CVE-2025-46821

Executive Summary

CVE-2025-46821 is a medium-severity vulnerability in the Envoy proxy, affecting its URI template matcher. The flaw arises because the matcher incorrectly excludes the * character from the set of valid URI path characters. This omission allows an attacker to craft a URI containing * that bypasses RBAC (Role-Based Access Control) rules configured using the uri_template permission. The vulnerability has a CVSS score of 5.3, indicating a moderate risk of unauthorized access to protected resources. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, suggesting low exploitation activity. The vendor has released patches in versions 1.34.1, 1.33.3, 1.32.6, and 1.31.8.

Supply Chain & Package Security

Envoy is a cloud-native proxy commonly used in service mesh architectures (e.g., Istio, Consul Connect). This vulnerability affects the core proxy binary, which is typically distributed as a container image or compiled binary. Organizations using Envoy in their infrastructure should verify their deployment version and apply the patch. Since Envoy is often deployed as a sidecar or edge proxy, a bypass of RBAC could lead to unauthorized access to internal services, potentially impacting the entire service mesh.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The threat level is medium due to the low complexity of exploitation and the potential for bypassing RBAC controls, which could lead to unauthorized access to sensitive endpoints. However, the impact is limited to confidentiality, and no integrity or availability impact is expected.

Deep Dive & Mechanics

Envoy's URI template matcher is used to define patterns for matching incoming request URIs. The matcher supports a set of valid characters, but the * character was inadvertently excluded. In URI template syntax, * is often used as a wildcard or literal character. When an attacker sends a request with a URI containing *, the matcher fails to match it against the configured uri_template patterns. This means that RBAC rules that rely on uri_template to deny or allow access can be bypassed.

For example, if an RBAC policy is configured to deny access to /admin/* using a URI template, a request to /admin/* (with a literal asterisk) would not match the pattern, and the request would be allowed. This could expose administrative endpoints or sensitive data.

The vulnerability is present in Envoy versions prior to 1.34.1, 1.33.3, 1.32.6, and 1.31.8. The fix involves adding * to the set of valid characters in the URI template matcher.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In URI template matcher, the set of valid characters does not include '*'
bool is_valid_char(char c) {
    return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || c == '/' || c == '-' || c == '_';
}

Patched Code (Conceptual):

// After fix, '*' is added to the valid set
bool is_valid_char(char c) {
    return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || c == '/' || c == '-' || c == '_' || c == '*';
}

The patch ensures that the * character is recognized as a valid URI path character, allowing URI templates to match requests containing *.

Exploitation & Lab Setup

Red Team

Prerequisites:

• An Envoy proxy with RBAC configured using uri_template permissions.
• Knowledge of a protected endpoint that uses * in its URI.

Exploitation Steps:

1. Identify an RBAC rule that uses uri_template to restrict access to a resource, e.g., /admin/*.
2. Send a request to the protected resource with a literal * in the URI, e.g., GET /admin/* HTTP/1.1.
3. Observe that the request bypasses the RBAC rule and is allowed.

Example Request:

GET /admin/* HTTP/1.1
Host: target-envoy-proxy

Expected Result: The request is processed without RBAC denial, potentially exposing the admin interface.

Blue Team

Detection:

• Monitor for requests containing * in the URI path, especially to sensitive endpoints.
• Review Envoy access logs for unusual patterns.

Mitigation:

• Apply the patch to upgrade Envoy to a fixed version.
• As a workaround, configure additional RBAC permissions using url_path with safe_regex expressions to cover the * character.

Example Workaround Configuration:

static_resources:
  listeners:
  - name: listener_0
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        config:
          route_config:
            virtual_hosts:
            - name: backend
              domains: ["*"]
              routes:
              - match:
                  prefix: "/"
                route:
                  cluster: service_cluster
                typed_per_filter_config:
                  envoy.filters.http.rbac:
                    "@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
                    rules:
                      action: DENY
                      policies:
                        admin_policy:
                          permissions:
                          - url_path:
                              safe_regex:
                                google_re2: {}
                                regex: "/admin/\\*"
                          principals:
                          - any: true

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with * in the URI path to protected endpoints.
  • Unauthorized access to resources that should be restricted by RBAC.

• Log IOCs:

  • Envoy access logs showing requests to /admin/* or similar patterns.
  • RBAC audit logs showing unexpected allowed requests.

• File IOCs:

  • Envoy configuration files with uri_template permissions that do not account for *.

Detection Engineering

YARA Rule

rule CVE_2025_46821_Envoy_URI_Template_Bypass {
    meta:
        description = "Detects requests with '*' in URI path targeting Envoy proxy"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-46821"
        severity = "medium"
    strings:
        $uri_star = /\*[\/\?]?/ nocase
    condition:
        $uri_star
}

Sigma Rule

title: Envoy URI Template Bypass via Asterisk Character
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests containing '*' in the URI path, indicating potential exploitation of CVE-2025-46821
author: Valters IT
date: 2025-04-10
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46821
logsource:
    category: webserver
    product: envoy
detection:
    selection:
        cs-uri-query|contains: "*"
    condition: selection
falsepositives:
    - Legitimate use of '*' in URI (e.g., search queries)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-46821 Envoy URI Template Bypass"; flow:to_server,established; content:"*"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Envoy to version 1.34.1, 1.33.3, 1.32.6, or 1.31.8, depending on your current version.
2. If immediate upgrade is not possible, apply the workaround by configuring additional RBAC permissions using url_path with safe_regex expressions to explicitly match the * character.

Long-Term Actions:

• Review all RBAC policies that use uri_template and ensure they are robust against character injection.
• Implement regular security audits of Envoy configurations.
• Monitor for new CVEs and apply patches promptly.

Workaround Example:

permissions:
- url_path:
    safe_regex:
      google_re2: {}
      regex: "/admin/\\*"

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. All information is provided for authorized security testing and defense purposes only.