Envoy crashes when JWT authentication is configured with the remote JWKS fetching
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.36.3, 1.35.7, 1.34.11, 1.33.13
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. This is caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS fetch fails, onJwksError() callback triggers processing of the second token, which calls fetch() again on the same fetcher object. The original callback's reset() then clears the second fetch's state (receiver_ and request_) which causes a crash when the async HTTP response arrives.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- envoyproxy envoy
From 1.36.0 · through 1.36.2; From 1.35.0 · through 1.35.6; From 1.34.0 · through 1.34.10; through 1.33.12
- github.com/envoyproxy/envoyGo
From 1.36.0 · fixed in 1.36.3
- github.com/envoyproxy/envoyGo
From 1.35.0 · fixed in 1.35.7
- github.com/envoyproxy/envoyGo
From 1.34.0 · fixed in 1.34.11
- github.com/envoyproxy/envoyGo
fixed in 1.33.13