#VU25838 Improper access control in envoy - CVE-2020-8664

Vulnerability identifier: #VU25838

Vulnerability risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-8664

CWE-ID: CWE-284

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
envoy
Server applications / IDS/IPS systems, Firewalls and proxy servers

Vendor: Cloud Native Computing Foundation

Description

The vulnerability allows a remote attacker to gain unauthorized access to sensitive information.

The vulnerability exists due to improper access restrictions when using SDS with Combined Validation Context. A remote attacker can use the same secret (e.g. trusted CA) across many resources together with the combined validation context and gain unauthorized access to the affected application

Mitigation
Install update from vendor's website.

Vulnerable software versions

envoy: 1.0.0, 1.1.0 - 1.13.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.6.0, 1.7.0 - 1.7.1, 1.8.0, 1.9.0 - 1.9.1

---

External links
https://github.com/envoyproxy/envoy/security/advisories/GHSA-3x9m-pgmg-xpx8
https://www.envoyproxy.io/docs/envoy/v1.13.1/intro/version_history

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.