Istio RequestAuthentication Resource SSRF Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in Istio versions prior to 1.28.6 and 1.29.2. When a RequestAuthentication resource is created with a jwksUri pointing to an internal service, istiod sends an unauthenticated HTTP GET request to that URL. This request is made without filtering out localhost or link-local IPs, potentially leading to sensitive data being sent to Envoy proxies via xDS configuration.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive data, which could then be distributed to Envoy proxies, potentially impacting the behavior of microservices managed by Istio.

Remediation

Users can upgrade to Istio versions 1.28.6 or 1.29.2, both of which contain the patch for this vulnerability. Additionally, users can deploy a ValidatingAdmissionPolicy to prevent the creation of RequestAuthentication resources with suspicious jwksUri values, such as localhost or link-local IP addresses.