Envoy is a cloud-native edge/middle/service proxy. Envoy does not decode escaped slash sequences `%2F` and `%5C` in HTTP URL paths in versions 1.18.2 and before. A remote attacker may craft a path with escaped slashes, e.g. `/something%2F..%2Fadmin`, to bypass access control, e.g. a block on `/admin`. A backend server could then decode slash sequences and normalize path and provide an attacker access beyond the scope provided for by the access control policy. ### Impact Escalation of Privileges when using RBAC or JWT filters with enforcement based on URL path. Users with back end servers that interpret `%2F` and `/` and `%5C` and `\` interchangeably are impacted. ### Attack Vector URL paths containing escaped slash characters delivered by untrusted client. Patches in versions 1.18.3, 1.17.3, 1.16.4, 1.15.5 contain new path normalization option to decode escaped slash characters. As a workaround, if back end servers treat `%2F` and `/` and `%5C` and `\` interchangeably and a URL path based access control is configured, one may reconfigure the back end server to not treat `%2F` and `/` and `%5C` and `\` interchangeably.

An update of the envoy package has been released.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1540 advisory.

    Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for     installation into an on-premise OpenShift Container Platform installation.

    Security Fix(es):

    * envoyproxy/envoy: HTTP request with escaped slash characters can bypass Envoy's authorization mechanisms     (CVE-2021-29492)

    * istio/istio: HTTP request with escaped slash characters can bypass authorization mechanisms     (CVE-2021-31920)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1538 advisory.

    Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for     installation into an on-premise OpenShift Container Platform installation.

    Security Fix(es):

    * envoyproxy/envoy: HTTP request with escaped slash characters can bypass Envoy's authorization mechanisms     (CVE-2021-29492)

    * istio/istio: HTTP request with escaped slash characters can bypass authorization mechanisms     (CVE-2021-31920)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
150944	Photon OS 1.0: Envoy PHSA-2021-1.0-0405	Nessus	PhotonOS Local Security Checks	high
149445	RHEL 8 : Red Hat OpenShift Service Mesh 1.1.14 (RHSA-2021:1540)	Nessus	Red Hat Local Security Checks	high
149435	RHEL 8 : Red Hat OpenShift Service Mesh 2.0.4 (RHSA-2021:1538)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2021-29492

high

Tenable Plugins

high

high

high