CVE-2023-27487

Envoy client may fake the header `x-envoy-original-path`

State: Published
Severity: 8.2 High
Published: Apr 4, 2023
Updated: Feb 11, 2025
Reserved: Mar 1, 2023

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web Token (JWT) checks and forge fake original paths. The header `x-envoy-original-path` should be an internal header, but Envoy does not remove this header from the request at the beginning of request processing when it is sent from an untrusted client. The faked header would then be used for trace logs and grpc logs, as well as used in the URL used for `jwt_authn` checks if the `jwt_authn` filter is used, and any other upstream use of the x-envoy-original-path header. Attackers may forge a trusted `x-envoy-original-path` header. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 have patches for this issue.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N	GitHub_M

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
envoyenvoyproxy	>= 1.25.0, <1.25.3Affected >= 1.24.0, < 1.24.4Affected >= 1.23.0, < 1.23.6Affected < 1.22.9Affected

References

https://github.com/envoyproxy/envoy/security/advisories/GHSA-5375-pq35-hf2g

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.