Auth bypass in Envoyproxy Envoy
CVE-2022-29226
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design when the HMAC signed cookie is missing a full authentication flow should be triggered. However, the current implementation assumes that access tokens are always validated thus allowing access in the presence of any access token attached to the request. Users are advised to upgrade. There is no known workaround for this issue.
Vulnerability class: Broken Authentication
EPSS: 0.013 (68.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N.
Affected products
- Envoyproxy Envoy — versions < 1.22.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-29226?
- CVE-2022-29226 is a critical-severity vulnerability in Envoyproxy Envoy, classified under Missing Authentication for Critical Function. CVSS score: 10.0/10. Published 2022-06-09.
- How severe is CVE-2022-29226?
- Critical severity. CVSS v3 base score is 10.0 out of 10.
- Is CVE-2022-29226 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.