CVE-2024-28250

Executive Summary

CVE-2024-28250 is a medium-severity vulnerability (CVSS 6.1) affecting Cilium, a cloud-native networking, observability, and security solution based on eBPF. The flaw causes WireGuard-eligible traffic between a node's Envoy proxy or DNS proxy and pods on other nodes to be transmitted in cleartext, bypassing the intended encryption. This occurs in clusters with WireGuard enabled and Layer 7 policies applied. The vulnerability impacts Cilium versions 1.14.0 through 1.14.7 (native routing) and 1.14.0 through 1.14.3 (tunnel mode). Patches are available in versions 1.14.8 and 1.15.2 (native routing) and 1.14.4 (tunnel mode with encryption.wireguard.encapsulate=true). No known public exploits exist, but the risk of data exposure is significant in multi-tenant or sensitive environments.

Supply Chain & Package Security

Cilium is distributed as container images and Go binaries. The vulnerability is not in a package manager (NPM, PyPI, Ruby) but in the core Cilium agent and operator components. Organizations should verify the integrity of Cilium images via signed checksums and ensure they are pulled from trusted registries (e.g., quay.io/cilium). The patch is available in official Cilium releases.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Adjacent Network – attacker must be on the same network segment (e.g., same Kubernetes node or cluster network).
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): None – no user action required.
• Scope (S): Unchanged – impact is confined to the vulnerable component.
• Confidentiality (C): High – cleartext exposure of sensitive data.
• Integrity (I): None – data cannot be modified.
• Availability (A): None – no denial of service.

Threat Level: Medium. The vulnerability requires adjacent network access, but in Kubernetes clusters, this is often achievable by a compromised pod or malicious insider. The impact is limited to confidentiality, but the exposure of unencrypted traffic (including DNS queries and Envoy proxy data) can leak credentials, API tokens, or internal service details.

Deep Dive & Mechanics

Cilium uses eBPF to enforce network policies and optionally encrypt traffic with WireGuard. When Layer 7 policies are applied, Cilium redirects traffic through Envoy proxies (for L7 inspection) and DNS proxies (for DNS-aware policies). The vulnerability arises because the WireGuard encryption logic fails to properly handle traffic that is redirected through these proxies.

Root Cause: In the Cilium agent's datapath, when a packet is destined for a pod on another node and is subject to L7 policy, it is first sent to the local Envoy or DNS proxy. The proxy then forwards the packet to the destination node. However, the encryption decision is made based on the original packet's metadata, not the proxy's forwarding context. As a result, the proxy-to-node traffic bypasses WireGuard encryption and is sent in cleartext over the cluster network.

Affected Components:

• cilium-agent (datapath)
• Envoy proxy (for L7 policies)
• DNS proxy (for DNS-aware policies)

Conditions for Exploitation:

1. Cilium cluster with WireGuard enabled (encryption.type=wireguard).
2. Layer 7 policies applied (e.g., HTTP-aware network policies).
3. Traffic between nodes (e.g., pod-to-pod across nodes) that is subject to L7 policy.

Impact: An attacker with access to the cluster network (e.g., via a compromised pod or network tap) can sniff unencrypted traffic that should be encrypted by WireGuard. This includes HTTP requests, DNS queries, and any data passing through Envoy proxies.

Vulnerable vs. Patched Code

The fix involves modifying the Cilium agent's datapath to ensure that traffic redirected through Envoy or DNS proxies is correctly identified as WireGuard-eligible and encrypted accordingly.

Vulnerable Code (Conceptual):

// In cilium-agent datapath, encryption decision based on original packet
func shouldEncrypt(pkt *Packet) bool {
    if pkt.DestIsPodOnOtherNode() && pkt.HasL7Policy() {
        // Redirect to proxy, but encryption flag is lost
        return false // BUG: should be true
    }
    return pkt.IsWireGuardEligible()
}

Patched Code (Conceptual):

// In cilium-agent datapath, encryption decision after proxy redirect
func shouldEncrypt(pkt *Packet) bool {
    if pkt.DestIsPodOnOtherNode() && pkt.HasL7Policy() {
        // Ensure encryption is applied after proxy redirect
        return true // FIX: always encrypt cross-node traffic with WireGuard
    }
    return pkt.IsWireGuardEligible()
}

Patch Details:

• Native routing mode: Fixed in Cilium 1.14.8 and 1.15.2.
• Tunnel mode: Fixed in Cilium 1.14.4 (requires encryption.wireguard.encapsulate=true).
• The patch ensures that all cross-node traffic subject to L7 policies is encrypted by WireGuard, regardless of proxy redirection.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to a Cilium cluster with WireGuard enabled and L7 policies.
• Ability to sniff network traffic (e.g., via a compromised pod with tcpdump or tshark).

