CVE-2021-32777
📋 TL;DR
Envoy's ext-authz extension fails to properly merge multiple-value headers when sending requests to external authorization services, sending only the last value instead. This allows attackers to craft requests that bypass authorization checks, potentially leading to privilege escalation. Affects Envoy deployments using the ext-authz extension with external authorization services that rely on multiple header values.
💻 Affected Systems
- Envoy Proxy
📦 What is this software?
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
Attackers bypass all authorization controls, gaining unauthorized access to protected resources or administrative privileges, potentially compromising entire service mesh infrastructure.
Likely Case
Selective authorization bypass for specific endpoints or services that use multiple-value headers for authorization decisions, allowing unauthorized access to sensitive data or functions.
If Mitigated
Limited impact with proper network segmentation, additional authentication layers, and monitoring that detects anomalous authorization patterns.
🎯 Exploit Status
Exploitation requires sending specifically crafted HTTP requests with multiple-value headers to Envoy instances with ext-authz enabled. No authentication needed if Envoy is publicly accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.19.1, 1.18.4, 1.17.4, 1.16.5 or later
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h
Restart Required: Yes
Instructions:
1. Identify affected Envoy instances. 2. Upgrade to patched version (1.19.1+, 1.18.4+, 1.17.4+, or 1.16.5+). 3. Restart Envoy service. 4. Verify the fix by testing header merging behavior.
🔧 Temporary Workarounds
Disable ext-authz extension
allTemporarily disable the vulnerable ext-authz extension if external authorization is not critical
Modify Envoy configuration to remove or comment out ext_authz filter configuration
Implement WAF rules
allAdd Web Application Firewall rules to detect and block requests with suspicious multiple-value headers
Configure WAF to inspect and sanitize HTTP headers before reaching Envoy
🧯 If You Can't Patch
- Implement network segmentation to restrict access to Envoy instances with ext-authz enabled
- Add additional authorization checks at the application layer to compensate for potential bypass
🔍 How to Verify
Check if Vulnerable:
Check Envoy version and ext-authz configuration. If version is before 1.19.1/1.18.4/1.17.4/1.16.5 and ext-authz is enabled, system is vulnerable.Check Version:
envoy --version or check Envoy container/image versionVerify Fix Applied:
Test with requests containing multiple-value headers to external authorization service and verify all values are properly merged and sent.📡 Detection & Monitoring
Log Indicators:
- Multiple authorization failures for same user/endpoint
- Unusual header patterns in access logs
- Authorization service receiving incomplete headers
Network Indicators:
- HTTP requests with multiple identical headers targeting ext-authz protected endpoints
- Unusual traffic patterns to authorization bypass endpoints
SIEM Query:
source="envoy" AND ("ext_authz" OR "authorization") AND header_count>1🔗 References
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h
- https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h
- https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history
