CVE-2021-31921
📋 TL;DR
This vulnerability allows external clients to bypass Istio's authorization checks and access internal Kubernetes services they shouldn't have access to. It affects Istio deployments where gateways are configured with AUTO_PASSTHROUGH routing. Organizations using vulnerable Istio versions with this specific configuration are at risk.
💻 Affected Systems
- Istio
📦 What is this software?
Istio by Istio
Istio by Istio
⚠️ Risk & Real-World Impact
Worst Case
External attackers gain unauthorized access to sensitive internal services, potentially leading to data exfiltration, lateral movement, or service disruption across the entire Kubernetes cluster.
Likely Case
Unauthorized access to internal services that should be protected by Istio's authorization policies, potentially exposing APIs, databases, or other backend services.
If Mitigated
With proper network segmentation and additional security controls, impact is limited to specific exposed services rather than entire cluster compromise.
🎯 Exploit Status
Exploitation requires knowledge of internal service names and access to the vulnerable gateway endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Istio 1.8.6 or 1.9.5
Vendor Advisory: https://istio.io/latest/news/security/istio-security-2021-006/
Restart Required: Yes
Instructions:
1. Upgrade Istio control plane to version 1.8.6 or 1.9.5. 2. Restart all Istio components. 3. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Disable AUTO_PASSTHROUGH
allRemove or modify gateway configurations using AUTO_PASSTHROUGH routing to use explicit routing rules instead.
kubectl edit gateway <gateway-name>
Remove or modify AUTO_PASSTHROUGH configuration
🧯 If You Can't Patch
- Implement network policies to restrict traffic between services
- Add additional authentication/authorization layers at the application level
🔍 How to Verify
Check if Vulnerable:
Check Istio version with 'istioctl version' and examine gateway configurations for AUTO_PASSTHROUGH usage.Check Version:
istioctl versionVerify Fix Applied:
Verify Istio version is 1.8.6+ or 1.9.5+ and test that unauthorized access attempts are properly blocked.📡 Detection & Monitoring
Log Indicators:
- Unexpected access patterns to internal services through gateways
- Authorization failures in Istio logs
Network Indicators:
- External traffic reaching internal services that should be protected
- Unusual port/protocol access through gateways
SIEM Query:
source_ip:external AND destination_service:internal AND protocol:TCP AND action:ALLOW