CVE-2020-16844
Description
An insecure access control vulnerability was found in Istio. If an authorization policy is created for a TCP service that includes a DENY rule with a prefix wildcard, Istio translates this into an Envoy string match, incorrectly removing the wildcard. This flaw allows an attacker to subvert particular DENY rules, potentially gaining access to restricted resources.
Mitigation
In regards to an AuthorizationPolicy for a TCP service, if using a DENY rule in the source principal (or namespace field) such as:
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
...
spec:
action: DENY
rules:
- from:
- source:
principals:
- */ns/servicemesh
Consider using an exact or suffix match instead such as:
- /foo/bar/ns/servicemesh
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.8 | 6.8 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | High | High | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | High | High | N/A |
| Integrity Impact | High | High | N/A |
| Availability Impact | None | None | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Red Hat CVSS v3 Score Explanation
Proposed changes to NIST's current CVSSv3 scoring:
AC:L -> AC:H To exploit this vulnerability an attacker needs to determine the AuthorizationPolicy content where wildcard is used in prefix. Hence proposing a change to Attack Complexity (AC) metric from Low to High. The same value to this metric has been assigned by Upstream.
We consider this as a Moderate impact flaw.
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
Acknowledgements
Red Hat would like to thank the Envoy Security Team for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
