CVE-2022-29226
📋 TL;DR
This vulnerability in Envoy's OAuth filter allows attackers to bypass authentication by providing any access token, even invalid ones. It affects all Envoy deployments using the OAuth filter in versions before 1.22.1. The flaw occurs because the implementation incorrectly assumes access tokens are always validated.
💻 Affected Systems
- Envoy Proxy
📦 What is this software?
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
Complete unauthorized access to protected resources and services behind Envoy proxy, potentially leading to data breaches, privilege escalation, and full system compromise.
Likely Case
Unauthenticated attackers gaining access to protected APIs and services that rely on Envoy's OAuth filter for authentication.
If Mitigated
No impact if the OAuth filter is not enabled or if proper network segmentation and additional authentication layers exist.
🎯 Exploit Status
Exploitation requires sending any access token parameter to Envoy with OAuth filter enabled. No special tools or complex techniques needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.22.1 and later
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-h45c-2f94-prxh
Restart Required: Yes
Instructions:
1. Upgrade Envoy to version 1.22.1 or later. 2. Update configuration if needed. 3. Restart Envoy service. 4. Verify the fix by testing authentication flow.
🔧 Temporary Workarounds
Disable OAuth Filter
allTemporarily disable the OAuth filter if not essential for operations
# Edit Envoy configuration to remove or comment out OAuth filter configuration
# Restart Envoy after configuration change
🧯 If You Can't Patch
- Implement additional authentication layer (e.g., API gateway, WAF) in front of Envoy
- Apply strict network segmentation to limit access to Envoy instances
🔍 How to Verify
Check if Vulnerable:
Check Envoy version and OAuth filter configuration. If version < 1.22.1 and OAuth filter is enabled, the system is vulnerable.Check Version:
envoy --versionVerify Fix Applied:
After upgrading to 1.22.1+, test that invalid access tokens are properly rejected and full OAuth flow is triggered when HMAC cookie is missing.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts with access tokens
- OAuth filter authentication bypass logs
- Unexpected successful authentications
Network Indicators:
- HTTP requests with access token parameters to protected endpoints
- Traffic patterns showing authentication bypass
SIEM Query:
source="envoy" AND ("oauth" OR "access_token") AND status="200" AND auth="bypass"🔗 References
- https://github.com/envoyproxy/envoy/commit/7ffda4e809dec74449ebc330cebb9d2f4ab61360
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-h45c-2f94-prxh
- https://github.com/envoyproxy/envoy/commit/7ffda4e809dec74449ebc330cebb9d2f4ab61360
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-h45c-2f94-prxh
