// For flags

CVE-2023-27492

Envoy may crash when a large request body is processed in Lua filter

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the Lua filter is vulnerable to denial of service. Attackers can send large request bodies for routes that have Lua filter enabled and trigger crashes.

As of versions versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy no longer invokes the Lua coroutine if the filter has been reset. As a workaround for those whose Lua filter is buffering all requests/ responses, mitigate by using the buffer filter to avoid triggering the local reply in the Lua filter.

A flaw was found in Envoy. This issue may allow attackers to send large request bodies for routes that have the Lua filter enabled, which will trigger a crash.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-03-01 CVE Reserved
  • 2023-04-04 CVE Published
  • 2024-04-10 EPSS Updated
  • 2024-08-02 CVE Updated
  • 2024-08-02 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-400: Uncontrolled Resource Consumption
  • CWE-770: Allocation of Resources Without Limits or Throttling
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Envoyproxy
Search vendor "Envoyproxy"
 Envoy
Search vendor "Envoyproxy" for product "Envoy"
 < 1.22.9
Search vendor "Envoyproxy" for product "Envoy" and version " < 1.22.9"
-
Affected
Envoyproxy
Search vendor "Envoyproxy"
 Envoy
Search vendor "Envoyproxy" for product "Envoy"
 >= 1.23.0 < 1.23.6
Search vendor "Envoyproxy" for product "Envoy" and version " >= 1.23.0 < 1.23.6"
-
Affected
Envoyproxy
Search vendor "Envoyproxy"
 Envoy
Search vendor "Envoyproxy" for product "Envoy"
 >= 1.24.0 < 1.24.4
Search vendor "Envoyproxy" for product "Envoy" and version " >= 1.24.0 < 1.24.4"
-
Affected
Envoyproxy
Search vendor "Envoyproxy"
 Envoy
Search vendor "Envoyproxy" for product "Envoy"
 >= 1.25.0 < 1.25.3
Search vendor "Envoyproxy" for product "Envoy" and version " >= 1.25.0 < 1.25.3"
-
Affected