CVE-2021-29492
📋 TL;DR
Envoy proxy versions 1.18.2 and earlier fail to decode escaped slash sequences (%2F and %5C) in HTTP URL paths, allowing attackers to bypass access controls like RBAC or JWT filters. This affects users whose backend servers treat escaped slashes as equivalent to regular slashes, potentially granting unauthorized access to restricted resources. The vulnerability enables privilege escalation when URL path-based access control is configured.
💻 Affected Systems
- Envoy proxy
📦 What is this software?
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
Complete bypass of access controls allowing unauthorized access to administrative interfaces, sensitive data, or privileged functionality.
Likely Case
Partial bypass of access restrictions leading to unauthorized access to some protected resources or endpoints.
If Mitigated
No impact if backend servers don't treat escaped slashes as equivalent to regular slashes, or if additional access controls are in place.
🎯 Exploit Status
Attack requires crafting URLs with escaped slashes; exploit is straightforward once the vulnerability is understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.18.3, 1.17.3, 1.16.4, 1.15.5
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-4987-27fx-x6cf
Restart Required: Yes
Instructions:
1. Update Envoy to patched version. 2. Enable path normalization option to decode escaped slash characters. 3. Restart Envoy service.
🔧 Temporary Workarounds
Backend server configuration
allReconfigure backend servers to NOT treat %2F and / or %5C and \ interchangeably
🧯 If You Can't Patch
- Implement additional access controls at backend server level
- Use WAF or reverse proxy with proper path normalization before Envoy
🔍 How to Verify
Check if Vulnerable:
Check Envoy version and verify if using URL path-based access controls with vulnerable backend serversCheck Version:
envoy --versionVerify Fix Applied:
Verify Envoy version is patched and test with crafted URLs containing %2F and %5C sequences📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing %2F or %5C sequences in URL paths
- Access to restricted endpoints from unexpected paths
Network Indicators:
- HTTP traffic with encoded slash characters bypassing expected access patterns
SIEM Query:
http.url:*%2F* OR http.url:*%5C*