Steps:

1. Deploy a malicious pod on a node that can capture traffic between nodes.

   kubectl run attacker --image=nginx --restart=Never -- /bin/bash -c "apt-get update && apt-get install -y tcpdump && tcpdump -i any -w /tmp/capture.pcap"
   

2. Trigger L7 policy traffic from a pod on another node (e.g., an HTTP request to a service with L7 policy).

   kubectl exec -it victim-pod -- curl http://service-with-l7-policy
   

3. Analyze the pcap for cleartext traffic.

   kubectl cp attacker:/tmp/capture.pcap ./capture.pcap
   tshark -r capture.pcap -Y "http.request or dns"
   

4. Observe unencrypted HTTP requests or DNS queries that should have been encrypted by WireGuard.

Blue Team (Defense & Detection)

Detection:

• Monitor for unexpected cleartext traffic between nodes using network monitoring tools (e.g., Zeek, Suricata).
• Check Cilium agent logs for encryption errors or warnings.
• Use the following Sigma rule to detect unencrypted WireGuard traffic.

Mitigation:

• Immediately upgrade Cilium to a patched version.
• If upgrade is not possible, disable L7 policies temporarily or use tunneling mode with encryption.wireguard.encapsulate=true.
• Implement network segmentation to limit attacker access to the cluster network.

Indicators of Compromise (IOCs)

• Network Traffic: Cleartext HTTP requests or DNS queries between nodes that should be encrypted by WireGuard.
• Cilium Agent Logs: Log entries indicating encryption bypass for proxy-redirected traffic.
• Pod Behavior: Pods with tcpdump or packet capture tools running unexpectedly.
• Cilium Version: Cilium agent version between 1.14.0 and 1.14.7 (native routing) or 1.14.0-1.14.3 (tunnel mode).

Detection Engineering

YARA Rule

rule CVE_2024_28250_Cilium_WireGuard_Bypass {
    meta:
        description = "Detects Cilium agent logs indicating WireGuard encryption bypass for proxy traffic"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-28250"
    strings:
        $log1 = "wireguard: skipping encryption for proxy-redirected traffic" ascii wide nocase
        $log2 = "encryption bypass for L7 policy traffic" ascii wide nocase
        $log3 = "WireGuard eligible traffic sent unencrypted" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: Cilium WireGuard Encryption Bypass Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects Cilium agent logs indicating WireGuard encryption bypass for proxy-redirected traffic (CVE-2024-28250)
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-28250
logsource:
    product: linux
    service: cilium-agent
detection:
    selection:
        - "wireguard: skipping encryption for proxy-redirected traffic"
        - "encryption bypass for L7 policy traffic"
        - "WireGuard eligible traffic sent unencrypted"
    condition: selection
falsepositives:
    - None expected
level: high

Suricata Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2024-28250 Cilium WireGuard Bypass - Cleartext HTTP Traffic"; flow:to_server; content:"HTTP/"; http_method; content:"Host:"; http_header; sid:1000001; rev:1; reference:cve,2024-28250; priority:2;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Cilium to version 1.14.8 or later (native routing) or 1.14.4 or later (tunnel mode with encryption.wireguard.encapsulate=true).

   helm upgrade cilium cilium/cilium --version 1.14.8
   

2. Verify the upgrade by checking Cilium agent logs for the fix.

   kubectl logs -n kube-system -l k8s-app=cilium | grep -i "wireguard"
   

Workarounds (if upgrade is not possible):

• Disable Layer 7 policies temporarily.
• Use tunneling mode (routingMode=tunnel) with encryption.wireguard.encapsulate=true.
• Restrict network access to the cluster to trusted entities only.

Long-Term Measures:

• Implement network segmentation and micro-segmentation.
• Use mutual TLS (mTLS) for all service-to-service communication.
• Regularly audit Cilium configurations and logs for encryption anomalies.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert