OpenShift Service Mesh Envoy Improper HTTP Header Sanitization Vulnerability Allowing Access Control Bypass and Denial of Service

A vulnerability exists in OpenShift Service Mesh versions 2.6.3 and 2.5.6, where improper sanitization of HTTP headers in Envoy can lead to rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and replay attacks. This flaw allows attackers to inject headers that manipulate request handling, potentially causing unauthorized access, request amplification, and denial-of-service conditions within the service mesh.

Impact

Exploitation of this vulnerability could bypass access controls, disrupt service by exhausting CPU and memory resources, and create denial-of-service conditions within the affected service mesh.

Reproduction

The vulnerability can be reproduced by sending HTTP requests with injected headers that exploit the lack of proper sanitization. This can be done using tools like curl, by including malicious headers that manipulate Envoy's request handling. Once the headers are injected, the resulting request can bypass access controls and cause denial-of-service conditions by amplifying requests or exhausting system resources.

Remediation

To address this vulnerability, it is recommended to filter out potentially malicious headers by using the 'request_headers_to_remove' option in the Envoy configuration file. Additionally, avoid trusting addresses in the 'x-forwarded-for' header and instead use the downstream IP address.