CVE-2024-23326
Description
Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.7 a server sends 101 when switching protocols. Envoy incorrectly accepts a 200 response from a server when requesting a protocol upgrade, but 200 does not indicate protocol switch. This opens up the possibility of request smuggling through Envoy if the server can be tricked into adding the upgrade header to the response.
How to fix
- envoyproxy envoy1.27.6, 1.28.4, 1.29.5, 1.30.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| envoyproxy envoy | v < 1.27.6, 1.28.0 ≤ v < 1.28.4, 1.29.0 ≤ v < 1.29.5, 1.30.0 ≤ v < 1.30.2 | 1.27.6, 1.28.4, 1.29.5, 1.30.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.