#VU56106 Improper Authorization in envoy - CVE-2021-32777
Published: August 26, 2021
Vulnerability identifier: #VU56106
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2021-32777
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
envoy
envoy
Software vendor:
Cloud Native Computing Foundation
Cloud Native Computing Foundation
Description
The vulnerability allows a remote attacker to bypass authorization process.
The vulnerability exists due to an error in ext-authz extension when sending request headers to the external authorization service in Envoy. The application sends only the last header instead of merging multiple value headers according to the HTTP specification. A remote attacker can bypass authorization process and gain unauthorized access to the application, if ext-authz extension is used.
Remediation
Install updates from vendor's website.