CVE-2021-32777

{"containers": {"cna": {"affected": [{"product": "envoy", "vendor": "envoyproxy", "versions": [{"status": "affected", "version": ">= 1.19.0, < 1.19.1"}, {"status": "affected", "version": ">= 1.18.0, < 1.18.4"}, {"status": "affected", "version": ">= 1.17.0, < 1.17.4"}, {"status": "affected", "version": ">= 1.16.0, < 1.16.5"}]}], "descriptions": [{"lang": "en", "value": "Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However, only the last header value is sent. This may allow specifically crafted requests to bypass authorization. Attackers may be able to escalate privileges when using ext-authz extension or back end service that uses multiple value headers for authorization. A specifically constructed request may be delivered by an untrusted downstream peer in the presence of ext-authz extension. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to the ext-authz extension to correctly merge multiple request header values, when sending request for authorization."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-551", "description": "CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-08-24T20:25:09.000Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h"}, {"tags": ["x_refsource_MISC"], "url": "https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history"}], "source": {"advisory": "GHSA-6g4j-5vrw-2m8h", "discovery": "UNKNOWN"}, "title": "Incorrect concatenation of multiple value request headers in ext-authz extension", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-32777", "STATE": "PUBLIC", "TITLE": "Incorrect concatenation of multiple value request headers in ext-authz extension"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "envoy", "version": {"version_data": [{"version_value": ">= 1.19.0, < 1.19.1"}, {"version_value": ">= 1.18.0, < 1.18.4"}, {"version_value": ">= 1.17.0, < 1.17.4"}, {"version_value": ">= 1.16.0, < 1.16.5"}]}}]}, "vendor_name": "envoyproxy"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However, only the last header value is sent. This may allow specifically crafted requests to bypass authorization. Attackers may be able to escalate privileges when using ext-authz extension or back end service that uses multiple value headers for authorization. A specifically constructed request may be delivered by an untrusted downstream peer in the presence of ext-authz extension. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to the ext-authz extension to correctly merge multiple request header values, when sending request for authorization."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"}]}, {"description": [{"lang": "eng", "value": "CWE-863: Incorrect Authorization"}]}]}, "references": {"reference_data": [{"name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h", "refsource": "CONFIRM", "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h"}, {"name": "https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history", "refsource": "MISC", "url": "https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history"}]}, "source": {"advisory": "GHSA-6g4j-5vrw-2m8h", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T23:33:55.865Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-32777", "datePublished": "2021-08-24T20:25:09.000Z", "dateReserved": "2021-05-12T00:00:00.000Z", "dateUpdated": "2024-08-03T23:33:55.865Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "envoy", "vendor": "envoyproxy", "versions": [{"status": "affected", "version": ">= 1.19.0, < 1.19.1"}, {"status": "affected", "version": ">= 1.18.0, < 1.18.4"}, {"status": "affected", "version": ">= 1.17.0, < 1.17.4"}, {"status": "affected", "version": ">= 1.16.0, < 1.16.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "matchCriteriaId": "AFC3BF7F-5B28-4765-8C6F-E2437A4B425D", "versionEndExcluding": "1.16.5", "versionStartIncluding": "1.16.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "matchCriteriaId": "83547329-1394-417F-93DB-70C1A9D173B0", "versionEndExcluding": "1.17.4", "versionStartIncluding": "1.17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "matchCriteriaId": "D7376E28-9915-4CA1-A5DB-40874D10E781", "versionEndExcluding": "1.18.4", "versionStartIncluding": "1.18.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:1.19.0:*:*:*:*:*:*:*", "matchCriteriaId": "1968AA35-60E2-4A00-84A0-617738B55D33", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However, only the last header value is sent. This may allow specifically crafted requests to bypass authorization. Attackers may be able to escalate privileges when using ext-authz extension or back end service that uses multiple value headers for authorization. A specifically constructed request may be delivered by an untrusted downstream peer in the presence of ext-authz extension. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to the ext-authz extension to correctly merge multiple request header values, when sending request for authorization."}, {"lang": "es", "value": "Envoy es un proxy L7 de c\u00f3digo abierto y un bus de comunicaci\u00f3n dise\u00f1ado para grandes arquitecturas modernas orientadas a servicios. En las versiones afectadas, cuando la extensi\u00f3n ext-authz env\u00eda los encabezados de las peticiones al servicio de autorizaci\u00f3n externo, debe combinar varios encabezados de valores de acuerdo con las especificaciones HTTP. Sin embargo, s\u00f3lo se env\u00eda el \u00faltimo valor del encabezado. Esto puede permitir a peticiones espec\u00edficamente dise\u00f1adas omitir la autorizaci\u00f3n. Unos atacantes pueden ser capaces de escalar privilegios cuando es usada la extensi\u00f3n ext-authz o el servicio de back-end que usa m\u00faltiples valores del encabezado para la autorizaci\u00f3n. Una petici\u00f3n espec\u00edficamente construida puede ser entregada por un peer downstream no confiable en presencia de la extensi\u00f3n ext-authz. Envoy versiones 1.19.1, 1.18.4, 1.17.4, 1.16.5, contienen correcciones a la extensi\u00f3n ext-authz para combinar correctamente los valores de los encabezados de peticiones m\u00faltiples, cuando se env\u00edan peticiones de autorizaci\u00f3n."}], "id": "CVE-2021-32777", "lastModified": "2026-06-17T03:53:36.603", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-08-24T21:15:06.970", "references": [{"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h"}, {"source": "security-advisories@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-551"}, {"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-863"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank the Envoy Security Team for reporting this issue.", "affected_release": [{"advisory": "RHSA-2021:3273", "cpe": "cpe:/a:redhat:service_mesh:1.1::el8", "package": "servicemesh-proxy-0:1.1.17-2.el8", "product_name": "OpenShift Service Mesh 1.1", "release_date": "2021-08-25T00:00:00Z"}, {"advisory": "RHSA-2021:3272", "cpe": "cpe:/a:redhat:service_mesh:2.0::el8", "package": "servicemesh-proxy-0:2.0.7-3.el8", "product_name": "OpenShift Service Mesh 2.0", "release_date": "2021-08-25T00:00:00Z"}], "bugzilla": {"description": "envoyproxy/envoy: HTTP request with multiple value headers can bypass authorization policies", "id": "1996933", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1996933"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "status": "verified"}, "cwe": "CWE-863", "details": ["Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However, only the last header value is sent. This may allow specifically crafted requests to bypass authorization. Attackers may be able to escalate privileges when using ext-authz extension or back end service that uses multiple value headers for authorization. A specifically constructed request may be delivered by an untrusted downstream peer in the presence of ext-authz extension. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to the ext-authz extension to correctly merge multiple request header values, when sending request for authorization.", "An authorization bypass vulnerability was found in envoyproxy/envoy. Envoy incorrectly evaluates an HTTP request with multiple `value` headers. This flaw allows an attacker to bypass rule policies that use the `ext_authz` extension. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability."], "name": "CVE-2021-32777", "public_date": "2021-08-24T19:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-32777\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-32777\nhttps://istio.io/latest/news/security/istio-security-2021-008/"], "threat_severity": "Important"}

{}