CVE-2021-21378
📋 TL;DR
This vulnerability in Envoy proxy allows attackers to bypass JWT authentication by presenting tokens from unauthorized issuers when the 'allow_missing' requirement is configured under 'requires_any'. It affects Envoy 1.17.0 users with JWT authentication filter configured in this specific way.
💻 Affected Systems
- Envoy Proxy
📦 What is this software?
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
Complete authentication bypass allowing unauthorized access to protected resources, potentially enabling data exfiltration, privilege escalation, or service disruption depending on how JWT tokens are used in the system.
Likely Case
Unauthorized access to APIs or services protected by JWT authentication, potentially exposing sensitive data or allowing unauthorized operations.
If Mitigated
Minimal impact if proper network segmentation, additional authentication layers, or strict authorization checks are in place beyond JWT validation.
🎯 Exploit Status
Exploitation requires presenting a JWT token with an issuer not in the provider list. No special tools or advanced knowledge needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.17.1
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-4996-m8hf-hj27
Restart Required: Yes
Instructions:
1. Upgrade Envoy to version 1.17.1 or later. 2. Update configuration files if needed. 3. Restart Envoy service. 4. Verify the fix by testing JWT authentication with unauthorized issuer tokens.
🔧 Temporary Workarounds
Remove allow_missing from requires_any
allReconfigure JWT authentication to not use 'allow_missing' requirement under 'requires_any' clause
Edit Envoy configuration YAML to remove 'allow_missing' from 'requires_any' section of JWT authentication filter
Disable JWT authentication filter
allTemporarily disable JWT authentication until patched
Comment out or remove JWT authentication filter from Envoy configuration
🧯 If You Can't Patch
- Implement network-level access controls to restrict access to vulnerable endpoints
- Add additional authentication layer (API keys, IP whitelisting) before JWT validation
🔍 How to Verify
Check if Vulnerable:
Check Envoy version with 'envoy --version' and verify configuration contains JWT filter with 'allow_missing' under 'requires_any'Check Version:
envoy --versionVerify Fix Applied:
Test authentication with JWT tokens from unauthorized issuers - they should be rejected after patch📡 Detection & Monitoring
Log Indicators:
- JWT filter debug logs showing 'JWT token is missing' messages for requests with tokens
- Authentication bypass logs
- Unexpected successful authentications
Network Indicators:
- Authentication requests with JWT tokens from unexpected issuers
- Increased authentication success rate
SIEM Query:
source="envoy" AND ("JWT token is missing" OR "authentication bypass" OR "unknown issuer")🔗 References
- https://github.com/envoyproxy/envoy/commit/ea39e3cba652bcc4b11bb0d5c62b017e584d2e5a
- https://github.com/envoyproxy/envoy/pull/15194
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-4996-m8hf-hj27
- https://github.com/envoyproxy/envoy/commit/ea39e3cba652bcc4b11bb0d5c62b017e584d2e5a
- https://github.com/envoyproxy/envoy/pull/15194
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-4996-m8hf-hj27
