CVE-2024-7207

Improper Input Validation (CWE-20)

Published: Sep 19, 2024 / Updated: 2mo ago

010
CVSS 9.8EPSS 0.05%Critical
CVE info copied to clipboard

Summary

A vulnerability has been identified in Envoy that allows for the modification or manipulation of headers from external clients when pass-through routes are used for the ingress gateway. This flaw is a regression of the fix for a previous vulnerability (CVE-2023-27487).

Impact

This vulnerability could allow a malicious user to forge the requested path logged by Envoy and potentially cause the Envoy proxy to make requests to internal-only services or arbitrary external systems. The impact is severe, with the CVSS v3.1 base score of 9.8 (Critical), indicating high impacts on confidentiality, integrity, and availability. The attack vector is network-based, requires no user interaction, and can be executed with low attack complexity without needing any privileges.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. GitHub has released security advisory GHSA-ffhv-fvxq-r6mf to address this vulnerability.

Mitigation

1. Update Envoy to the latest patched versions: - Version 1.28.7 or later for the 1.28.x series - Version 1.29.9 or later for the 1.29.x series - Version 1.30.6 or later for the 1.30.x series - Version 1.31.2 or later for the 1.31.x series 2. If immediate patching is not possible, consider implementing additional security controls at the network level to restrict access to the Envoy proxy and monitor for suspicious traffic patterns. 3. Review and strengthen input validation mechanisms, particularly for header handling in pass-through routes. 4. Audit logs for any signs of exploitation, focusing on unusual path requests or unexpected internal service access. 5. For Red Hat OpenShift Service Mesh 2.0 users, check with Red Hat for specific patching instructions or mitigations.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-7207

Sep 19, 2024 at 11:15 PM
First Article

Feedly found the first article mentioning CVE-2024-7207. See article

Sep 19, 2024 at 11:24 PM / National Vulnerability Database
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Sep 19, 2024 at 11:25 PM
EPSS

EPSS Score was set to: 0.05% (Percentile: 16.4%)

Sep 20, 2024 at 10:02 AM
CVSS

A CVSS base score of 9.8 has been assigned.

Sep 25, 2024 at 5:55 PM / nvd
Static CVE Timeline Graph

Affected Systems

Envoyproxy/envoy
+null more

Patches

github.com
+null more

Links to Mitre Att&cks

T1562.003: Impair Command History Logging
+null more

Attack Patterns

CAPEC-10: Buffer Overflow via Environment Variables
+null more

References

(CVE-2024-7207) CVE-2024-7207 envoy: Server-side request forgery via HTTP header manipulation
This site requires JavaScript to be enabled to function correctly, please enable it.

News

CVE-2024-7207
A flaw was found in Envoy. It is possible to modify or manipulate headers from external clients when pass-through routes are used for the ingress gateway. This issue could allow a malicious user to forge what is logged by Envoy as a requested path and cause the Envoy proxy to make requests to internal-only services or arbitrary external systems. This is a regression of the fix for CVE-2023-27487. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or...
Vulnerability Summary for the Week of September 16, 2024
High Vulnerabilities Primary Vendor — Product Description Published CVSS Score Source & Patch Info CIRCUTOR–CIRCUTOR Q-SMT CIRCUTOR Q-SMT in its firmware version 1.0.4, could be affected by a denial of service (DoS) attack if an attacker with access to the web service bypasses the authentication mechanisms on the login page, allowing the attacker to use all the functionalities implemented at web level that allow interacting with the device. 2024-09-18 10 CVE-2024-8887 cve-coordination@incibe.es CIRCUTOR–CIRCUTOR Q-SMT An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network captures, locally stored web information, etc. 2024-09-18 10 CVE-2024-8888 cve-coordination@incibe.es dragonflyoss–Dragonfly2 Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation (CNCF) as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, “Secret Key”, is hard coded, which leads to authentication bypass. An attacker can perform any action as a user with admin privileges. This issue has been addressed in release version 2.0.9. All users are advised to upgrade.
Security Bulletin 25 Sep 2024 - Cyber Security Agency of Singapore
CVE-2024-9014, pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to ...
US-CERT Vulnerability Summary for the Week of September 16, 2024
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High : vulnerabilities with a CVSS base score of 7.0–10.0 Medium : vulnerabilities with a CVSS base score of 4.0–6.9 Low : vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links.
Envoy Proxy Vulnerability Allows Header Manipulation and Request Forgery
Red Hat - HIGH - CVE-2024-7207 A flaw was found in Envoy. It is possible to modify or manipulate headers from external clients when pass-through routes are used for the ingress gateway. This issue could allow a malicious user to forge what is logged by Envoy as a requested path and cause the Envoy proxy to make requests to internal-only services or arbitrary external systems. This is a regression of the fix for CVE-2023-27487.
See 10 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI