GHSA-hqxw-mm44-gc4r
Istio Fragments in Path May Lead to Authorization Policy Bypass
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | istio.io/istio | < 1.9.8 | 1.9.8 |
| Go | istio.io/istio | >= 1.10.0, < 1.10.4 | 1.10.4 |
| Go | istio.io/istio | >= 1.11.0, < 1.11.1 | 1.11.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with `#fragment` in the path may bypass Istio’s URI path based authorization policies.
### Patches
* Istio 1.11.1 and above
* Istio 1.10.4 and above
* Istio 1.9.8 and above
### Workarounds
A Lua filter may be written to normalize the path. This is similar to the Path normalization presented in the [Security Best Practices](https://istio.io/latest/docs/ops/best-practices/security/#case-normalization) guide.
### References
More details can be found in the [Istio Security Bulletin](https://istio.io/latest/news/security/istio-security-2021-008)
### For more information
If you have any questions or comments about this advisory, please email us at [email protected]
References
External links from the advisory. They lead to third-party sites.