CVE-2022-21679 : Exploit Details and Defense Strategies

Istio, an open platform for microservices, has a vulnerability in versions 1.12.0 and 1.12.1 that could lead to an Authorization Policy bypass. Users are at risk if hosts or notHosts fields are used incorrectly.

Understanding CVE-2022-21679

This CVE highlights a critical security issue in Istio versions 1.12.0 and 1.12.1 related to the authorization policy's hosts and notHosts fields, leading to a potential bypass.

What is CVE-2022-21679?

In Istio 1.12.0 and 1.12.1, the authorization policy with hosts and notHosts may be incorrectly bypassed or denied during an upgrade, causing a mismatch due to a bug utilizing a new Envoy API with conflicting data plane versions.

The Impact of CVE-2022-21679

The vulnerability poses a medium risk with a CVSS base score of 6.8, affecting confidentiality and integrity with high impact when hosts or notHosts fields are misused.

Technical Details of CVE-2022-21679

This section provides detailed technical insights into the vulnerability.

Vulnerability Description

The bug in Istio versions 1.12.0 and 1.12.1 allows for authorization policy bypass when using hosts or notHosts fields incorrectly, leading to unexpected outcomes during upgrades.

Affected Systems and Versions

Istio versions >= 1.12.0 and < 1.12.2 are affected by this vulnerability, specifically impacting users leveraging the hosts and notHosts fields.

Exploitation Mechanism

The vulnerability occurs due to a mismatch caused by the incorrect usage of the new Envoy API with conflicting data plane versions.

Mitigation and Prevention

To secure systems from CVE-2022-21679, immediate actions and long-term security practices are essential.

Immediate Steps to Take

Users are advised to upgrade to version 1.12.2 or avoid mixing the 1.12.0/1.12.1 control plane with the 1.11 data plane when utilizing hosts or notHosts fields.

Long-Term Security Practices

Implement strict version control and conduct thorough testing during upgrades to prevent authorization policy bypasses.

Patching and Updates

Stay informed about security advisories from Istio and promptly apply patches to mitigate potential vulnerabilities.