CVE-2024-32976

Executive Summary

CVE-2024-32976 is a high-severity denial-of-service (DoS) vulnerability in Envoyproxy, a cloud-native edge and service proxy. The flaw resides in the Brotli decompression filter, where specially crafted Brotli data with extra input can cause an infinite loop during decompression. This leads to resource exhaustion and service unavailability. The vulnerability has a CVSS score of 7.5, indicating significant impact on availability. No public proof-of-concept (PoC) or exploit code is currently available, and the patch status remains unknown. The attack vector is network-based, requires no authentication, and can be triggered remotely, making it a critical concern for organizations using Envoyproxy with Brotli compression.

Supply Chain & Package Security

Envoyproxy is a widely used component in cloud-native environments, often deployed as a sidecar proxy in Kubernetes and service mesh architectures. The Brotli filter is a standard feature for compression. This vulnerability affects the supply chain by potentially allowing an attacker to disrupt critical infrastructure services that rely on Envoyproxy for traffic management and security. Organizations should audit their Envoyproxy deployments for the use of the Brotli filter and assess exposure.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (N) – No data breach.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of service availability.

Threat Level: High. The vulnerability is easily exploitable remotely with low complexity, leading to a denial-of-service condition. While no public exploit exists, the nature of the flaw (infinite loop) makes it a prime target for attackers.

Deep Dive & Mechanics

The vulnerability is a classic infinite loop (CWE-835) in the Brotli decompression filter of Envoyproxy. Brotli is a compression algorithm optimized for web content. The Envoyproxy Brotli filter is designed to decompress incoming Brotli-compressed data before forwarding it to upstream services.

Root Cause: The flaw occurs when the Brotli decompressor receives a valid Brotli stream followed by extra input data. Under specific conditions, the decompressor fails to properly handle the end-of-stream marker and enters an infinite loop, continuously attempting to decompress the extra data. This consumes 100% CPU resources, leading to a denial-of-service condition for the affected Envoyproxy instance.

Attack Vector: An attacker sends a crafted HTTP request with a Brotli-compressed body that includes extra trailing data. The Envoyproxy Brotli filter processes this request, triggering the infinite loop. The attack can be performed without authentication, over the network, and with low complexity.

Impact: The affected Envoyproxy process becomes unresponsive, dropping all legitimate traffic. In a service mesh or edge proxy deployment, this can cascade to downstream services, causing widespread disruption.

Vulnerable vs. Patched Code

Since no official patch or specific version information is available, the following is a conceptual comparison based on the vulnerability description.

Vulnerable Code (Conceptual):

// Brotli decompression loop
while (BrotliDecoderDecompressStream(state, &available_in, &next_in, &available_out, &next_out, &total_out) == BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT) {
    // Process output
}
// Missing check for extra input after stream end

Patched Code (Conceptual):

// Brotli decompression loop with end-of-stream check
BrotliDecoderResult result;
do {
    result = BrotliDecoderDecompressStream(state, &available_in, &next_in, &available_out, &next_out, &total_out);
    if (result == BROTLI_DECODER_RESULT_SUCCESS) {
        // Stream ended successfully, break out of loop
        break;
    }
} while (result == BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT);
// Additional check for extra input
if (available_in > 0) {
    // Handle or discard extra input
}

The patched code ensures that once the Brotli stream is successfully decompressed (BROTLI_DECODER_RESULT_SUCCESS), the loop exits, preventing infinite processing of extra input.

Exploitation & Lab Setup

Red Team (Exploitation)

Objective: Trigger a denial-of-service condition on an Envoyproxy instance with the Brotli filter enabled.

Prerequisites:

• Target Envoyproxy with Brotli filter enabled (default in many configurations).
• Network access to the proxy.

Steps:

1. Craft Malicious Payload: Create a valid Brotli-compressed payload with extra trailing data. This can be done using a Brotli library (e.g., Python's brotli).

   import brotli
   # Valid compressed data
   valid_data = b"Hello, World!"
   compressed = brotli.compress(valid_data)
   # Add extra trailing data
   malicious_payload = compressed + b"\x00" * 100
   

2. Send HTTP Request: Send a POST request to the Envoyproxy with the malicious payload as the body and Content-Encoding: br header.

   curl -X POST http://target-envoy:8080/path \
        -H "Content-Encoding: br" \
        --data-binary @malicious_payload.bin
   

3. Observe Impact: The Envoyproxy process will enter an infinite loop, consuming 100% CPU and becoming unresponsive to other requests.

Expected Outcome: Denial of service on the target Envoyproxy instance.

Blue Team (Defense & Detection)

Objective: Detect and mitigate exploitation attempts.

Detection:

• Monitor CPU usage on Envoyproxy hosts for sudden spikes to 100%.
• Analyze network traffic for Brotli-compressed requests with unusually large or malformed payloads.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Disable the Brotli filter if not required.
• Apply rate limiting to incoming requests.
• Implement Web Application Firewall (WAF) rules to block suspicious Brotli payloads.
• Monitor for the specific YARA/Sigma/Suricata signatures.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with Content-Encoding: br header and unusually large body sizes.
  • Repeated requests to the same endpoint with Brotli compression.
• Host IOCs:
  • Envoyproxy process consuming 100% CPU.
  • Log entries showing repeated Brotli decompression errors or timeouts.
• File IOCs:
  • Malicious payload files with Brotli-compressed data followed by extra bytes.

Detection Engineering

YARA Rule

rule CVE_2024_32976_Brotli_Infinite_Loop {
    meta:
        description = "Detects Brotli-compressed payloads with extra trailing data indicative of CVE-2024-32976"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-32976"
    strings:
        $brotli_magic = { 0B 02 80 } // Brotli magic bytes (varies)
        $extra_data = /[\x00-\xFF]{100,}/ // Extra data after Brotli stream
    condition:
        $brotli_magic at 0 and $extra_data
}

Sigma Rule

title: CVE-2024-32976 - Envoyproxy Brotli Infinite Loop DoS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with Brotli encoding and suspicious payload size
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: envoyproxy
detection:
    selection:
        http.request.headers.Content-Encoding: "br"
        http.request.body.size: >= 10000
    condition: selection
falsepositives:
    - Legitimate large Brotli-compressed requests
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32976 - Envoyproxy Brotli Infinite Loop DoS"; flow:to_server; content:"Content-Encoding|3a| br"; http_header_names; content:"Content-Encoding"; http_header_names; pcre:"/Content-Encoding:\s*br/i"; byte_test:1,>,10000,0,relative; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Brotli Filter: If the Brotli filter is not essential, disable it in the Envoyproxy configuration.

   http_filters:
   - name: envoy.filters.http.brotli
     typed_config:
       "@type": type.googleapis.com/envoy.extensions.filters.http.brotli.v3.Brotli
       # Remove or comment out this filter
   

2. Apply Rate Limiting: Use Envoyproxy's rate limiting capabilities to restrict the number of requests with Brotli encoding.
3. Monitor for Exploitation: Implement the detection rules above and monitor for anomalous CPU usage.

Long-Term Fix:

• Await an official patch from Envoyproxy. Once available, upgrade to the patched version immediately.
• Subscribe to Envoyproxy security advisories for updates.

Workarounds:

• Use alternative compression methods (e.g., gzip) if Brotli is not required.
• Implement a reverse proxy or WAF in front of Envoyproxy to filter malicious payloads.

Valters IT