CVE-2021-39156GHSA-HQXW-MM44-GC4R
Fragments in Path May Lead to Authorization Policy Bypass
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.9.8, 1.10.4, 1.11.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
Summary
Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with `#fragment` in the path may bypass Istio’s URI path based authorization policies. Patches are available in Istio 1.11.1, Istio 1.10.4 and Istio 1.9.8. As a work around a Lua filter may be written to normalize the path.
Timeline
- CVE published
- Record last updated
Affected versions
- istio istio
fixed in 1.9.8; From 1.10.0 · fixed in 1.10.4; From 1.11.0 · fixed in 1.11.1
- istio.io/istioGo
fixed in 1.9.8
- istio.io/istioGo
From 1.10.0 · fixed in 1.10.4
- istio.io/istioGo
From 1.11.0 · fixed in 1.11.1