CVE-2023-27493
📋 TL;DR
Envoy proxy versions before 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 fail to properly sanitize request properties when generating headers, allowing injection of illegal characters. This can cause upstream services to misinterpret requests as multiple pipelined requests, potentially bypassing security policies. Affects all Envoy deployments using request header generation from downstream properties.
💻 Affected Systems
- Envoy Proxy
📦 What is this software?
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
Upstream service interprets single request as two pipelined requests, bypassing Envoy's security policies and potentially enabling privilege escalation or data exfiltration.
Likely Case
Header corruption causing upstream service errors, request failures, or inconsistent application behavior.
If Mitigated
Minimal impact with proper input validation at upstream services, though still violates HTTP protocol specifications.
🎯 Exploit Status
Exploitation requires specific header generation configurations and upstream service vulnerability to header injection.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.26.0, 1.25.3, 1.24.4, 1.23.6, or 1.22.9
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-w5w5-487h-qv8q
Restart Required: Yes
Instructions:
1. Identify current Envoy version. 2. Upgrade to patched version matching your release line. 3. Restart Envoy service. 4. Verify version and functionality.
🔧 Temporary Workarounds
Disable downstream property header generation
allPrevent Envoy from adding request headers based on downstream request properties like certificate properties.
Modify Envoy configuration to remove or disable header generation from downstream properties
🧯 If You Can't Patch
- Implement strict input validation at upstream services to reject malformed headers
- Use network segmentation to isolate vulnerable Envoy instances from critical upstream services
🔍 How to Verify
Check if Vulnerable:
Check Envoy version and configuration for header generation from downstream propertiesCheck Version:
envoy --versionVerify Fix Applied:
Confirm Envoy version is 1.26.0, 1.25.3, 1.24.4, 1.23.6, or 1.22.9 and test header generation functionality📡 Detection & Monitoring
Log Indicators:
- Unusual upstream service errors related to header parsing
- HTTP protocol violations in logs
Network Indicators:
- Malformed HTTP headers in traffic between Envoy and upstream services
SIEM Query:
source="envoy" AND (error OR "header" OR "malformed")