CVE-2024-45809

Executive Summary

CVE-2024-45809 is a denial-of-service (DoS) vulnerability in the Envoy proxy’s JWT (JSON Web Token) filter. Under specific conditions—remote JWKs, clear_route_cache enabled, header operations configured, and a routing table that causes JWT header modifications to result in no matching route—Envoy will crash due to a null pointer dereference. The root cause is an incorrect ordering of continueDecoding and clearRouteCache in the filter’s decode logic. This vulnerability has a CVSS score of 5.3 (Medium) and affects Envoy versions prior to 1.31.2, 1.30.6, and 1.29.9. No public exploit code or PoC is available, but the conditions are well-documented, making it a realistic threat for environments using JWT authentication with remote JWKs and route cache clearing.

Supply Chain & Package Security

Envoy is a critical component in many cloud-native and service mesh deployments (e.g., Istio, Consul Connect). This vulnerability is not a supply chain compromise of the package itself, but it affects the runtime behavior of the proxy. Organizations using Envoy as a sidecar or edge proxy should treat this as a high-priority patch, as a crash can lead to service disruption. No malicious packages or compromised dependencies have been identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be triggered remotely by sending crafted HTTP requests.
• Attack Complexity: Low (AC:L) – No special conditions or timing required; the attacker only needs to meet the described configuration.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The crash does not affect other components.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: Low (A:L) – The crash causes a denial of service for the affected Envoy instance, but it can be restarted.

Threat Level: Medium. The vulnerability requires specific configuration conditions, but if those conditions are met, an attacker can reliably crash the proxy, leading to service disruption.

Deep Dive & Mechanics

The vulnerability resides in the JWT filter’s decodeHeaders function. When the filter processes a request, it may need to fetch remote JWKs (asynchronously) and then clear the route cache. The issue occurs in the following sequence:

1. Remote JWKs: The filter initiates an async fetch for JWKs, which requires the filter to pause decoding and wait for the response.
2. clear_route_cache: The provider configuration has clear_route_cache enabled, meaning that after JWT validation, the route cache is cleared to force re-evaluation.
3. Header operations: The JWT filter is configured to modify request headers (e.g., extracting claims into headers).
4. Routing mismatch: The routing table is set up so that after the header modifications, the request no longer matches any route.

When the async JWK fetch completes, the filter calls continueDecoding() to resume processing. However, the code then attempts to clear the route cache by calling clearRouteCache(). At this point, the request’s route may have been set to nullptr because the modified headers caused a route mismatch. The clearRouteCache function dereferences the route pointer without a null check, leading to a crash.

The fix reorders the operations: clearRouteCache is called before continueDecoding, ensuring that the route is still valid when the cache is cleared.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

void JwtFilter::onAsyncJwkFetchComplete() {
    // ... validation logic ...
    continueDecoding();  // Resumes processing, may set route to nullptr
    clearRouteCache();   // Crashes if route is nullptr
}

Patched Code (simplified):

void JwtFilter::onAsyncJwkFetchComplete() {
    // ... validation logic ...
    clearRouteCache();   // Called before continueDecoding, route is still valid
    continueDecoding();  // Safe to resume
}

The patch ensures that the route cache is cleared while the route pointer is still valid, preventing the null pointer dereference.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Envoy version < 1.31.2, < 1.30.6, or < 1.29.9.
• JWT filter configured with:
  • remote_jwks (async JWK fetch).
  • clear_route_cache: true.
  • Header operations (e.g., header_to_claims).
  • A routing table that causes the modified request to not match any route.

Exploitation Steps:

1. Set up an Envoy instance with the vulnerable configuration.
2. Send a request with a valid JWT that, after header modifications, results in no matching route.
3. The Envoy process will crash, causing a denial of service.

Example Request:

GET /protected HTTP/1.1
Host: example.com
Authorization: Bearer <crafted_jwt>

Note: No public exploit code exists. The above is a conceptual description.

Blue Team

Detection:

• Monitor Envoy logs for crashes or segfaults.
• Look for repeated requests that cause the proxy to restart.
• Use the detection rules below.

Mitigation:

• Upgrade to Envoy 1.31.2, 1.30.6, or 1.29.9.
• If upgrade is not possible, disable clear_route_cache or avoid using header operations that can cause route mismatches.

Indicators of Compromise (IOCs)

• Log Entries: Envoy crash logs containing nullptr or segfault in the JWT filter context.
• Process Behavior: Repeated Envoy process restarts.
• Network: Requests with JWT tokens that, after header modifications, result in no matching route.

Detection Engineering

YARA Rule

rule CVE_2024_45809_Envoy_JWT_Crash {
    meta:
        description = "Detects Envoy crash logs related to CVE-2024-45809"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-45809"
    strings:
        $crash1 = "null pointer dereference" nocase
        $crash2 = "segfault" nocase
        $crash3 = "JwtFilter" nocase
        $crash4 = "clearRouteCache" nocase
    condition:
        any of ($crash1, $crash2) and any of ($crash3, $crash4)
}

Sigma Rule

title: Envoy JWT Filter Crash (CVE-2024-45809)
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects Envoy crash events caused by null pointer dereference in JWT filter
author: Valters IT
date: 2025-04-10
logsource:
    product: envoy
    service: proxy
detection:
    selection:
        - EventID: "CRASH"
        - Message|contains: "nullptr"
        - Message|contains: "JwtFilter"
    condition: selection
falsepositives:
    - None expected
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-45809 - Envoy JWT Filter Crash Attempt";
    flow:to_server;
    content:"Authorization";
    content:"Bearer";
    pcre:"/JWT/i";
    classtype:attempted-dos;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

• Upgrade Envoy to version 1.31.2, 1.30.6, or 1.29.9 (or later).
• If upgrade is not possible, disable clear_route_cache in JWT provider configurations.
• Avoid using header operations that can cause route mismatches.

Long-term:

• Implement a Web Application Firewall (WAF) to filter malicious requests.
• Monitor Envoy logs for crashes and set up alerts.
• Regularly update Envoy to the latest stable version.

Workarounds:

• None officially provided. The only reliable fix is the upgrade.

Valters IT