CVE-2025-30157

Executive Summary

CVE-2025-30157 is a denial-of-service (DoS) vulnerability in the Envoy proxy's ext_proc HTTP filter. The flaw arises from a lifecycle management issue where a local reply sent to an external processing server can cause a null pointer dereference, leading to a crash of the Envoy process. A known trigger is a failed WebSocket handshake, which causes Envoy to send a local reply and subsequently crash. The vulnerability affects all Envoy versions prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10. The CVSS score is 6.5 (Medium), with a vector emphasizing network-based, low-complexity attacks that require no privileges or user interaction, resulting in high availability impact.

Supply Chain & Package Security

Envoy is a cloud-native proxy commonly deployed as a sidecar or edge proxy in Kubernetes and service mesh environments. The vulnerability is in the core proxy binary, not a package manager distribution. However, organizations using Envoy via container images (e.g., envoyproxy/envoy) or package managers (e.g., apt, yum) should verify their version and update to the patched release. No malicious packages have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication or privileges are needed.
• User Interaction (UI): None – The attack does not require any user action.
• Scope (S): Unchanged – The exploit does not affect resources beyond the vulnerable component.
• Confidentiality (C): None – No data disclosure.
• Integrity (I): None – No data modification.
• Availability (A): High – The vulnerability can cause a complete denial of service (crash).

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation (network-based, no auth) and the potential for widespread impact in service mesh environments elevate the risk. An attacker can crash Envoy instances, disrupting traffic routing and service availability.

Deep Dive & Mechanics

The vulnerability resides in Envoy's external processing (ext_proc) HTTP filter. This filter allows Envoy to communicate with an external processing server for custom request/response modifications. The lifecycle of the filter involves managing state between Envoy and the external server.

When a local reply is generated (e.g., due to a failed WebSocket handshake), the filter's internal state can become inconsistent. Specifically, the filter may attempt to send a message to the external server after the local reply has been sent, leading to a use-after-free or null pointer dereference. This occurs because the filter's lifetime is not properly synchronized with the stream's lifecycle.

The crash is triggered when:

1. A WebSocket upgrade request is received.
2. The ext_proc filter is configured to process the request.
3. The WebSocket handshake fails (e.g., due to missing headers or protocol mismatch).
4. Envoy generates a local reply (e.g., 400 Bad Request).
5. The ext_proc filter attempts to send a message to the external server after the local reply has been sent, causing a null pointer dereference.

The vulnerability is a classic CWE-476 (NULL Pointer Dereference) where the filter does not check if the stream is still valid before sending data.

Vulnerable vs. Patched Code

The fix involves adding a null check before sending messages to the external server after a local reply. Below is a simplified representation of the vulnerable and patched code.

Vulnerable Code (simplified):

void ExtProcFilter::onLocalReply(const Http::ResponseHeaderMap& headers) {
  // ... handle local reply ...
  // Vulnerable: No check if stream is still valid
  sendMessageToExternalServer(headers);
}

Patched Code (simplified):

void ExtProcFilter::onLocalReply(const Http::ResponseHeaderMap& headers) {
  // ... handle local reply ...
  // Patched: Check if stream is still valid before sending
  if (stream_.has_value() && stream_->isValid()) {
    sendMessageToExternalServer(headers);
  }
}

The patch ensures that the filter only sends messages to the external server if the underlying stream is still valid, preventing the null pointer dereference.

Exploitation & Lab Setup

Red Team

Objective: Crash an Envoy instance configured with the ext_proc filter by triggering a failed WebSocket handshake.

Prerequisites:

• An Envoy proxy (version < 1.33.1, < 1.32.4, < 1.31.6, < 1.30.10) with the ext_proc filter configured.
• Network access to the Envoy listener.

Steps:

1. Identify an Envoy endpoint that uses the ext_proc filter. This can be done by probing for WebSocket endpoints or analyzing configuration leaks.
2. Send a malformed WebSocket upgrade request that will fail the handshake. For example:

   GET /ws HTTP/1.1
   Host: target
   Upgrade: websocket
   Connection: Upgrade
   Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==
   Sec-WebSocket-Version: 13
   

   Note: The exact trigger may require specific headers or values that cause the handshake to fail.
3. Observe the Envoy process crash. This can be verified by checking if the service becomes unresponsive or by monitoring logs for a segmentation fault.

Expected Outcome: The Envoy process crashes, causing a denial of service for all traffic handled by that instance.

Blue Team

Detection:

• Monitor Envoy logs for crash signatures (e.g., SIGSEGV, null pointer, ext_proc).
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Immediately upgrade Envoy to a patched version (1.33.1, 1.32.4, 1.31.6, or 1.30.10).
• If upgrading is not possible, disable the ext_proc filter or restrict access to the Envoy listener.
• Implement network segmentation to limit exposure of Envoy instances.

Hunting:

• Search for failed WebSocket handshake attempts in Envoy access logs.
• Look for patterns of repeated WebSocket upgrade requests from the same source IP.

Indicators of Compromise (IOCs)

• Log Entries: Envoy crash logs containing SIGSEGV, null pointer, or ext_proc filter errors.
• Network Traffic: Malformed WebSocket upgrade requests that fail the handshake.
• Process Behavior: Envoy process exiting unexpectedly with a non-zero exit code.
• File System: Core dump files (if enabled) in the Envoy working directory.

Detection Engineering

YARA Rule

rule CVE_2025_30157_Envoy_Crash {
  meta:
    description = "Detects Envoy crash logs indicating CVE-2025-30157 exploitation"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-30157"
  strings:
    $crash1 = "SIGSEGV" ascii wide nocase
    $crash2 = "null pointer" ascii wide nocase
    $crash3 = "ext_proc" ascii wide nocase
    $crash4 = "segmentation fault" ascii wide nocase
  condition:
    any of ($crash*) and filesize < 1MB
}

Sigma Rule

title: Envoy Crash Due to CVE-2025-30157
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects Envoy crash events related to CVE-2025-30157 exploitation
author: Valters IT
date: 2025-04-10
logsource:
  product: envoy
  service: proxy
detection:
  selection:
    EventID: 1000  # Windows Event ID for application crash (adjust for Linux)
    Provider_Name: 'Envoy'
    Message|contains:
      - 'SIGSEGV'
      - 'null pointer'
      - 'ext_proc'
      - 'segmentation fault'
  condition: selection
falsepositives:
  - Legitimate crashes due to other bugs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-30157 Envoy ext_proc Crash Attempt"; flow:to_server; content:"Upgrade"; http_header; content:"websocket"; http_header; content:"Sec-WebSocket-Key"; http_header; pcre:"/Sec-WebSocket-Version:\s*13/"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Envoy to version 1.33.1, 1.32.4, 1.31.6, or 1.30.10 (or later).
2. If upgrading is not possible, disable the ext_proc filter in the Envoy configuration:

   http_filters:
   - name: envoy.filters.http.ext_proc
     typed_config:
       "@type": type.googleapis.com/envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor
       disabled: true
   

3. Restrict network access to Envoy listeners using firewall rules or network policies.

Long-Term Measures:

• Implement a vulnerability management program to ensure timely patching of Envoy and other critical infrastructure.
• Monitor Envoy security advisories and subscribe to the Envoy mailing list.
• Use Web Application Firewalls (WAF) to filter malformed WebSocket requests.

Workarounds:

• If the ext_proc filter is required, consider using a different external processing mechanism (e.g., Lua filter) until the patch is applied.

Valters IT
Securing Digital Frontiers