Detections
Analytics
CVE-2024-7207
critical
Description
A flaw was found in Envoy. It is possible to modify or manipulate headers from external clients when pass-through routes are used for the ingress gateway. This issue could allow a malicious user to forge what is logged by Envoy as a requested path and cause the Envoy proxy to make requests to internal-only services or arbitrary external systems. This is a regression of the fix for CVE-2023-27487.
References
https://github.com/envoyproxy/envoy/security/advisories/GHSA-ffhv-fvxq-r6mf