CyberRota Analysis
AI-GeneratedEnvoy's routing mechanism contains a vulnerability that allows unauthenticated clients to bypass path-based authorization when the `ignore_path_parameters_in_path_matching` option is enabled. Specifically, the router's handling of semicolon suffixes can lead to a mismatch in authorization checks, potentially allowing access to protected routes. Organizations using affected versions should prioritize upgrading to the fixed releases (1.36.10, 1.37.6, 1.38.4, or 1.39.1) to mitigate the risk of unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_matching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC url_path matcher evaluates the raw path. A downstream request such as /admin;x can therefore miss a DENY rule for /admin while the router still selects the protected /admin backend. The inconsistent canonicalization allows an unauthenticated client to bypass path-based authorization. The relevant scope boundary is that the route option and a path-based RBAC rule must both be present, and the protected route must match after stripping. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Related CVEs
Other vulnerabilities affecting the same vendor(s)