Envoy WebSocket Handshake Failure Causes Denial-of-Service Vulnerability in ext_proc HTTP Filter

A denial-of-service vulnerability has been identified in Envoy versions prior to 1.34.0. The issue arises in the ext_proc HTTP filter, which can crash Envoy when a local reply is sent to an external server. This problem is linked to the filter's lifetime management. A specific scenario that triggers this crash is a failed WebSocket handshake, which prompts a local reply that ultimately leads to the Envoy crash.

Impact

Exploitation of this vulnerability causes Envoy to crash, disrupting service and causing a denial-of-service condition.

Reproduction

To reproduce this vulnerability, enable both WebSocket traffic and the ext_proc HTTP filter in Envoy. Then, initiate a WebSocket handshake that fails. This failure will trigger a local reply, which the ext_proc filter processes, causing Envoy to crash.

Remediation

Users can apply the patch available in Envoy versions 1.33.1, 1.32.4, 1.31.6, and 1.30.10. After applying the patch, the ext_proc filter will no longer send local replies generated by Envoy to the ext_proc server for processing. Additionally, the router will cancel upstream requests when a local reply is sent.