CVE-2025-66220

Executive Summary

CVE-2025-66220 is a moderate-severity vulnerability in the Envoy proxy that affects its mTLS certificate validation logic. The flaw resides in the match_typed_subject_alt_names matcher, which incorrectly treats certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches. This can allow an attacker to bypass intended mTLS authentication checks by presenting a specially crafted certificate that appears to match a required SAN pattern but actually contains a null byte that truncates the comparison.

The vulnerability has a CVSS score of 5.0 (Medium) and a low EPSS score of 0.0%, indicating that exploitation is not currently widespread. However, the lack of an official patch and the potential for authentication bypass in mTLS configurations make this a significant concern for environments relying on Envoy for secure service-to-service communication.

Supply Chain & Package Security

Envoy is a high-performance proxy commonly deployed as a sidecar in service mesh architectures (e.g., Istio, Consul Connect). It is distributed as a compiled binary and also available as a Docker image. The vulnerability affects the core proxy binary, not a specific package manager ecosystem. However, organizations using Envoy in containerized environments should verify the version of the Envoy image in use and apply any future patches as soon as they become available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.0 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows an attacker to bypass mTLS certificate matching, potentially gaining unauthorized access to services that rely on SAN-based authentication. The low EPSS score suggests limited active exploitation, but the lack of a patch increases the risk for unpatched deployments.

Deep Dive & Mechanics

The vulnerability is in Envoy's implementation of the match_typed_subject_alt_names configuration option, which is used to match Subject Alternative Names (SANs) in mTLS client certificates. Specifically, the issue occurs when the SAN is of type OTHERNAME and contains a null byte (\0).

In standard string handling, a null byte is interpreted as a string terminator. However, Envoy's certificate matcher does not properly handle null bytes embedded within the SAN value. When comparing the certificate's SAN against a configured pattern, the matcher may stop at the null byte, treating the certificate as a match even if the full SAN value (including characters after the null byte) does not actually match the pattern.

For example, if the configured pattern is example.com, an attacker could present a certificate with an OTHERNAME SAN value of example.com\0.evil.com. The matcher would compare up to the null byte, see example.com, and incorrectly consider it a valid match, granting access to the attacker.

This is a classic null byte injection vulnerability (CWE-158) that bypasses input validation by exploiting differences in how strings are interpreted by different components.

Vulnerable vs. Patched Code

The vulnerable code is in the Ssl::Utility::matchSubjectAltName function within Envoy's SSL/TLS implementation. The function compares the SAN value from the certificate against a list of configured patterns.

Vulnerable Code (Conceptual):

bool matchSubjectAltName(const std::string& san, const std::string& pattern) {
    // Vulnerable: Uses strcmp or similar that stops at null byte
    return strcmp(san.c_str(), pattern.c_str()) == 0;
}

Patched Code (Conceptual):

bool matchSubjectAltName(const std::string& san, const std::string& pattern) {
    // Patched: Uses full string comparison, not null-terminated
    return san == pattern;
}

The patched version uses a full string comparison that does not treat null bytes as terminators, ensuring that the entire SAN value is compared against the pattern.

Exploitation & Lab Setup

Red Team

Prerequisites:

• An Envoy instance (version < 1.33.12, < 1.34.10, < 1.35.6, < 1.36.2) configured with mTLS and match_typed_subject_alt_names.
• Ability to generate a custom X.509 certificate with an OTHERNAME SAN containing a null byte.

Exploitation Steps:

1. Generate a Malicious Certificate: Use OpenSSL to create a certificate with a crafted OTHERNAME SAN. The following command creates a certificate with an OTHERNAME SAN that includes a null byte:

   openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes \
     -subj "/CN=attacker" \
     -addext "subjectAltName=otherName:1.2.3.4;UTF8:example.com\0.evil.com"
   

   Note: The exact method to embed a null byte may vary depending on the tool. In some cases, you may need to use a hex editor to modify the certificate after generation.

2. Present the Certificate to Envoy: Use a TLS client (e.g., curl with --cert and --key) to connect to the Envoy listener:

   curl --cert cert.pem --key key.pem https://envoy-listener:443/
   

3. Verify Bypass: If the vulnerability is present, Envoy will accept the connection and forward the request to the upstream service, even though the SAN does not actually match the configured pattern.

Blue Team

Detection:

• Monitor Envoy access logs for connections from certificates with unusual SAN values, especially those containing null bytes or other non-printable characters.
• Use the detection rules provided in the Detection Engineering section to identify exploitation attempts.

Mitigation:

• If possible, disable the use of match_typed_subject_alt_names with OTHERNAME SANs until a patch is available.
• Implement additional validation of client certificates at the application layer.
• Restrict network access to Envoy listeners to trusted IP ranges.

Indicators of Compromise (IOCs)

• Network:
  • TLS handshakes with certificates containing null bytes in the OTHERNAME SAN.
  • Connections to Envoy listeners from unexpected IP addresses.
• Host:
  • Envoy logs showing successful mTLS connections with certificates that have unusual SAN values.
  • Presence of custom certificates with embedded null bytes in the SAN field.
• File:
  • Certificate files with OTHERNAME SANs containing \0 or other non-printable characters.

Detection Engineering

YARA Rule

rule CVE_2025_66220_Envoy_mTLS_NullByte_SAN {
    meta:
        description = "Detects certificates with null bytes in OTHERNAME SANs"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-66220"
    strings:
        $null_byte = { 00 }
        $othername_oid = { 06 04 2A 86 48 86 F7 0D 01 09 0E } // OID for OTHERNAME (1.3.6.1.4.1.311.20.2.3)
    condition:
        $othername_oid and #null_byte > 0
}

Sigma Rule

title: Envoy mTLS Certificate Null Byte SAN Bypass
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2025-66220 by monitoring for certificates with null bytes in OTHERNAME SANs
author: Valters IT
date: 2025-04-10
logsource:
    category: proxy
    product: envoy
detection:
    selection:
        event_type: "ssl_handshake"
        tls_client_cert_san|contains: "\0"
    condition: selection
falsepositives:
    - Legitimate use of null bytes in SANs (extremely rare)
level: high

Suricata Rule

alert tls any any -> any any (msg:"CVE-2025-66220 Envoy mTLS Certificate Null Byte SAN Bypass"; flow:to_server; tls.cert_subject_alt_name; content:"|00|"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Envoy: Monitor the Envoy project for a patched release and upgrade to a fixed version as soon as it becomes available.
2. Disable OTHERNAME Matching: If possible, avoid using match_typed_subject_alt_names with OTHERNAME SANs. Use other SAN types (e.g., DNS, URI) instead.
3. Network Segmentation: Restrict access to Envoy listeners to only trusted clients.

Long-Term Actions:

1. Implement Certificate Validation: Add application-layer validation of client certificates to ensure SANs do not contain null bytes.
2. Monitor for Patches: Subscribe to Envoy security advisories to receive notifications about patches.
3. Conduct Security Audits: Review all mTLS configurations for reliance on OTHERNAME SAN matching.

Workaround: If upgrading is not immediately possible, consider using a custom filter or Lua script in Envoy to validate the SAN value before allowing the connection. This can be done by inspecting the certificate's SAN in a filter and rejecting connections where the SAN contains a null byte.

Valters IT
DevSecOps & Cyber Threat Intelligence