Envoy RBAC Header Validation Bypass Vulnerability

A logic vulnerability has been identified in the Envoy proxy's Role-Based Access Control (RBAC) filter, affecting versions prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13. The issue arises in the validation of HTTP headers when multiple values are present for the same header name. Instead of assessing each value individually, Envoy merges them into a single comma-separated string. This flaw enables attackers to circumvent RBAC 'Deny' rules by sending duplicate headers, masking the malicious value from exact-match evaluations. Exploitation of this vulnerability could lead to unauthorized access to internal resources or administrative endpoints that rely on header-based denial strategies.

Impact

Exploitation allows remote attackers to bypass RBAC access controls, potentially gaining unauthorized access to sensitive internal resources or administrative endpoints that are protected by header-based 'Deny' rules.

Reproduction

To reproduce this vulnerability, deploy Envoy with an RBAC 'Deny' rule that performs an exact match on a specific header, such as 'internal: true'. First, send a request with the 'internal' header set to 'true', which should be blocked by Envoy. Then, send a request containing the 'internal' header twice. Envoy will concatenate the values, and the 'Deny' rule will not trigger, allowing the request to be processed.

Remediation

Users can update to Envoy versions 1.37.1, 1.36.5, 1.35.8, or 1.34.13, where this vulnerability has been fixed. Additionally, the runtime guard 'envoy.reloadable_features.rbac_match_headers_individually' can be enabled to ensure that header values are validated individually, preventing the bypass.