CVE-2025-24030
Jan. 23, 2025, 4:15 a.m.
7.1
High
Description
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior to 1.2.6. The admin interface can be used to terminate the Envoy process and extract the Envoy configuration (possibly containing confidential data). Version 1.2.6 fixes the issue. As a workaround, the `EnvoyProxy` API can be used to apply a bootstrap config patch that restricts access strictly to the prometheus stats endpoint. Find below an example of such a bootstrap patch.
Product(s) Impacted
| Product | Versions |
|---|---|
| Envoy Gateway |
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-419
Unprotected Primary Channel
The product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.
References
Tags
CVSS Score
CVSS Data - 3.1
- Attack Vector: ADJACENT_NETWORK
- Attack Complexity: LOW
- Privileges Required: NONE
- Scope: UNCHANGED
- Confidentiality Impact: LOW
- Integrity Impact: NONE
- Availability Impact: HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Timeline
Published: Jan. 23, 2025, 4:15 a.m.
Last Modified: Jan. 23, 2025, 4:15 a.m.
Last Modified: Jan. 23, 2025, 4:15 a.m.
Status : Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
security-advisories@github.com
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.