CVE-2024-23324
📋 TL;DR
This vulnerability allows downstream clients to bypass external authentication in Envoy proxy by forcing invalid gRPC requests to the ext_authz service when failure_mode_allow is enabled. This affects all Envoy deployments using ext_authz with gRPC and failure_mode_allow=true. Attackers can circumvent authentication checks and potentially access protected resources.
💻 Affected Systems
- Envoy Proxy
📦 What is this software?
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
Complete authentication bypass allowing unauthorized access to protected backend services, potentially leading to data exfiltration, privilege escalation, or service compromise.
Likely Case
Authentication bypass enabling access to resources that should require authentication, potentially exposing sensitive data or functionality.
If Mitigated
Limited impact if proper network segmentation and additional authentication layers exist, but still represents a security control bypass.
🎯 Exploit Status
Exploitation requires sending specially crafted gRPC requests to trigger the bypass condition
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.29.1, 1.28.1, 1.27.3, or 1.26.7
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-gq3v-vvhj-96j6
Restart Required: Yes
Instructions:
1. Identify Envoy version currently deployed. 2. Upgrade to patched version (1.29.1, 1.28.1, 1.27.3, or 1.26.7). 3. Restart Envoy service. 4. Verify the new version is running.
🔧 Temporary Workarounds
Disable failure_mode_allow
allSet failure_mode_allow to false in ext_authz configuration to prevent bypass when gRPC requests fail
Modify Envoy configuration: set failure_mode_allow: false in ext_authz filter
🧯 If You Can't Patch
- Implement additional authentication layers at the application level
- Use network segmentation to limit access to vulnerable Envoy instances
🔍 How to Verify
Check if Vulnerable:
Check Envoy configuration for ext_authz filter with gRPC protocol and failure_mode_allow=trueCheck Version:
envoy --versionVerify Fix Applied:
Verify Envoy version is 1.29.1, 1.28.1, 1.27.3, or 1.26.7 or higher📡 Detection & Monitoring
Log Indicators:
- Failed gRPC requests to ext_authz followed by successful downstream connections
- Authentication bypass events in access logs
Network Indicators:
- Unexpected successful connections after gRPC failures
- Traffic patterns bypassing expected auth flows
SIEM Query:
source="envoy" AND ("ext_authz" AND "failure" AND "allow")🔗 References
- https://github.com/envoyproxy/envoy/commit/29989f6cc8bfd8cd2ffcb7c42711eb02c7a5168a
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-gq3v-vvhj-96j6
- https://github.com/envoyproxy/envoy/commit/29989f6cc8bfd8cd2ffcb7c42711eb02c7a5168a
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-gq3v-vvhj-96j6
