CVE-2024-23324: Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata
First published: Fri Feb 09 2024(Updated: )
Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients can force invalid gRPC requests to be sent to ext_authz, circumventing ext_authz checks when failure_mode_allow is set to true. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Envoy Proxy | >=1.26.0<1.26.7 | |
| Envoy Proxy | >=1.27.0<1.27.3 | |
| Envoy Proxy | >=1.28.0<1.28.1 | |
| Envoy Proxy | >=1.29.0<1.29.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-23324?
CVE-2024-23324 has been categorized with a high severity due to the potential for bypassing external authentication checks.
How do I fix CVE-2024-23324?
To mitigate CVE-2024-23324, update Envoy Proxy to a version above 1.29.1 and ensure that failure_mode_allow is set to false.
Which versions of Envoy Proxy are affected by CVE-2024-23324?
CVE-2024-23324 affects Envoy Proxy versions from 1.26.0 to 1.26.7, 1.27.0 to 1.27.3, 1.28.0 to 1.28.1, and 1.29.0 to 1.29.1.
What type of vulnerability is CVE-2024-23324?
CVE-2024-23324 is a security vulnerability that allows external authentication to be bypassed by malformed gRPC requests.
Who is affected by CVE-2024-23324?
Organizations using vulnerable versions of Envoy Proxy that rely on external authentication for security are at risk from CVE-2024-23324.
- agent/references
- agent/title
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- agent/remedy
- agent/severity
- agent/softwarecombine
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/envoyproxy
- canonical/envoy proxy
- version/envoy proxy/1.26.0
- version/envoy proxy/1.27.0
- version/envoy proxy/1.28.0
- version/envoy proxy/1.29.0