Go · github.com/envoyproxy/gateway
Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure
The to_absolute_normalized_path function (security.lua:28-43) does not collapse redundant path separators (// → /). On Linux, //etc/passwd is equivalent to /etc/passwd (POSIX path semantics), but is_critical_path fails to match the double-slash variant because //etc/passwd does not start with /etc/.
This allows Lua code submitted as an EnvoyExtensionPolicy to read arbitrary files from the gateway controller pod's filesystem during Strict validation (the default), including:
/etc/passwd//var/run/secrets/kubernetes.io/serviceaccount/token//certs/...//proc/self/environThese credentials can be used to read sensitive information from the K8s API Server or from the Gateway XDS server.
This has been patched in versions >= v1.7.4 and v1.8.1
// to /) so double-slash variants like //etc/passwd and //var/run/secrets/... are matched by the critical-path check.. or .. segment in any position and across both separator styles (catches /etc/./passwd, ./etc/passwd, /etc/.).Please refer to the Warning section in Lua docs for measures to reduce risk.
Envoy Gateway thanks @dashingDragon and @Donjon-Cerberus for reporting this issue.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.