GitHub Advisoryadvisory · Go

GHSA-hqxw-mm44-gc4r Istio Fragments in Path May Lead to Authorization Policy Bypass

HIGH Published 2021-08-30 Modified 2022-08-15 Official page ↗
Aliases
CVE-2021-39156
Ecosystem
Go
Packages
istio.io/istio
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-706, CWE-863
Reviewed
2021-08-25

Affected packages

• Go istio.io/istio: < 1.9.8 → fixed in 1.9.8 • Go istio.io/istio: >= 1.10.0, < 1.10.4 → fixed in 1.10.4 • Go istio.io/istio: >= 1.11.0, < 1.11.1 → fixed in 1.11.1

Description

Impact Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with `#fragment` in the path may bypass Istio’s URI path based authorization policies. Patches • Istio 1.11.1 and above • Istio 1.10.4 and above • Istio 1.9.8 and above Workarounds A Lua filter may be written to normalize the path. This is similar to the Path normalization presented in the Security Best Practices guide. References More details can be found in the Istio Security Bulletin For more information If you have any questions or comments about this advisory, please email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2021-39156 Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce… vulnerability

Weakness · CWE (2)

  • CWE-706 Use of Incorrectly-Resolved Name or Reference weakness
  • CWE-863 Incorrect Authorization weakness

References