CVE-2021-29492
Bypass of path matching rules using escaped slash characters
En resumen
El proxy Envoy no decodifica barras escapadas (%2F, %5C) en URLs, permitiendo que atacantes eludan reglas de control de acceso usando rutas como /something%2F..%2Fadmin, que servidores backend decodifican diferente y otorgan acceso no autorizado.
Detalle técnico
Vulnerabilidad de traversal de ruta (CWE-22): Envoy no normaliza secuencias de escape en rutas HTTP antes de aplicar políticas de control de acceso (RBAC, JWT). Atacante envía URLs con %2F o %5C que eluden filtros del proxy; servidores backend que decodifican esas secuencias normalizan la ruta y acceden a recursos fuera del alcance de la política. Afecta versiones ≤1.18.2.
Resumen generado y traducido por IA a partir de la descripción oficial.
Envoy is a cloud-native edge/middle/service proxy. Envoy does not decode escaped slash sequences `%2F` and `%5C` in HTTP URL paths in versions 1.18.2 and before. A remote attacker may craft a path with escaped slashes, e.g. `/something%2F..%2Fadmin`, to bypass access control, e.g. a block on `/admin`. A backend server could then decode slash sequences and normalize path and provide an attacker access beyond the scope provided for by the access control policy. ### Impact Escalation of Privileges when using RBAC or JWT filters with enforcement based on URL path. Users with back end servers that interpret `%2F` and `/` and `%5C` and `\` interchangeably are impacted. ### Attack Vector URL paths containing escaped slash characters delivered by untrusted client. Patches in versions 1.18.3, 1.17.3, 1.16.4, 1.15.5 contain new path normalization option to decode escaped slash characters. As a workaround, if back end servers treat `%2F` and `/` and `%5C` and `\` interchangeably and a URL path based access control is configured, one may reconfigure the back end server to not treat `%2F` and `/` and `%5C` and `\` interchangeably.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
envoyproxy · envoy¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →