoding or Escaping of Output
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L | GitHub_M |
| CVSS 3.1 | HIGH 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2023-39925
- GCVE · GCVE-0-2023-35941
CERT-FR advisories
- CERTFR-2024-AVI-0156 — Multiples vulnérabilités dans les produits Tenable · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*≥ 1.23.0 < 1.23.12cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*≥ 1.24.0 < 1.24.10cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*≥ 1.25.0 < 1.25.9cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*≥ 1.26.0 < 1.26.4
Affected products
| Product | Versions |
|---|---|
| envoyproxy · envoy | affected >= 1.26.0, < 1.26.4 ; affected >= 1.25.0, < 1.25.9 ; affected >= 1.24.0, < 1.24.10 ; affected < 1.23.12 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |