CyberRota Analysis
AI-GeneratedEnvoy's URL normalization vulnerability allows for path confusion due to improper handling of dot and dotdot segments with semicolon parameters, potentially enabling remote clients to bypass path-based security policies. This issue primarily affects users of Envoy prior to versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1, particularly those implementing routing or RBAC based on normalized paths. Organizations utilizing Envoy in their cloud-native applications should prioritize upgrading to the patched versions to mitigate the risk of unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Related CVEs
Other vulnerabilities affecting the same vendor(s)