Multiple vulnerabilities in Envoy



Risk High
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2023-35941
CVE-2023-35942
CVE-2023-35943
CVE-2023-35944
CWE-ID CWE-116
CWE-416
CWE-20
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Public exploit code for vulnerability #2 is available.
Public exploit code for vulnerability #3 is available.
Public exploit code for vulnerability #4 is available.
Vulnerable software
 envoy
Server applications / IDS/IPS systems, Firewalls and proxy servers

Vendor Cloud Native Computing Foundation

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Improper Encoding or Escaping of Output

EUVDB-ID: #VU78678

Risk: High

CVSSv4.0: 7.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2023-35941

CWE-ID: CWE-116 - Improper Encoding or Escaping of Output

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper encoding or escaping of output. A remote attacker can construct credentials with permanent validity.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

envoy: 1.23.0 - 1.26.3

CPE2.3 External links

https://github.com/envoyproxy/envoy/security/advisories/GHSA-7mhv-gr67-hq55


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Use-after-free

EUVDB-ID: #VU78682

Risk: Medium

CVSSv4.0: 5.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2023-35942

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the gRPC access logger extension. A remote user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

envoy: 1.23.0 - 1.26.3

CPE2.3
External links

https://github.com/envoyproxy/envoy/security/advisories/GHSA-69vr-g55c-v2v4


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Use-after-free

EUVDB-ID: #VU78681

Risk: Medium

CVSSv4.0: 5.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2023-35943

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the HTTP CORS filter. A remote user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

envoy: 1.23.0 - 1.26.3

CPE2.3
External links

https://github.com/envoyproxy/envoy/security/advisories/GHSA-mc6h-6j9x-v3gq


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Input validation error

EUVDB-ID: #VU78679

Risk: High

CVSSv4.0: 7.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2023-35944

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to incorrect handling of requests and responses with mixed case schemes. A remote attacker can pass specially crafted input to the application and bypass some requests with mixed schemes.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

envoy: 1.23.0 - 1.26.3

CPE2.3
External links

https://github.com/envoyproxy/envoy/security/advisories/GHSA-pvgm-7jpg-pw5g


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###