CVE-2021-43824
📋 TL;DR
A crafted CONNECT request sent to Envoy's JWT filter configured with regex matching causes a crash, leading to denial of service. This affects Envoy deployments using regex-based JWT filtering. The vulnerability allows attackers to disrupt service availability.
💻 Affected Systems
- Envoy Proxy
📦 What is this software?
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage for Envoy instances, disrupting all traffic proxied through affected instances.
Likely Case
Intermittent crashes causing service disruption and degraded performance.
If Mitigated
No impact if regex is not used in JWT filter configuration or if patched.
🎯 Exploit Status
Simple crafted request triggers the crash; details in advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.20.2, 1.19.3, 1.18.6, or 1.17.3
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-vj5m-rch8-5r2p
Restart Required: Yes
Instructions:
1. Identify Envoy version. 2. Upgrade to patched version via package manager or source. 3. Restart Envoy service.
🔧 Temporary Workarounds
Disable regex in JWT filter
allRemove or disable regex matching in JWT filter configuration.
Edit Envoy configuration to remove regex from JWT filter settings.
🧯 If You Can't Patch
- Implement network controls to block CONNECT requests to vulnerable endpoints.
- Use load balancers or WAFs to filter malicious requests before reaching Envoy.
🔍 How to Verify
Check if Vulnerable:
Check Envoy version and JWT filter configuration for regex usage.Check Version:
envoy --versionVerify Fix Applied:
Verify Envoy version is patched and test with crafted CONNECT request.📡 Detection & Monitoring
Log Indicators:
- Envoy crash logs, unexpected termination, error messages related to JWT filter.
Network Indicators:
- Spike in CONNECT requests to JWT endpoints, abnormal traffic patterns.
SIEM Query:
source="envoy" AND ("crash" OR "segfault" OR "JWT filter error")🔗 References
- https://github.com/envoyproxy/envoy/commit/9371333230b1a6e1be2eccf4868771e11af6253a
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-vj5m-rch8-5r2p
- https://github.com/envoyproxy/envoy/commit/9371333230b1a6e1be2eccf4868771e11af6253a
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-vj5m-rch8-5r2p
