CVE-2021-29492 is a path traversal vulnerability affecting Envoy proxy versions 1.18.2 and earlier. It allows a remote attacker to bypass access control policies by crafting URL paths with escaped slash sequences (e.g., %2F, %5C) that Envoy fails to decode. This can lead to an escalation of privileges if backend servers interpret these escaped slashes interchangeably with unescaped ones, granting unauthorized access to restricted resources. The vulnerability has a CVSS score of 8.3 (HIGH) due to its network attack vector, low complexity, and potential for partial impact on confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.15.5CPE matchmatch criteria | cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:* | ||
>= 1.16.0, < 1.16.4CPE matchmatch criteria | cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:* | ||
>= 1.17.0, < 1.17.3CPE matchmatch criteria | cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:* | ||
>= 1.18.0, < 1.18.3CPE matchmatch criteria | cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
envoyproxy/envoy: HTTP request with escaped slash characters can bypass Envoy's authorization mechanisms
May 11, 2021Envoy Escaped Slash Sequences Bypass
Jan 1, 2021Envoy does not decode escaped slash sequences in HTTP URL paths
Envoy does not decode escaped slash sequences in HTTP URL paths