CVE-2024-42487

Executive Summary

CVE-2024-42487 is a medium-severity vulnerability in Cilium, an eBPF-based networking, observability, and security solution. The flaw resides in the Gateway API implementation, specifically in the handling of HTTPRoute and GRPCRoute match precedence. According to the Gateway API specification, request methods must be evaluated before request headers when determining route matching. However, Cilium versions 1.15.x prior to 1.15.8 and 1.16.x prior to 1.16.1 incorrectly prioritize header matching over method matching. This deviation can lead to unintended routing behavior, potentially allowing an attacker to bypass security controls or access unintended backend services. The vulnerability has a CVSS score of 4.0 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code is available. The fix is included in Cilium v1.15.8 and v1.16.1, with no workaround available.

Supply Chain & Package Security

Cilium is distributed as a container image and via package managers for Kubernetes environments. Organizations using Cilium as a CNI plugin or for network security should verify their deployment version and update to the patched releases. Since Cilium is often deployed as part of a larger Kubernetes ecosystem, the supply chain risk is moderate; however, no direct package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 4.0 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The low integrity impact reflects the potential for unintended routing, which could allow an attacker to bypass security policies or access unintended services, but not directly compromise data confidentiality or system availability.

Deep Dive & Mechanics

The vulnerability stems from a logic error in Cilium's Gateway API controller. The Gateway API specification defines a strict precedence order for matching rules:

1. Exact path match
2. Prefix path match
3. Regular expression path match
4. Method match (e.g., GET, POST)
5. Header match (e.g., custom headers)

In Cilium versions prior to 1.15.8 and 1.16.1, the implementation incorrectly evaluates header matches before method matches. This means that if a route defines both a method constraint (e.g., only allow POST) and a header constraint (e.g., X-Custom: value), the header constraint is evaluated first. An attacker could craft a request with a matching header but a different HTTP method (e.g., GET) and be incorrectly routed to a backend intended only for POST requests. This could lead to unauthorized access to sensitive endpoints or bypass of security controls.

The issue is in the route matching logic within the Cilium agent's Gateway API handler. The code responsible for iterating over route rules does not respect the specification-defined order, leading to the precedence inversion.

Vulnerable vs. Patched Code

The vulnerable code is in the route matching logic. A simplified pseudocode representation:

Vulnerable (pre-1.15.8 / pre-1.16.1):

func matchRoute(route Route, req *http.Request) bool {
    // Incorrect order: headers checked before method
    if !matchHeaders(route.Headers, req) {
        return false
    }
    if !matchMethod(route.Method, req) {
        return false
    }
    // ... path matching
    return true
}

Patched (1.15.8 / 1.16.1):

func matchRoute(route Route, req *http.Request) bool {
    // Correct order: method checked before headers
    if !matchMethod(route.Method, req) {
        return false
    }
    if !matchHeaders(route.Headers, req) {
        return false
    }
    // ... path matching
    return true
}

The fix simply reorders the matching logic to comply with the Gateway API specification.

Exploitation & Lab Setup

Red Team

No public exploit code is available. However, a proof-of-concept can be constructed:

1. Deploy a Cilium cluster with a vulnerable version (e.g., 1.15.7).
2. Create a Gateway API HTTPRoute that allows only POST requests to a specific backend, but also requires a header X-Debug: true.
3. Send a GET request with the header X-Debug: true. In the vulnerable version, the request will be matched to the route (because headers are checked first) and forwarded to the backend, bypassing the method restriction.

Example curl command:

curl -X GET -H "X-Debug: true" http://<gateway>/sensitive-endpoint

Blue Team

To detect exploitation attempts:

• Monitor Gateway API logs for unexpected method/header combinations.
• Use network monitoring to identify requests that match routes with method restrictions but use different HTTP methods.
• Implement additional validation at the application layer to enforce method restrictions.

Indicators of Compromise (IOCs)

• Network: HTTP requests with mismatched method and header combinations that are routed to unintended backends.
• Logs: Gateway API logs showing route matches that violate method restrictions.
• Configuration: Cilium versions 1.15.x < 1.15.8 or 1.16.x < 1.16.1.

Detection Engineering

YARA Rule

rule CVE_2024_42487_Cilium_GatewayAPI_Precedence {
    meta:
        description = "Detects Cilium versions vulnerable to Gateway API match precedence issue"
        author = "Valters IT"
        date = "2025-04-16"
        reference = "CVE-2024-42487"
    strings:
        $version_1_15 = /1\.15\.[0-7]/ 
        $version_1_16 = /1\.16\.0/
    condition:
        $version_1_15 or $version_1_16
}

Sigma Rule

title: Cilium Gateway API Match Precedence Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2024-42487 where HTTP method restrictions are bypassed via header matching
author: Valters IT
date: 2025-04-16
logsource:
    product: cilium
    service: gateway-api
detection:
    selection:
        event: "route_match"
        method: "GET"
        header: "X-Debug: true"
    condition: selection
falsepositives:
    - Legitimate use of custom headers with GET requests
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-42487 Cilium Gateway API Method Bypass";
    flow:to_server;
    content:"X-Debug|3a| true";
    http_header;
    http_method;
    content:"GET";
    http_method;
    sid:1000001;
    rev:1;
    reference:cve,2024-42487;
    classtype:attempted-repository;
    priority:2;
)

Remediation & Mitigation

1. Immediate: Upgrade Cilium to v1.15.8 or v1.16.1 (or later).
2. Workaround: None available. The only fix is to upgrade.
3. Compensating Controls: If immediate upgrade is not possible, consider implementing additional network policies or Web Application Firewall (WAF) rules to enforce method restrictions at the edge.
4. Verification: After upgrade, verify that Gateway API routes follow the correct match precedence by testing with crafted requests.

Valters IT