Description
A flaw was found in Envoy. It is possible to modify or manipulate headers from external clients when pass-through routes are used for the ingress gateway. This issue could allow a malicious user to forge what is logged by Envoy as a requested path and cause the Envoy proxy to make requests to internal-only services or arbitrary external systems. This is a regression of the fix for CVE-2023-27487.
Remediation
References
Related Vulnerabilities
Oracle Database Server CVE-2015-4923 Vulnerability (CVE-2015-4923)
e107 Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2010-5084)
WordPress Plugin My Category Order 'parentID' Parameter SQL Injection (2.8)
PHP Other Vulnerability (CVE-2002-1396)
WordPress Plugin WP Customer Reviews Cross-Site Scripting (3.4.2)