CVE-2021-32779
📋 TL;DR
This vulnerability in Envoy proxy allows attackers to bypass path-based authorization controls by including URI fragments (#fragment) in requests. It affects Envoy deployments using RBAC filters or similar authorization mechanisms with path-based rules. Attackers can escalate privileges by accessing restricted endpoints.
💻 Affected Systems
- Envoy Proxy
📦 What is this software?
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
Complete authorization bypass allowing unauthorized access to administrative endpoints, potentially leading to data exposure, service disruption, or further compromise.
Likely Case
Partial authorization bypass allowing access to some restricted endpoints based on path matching rules.
If Mitigated
No impact if proper network segmentation, additional authentication layers, or updated versions are in place.
🎯 Exploit Status
Exploitation requires sending specially crafted URIs with fragments to bypass path matching
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.19.1, 1.18.4, 1.17.4, 1.16.5
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-r222-74fw-jqr9
Restart Required: Yes
Instructions:
1. Identify Envoy version. 2. Upgrade to patched version. 3. Restart Envoy service. 4. Verify fragment handling is removed from path processing.
🔧 Temporary Workarounds
Enable path normalization
allSet path_normalization=true in Envoy 1.18.0+ configurations
Set 'path_normalization: true' in Envoy configuration
WAF fragment filtering
allConfigure WAF to block or sanitize URI fragments
🧯 If You Can't Patch
- Implement additional authentication/authorization layers beyond path-based rules
- Use network segmentation to isolate Envoy instances from sensitive backend services
🔍 How to Verify
Check if Vulnerable:
Check Envoy version and configuration for path-based authorization with path_normalization=false (if 1.18.0+)Check Version:
envoy --versionVerify Fix Applied:
Test with requests containing fragments to ensure they're properly rejected or normalized📡 Detection & Monitoring
Log Indicators:
- Requests with # fragments in URI paths
- Authorization failures followed by successful access
Network Indicators:
- HTTP requests containing # in path segments
- Unusual access patterns to admin endpoints
SIEM Query:
http.uri contains "#" AND (http.status_code=200 OR http.status_code=302) AND NOT http.uri contains "?"🔗 References
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-r222-74fw-jqr9
- https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-r222-74fw-jqr9
- https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history
