Envoy TLS Inspector Bypass Vulnerability

A vulnerability in Envoy's TLS inspector feature, present in versions prior to 1.13.0, allows for bypassing TLS client recognition by using only TLS 1.3. This occurs because the TLS extensions, such as Server Name Indication (SNI) and Application-Layer Protocol Negotiation (ALPN), were not inspected. As a result, connections could be incorrectly matched to a different filter chain, potentially bypassing certain security restrictions.

Impact

Exploitation of this vulnerability could lead to an incorrect filter chain match, allowing a client to bypass security restrictions that are dependent on the TLS inspector.

Remediation

Users can upgrade to Envoy versions 1.13.1 or 1.12.3, both of which include the necessary fix.