CVE-2020-35470 in Envoy
Summary
by MITRE • 12/15/2020
Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the proxy protocol header. This affects situations with tcp-proxy as the network filter (not HTTP filters).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 12/18/2020
The vulnerability identified as CVE-2020-35470 represents a significant logging discrepancy in the Envoy proxy software that impacts the accuracy of downstream address tracking. This flaw specifically manifests when Envoy processes TCP traffic through the tcp-proxy network filter, where the system fails to properly account for proxy protocol headers that contain the actual client information. The issue stems from Envoy's default behavior of logging the immediate peer address from which the connection was established rather than extracting and utilizing the client address information that may be embedded within proxy protocol headers. This misconfiguration leads to audit trails and monitoring systems receiving incorrect source address information, potentially compromising security operations and incident response capabilities.
The technical root cause of this vulnerability lies in Envoy's address resolution logic within the tcp-proxy filter implementation. When a connection is established through a proxy protocol enabled environment, the actual client address information is typically transmitted within the proxy protocol header, which contains the original source IP address that was forwarded through the proxy chain. However, Envoy's implementation prior to version 1.16.1 only examines the direct peer connection information and ignores the proxy protocol header contents entirely. This design flaw creates a scenario where security monitoring tools, access logs, and traffic analysis systems receive misleading information about the true origin of network connections, potentially masking malicious activities or complicating forensic investigations.
The operational impact of this vulnerability extends beyond simple logging inaccuracies to potentially compromise security posture and compliance requirements. Organizations relying on Envoy for traffic management in environments where proxy protocol is utilized may experience difficulties in accurately correlating network events with actual client behavior, leading to false positives in intrusion detection systems or missed security incidents. The vulnerability affects specifically environments using tcp-proxy network filters rather than HTTP filters, indicating that the issue is primarily relevant to TCP-level proxying scenarios where the proxy protocol header contains critical client identification information. This limitation means that organizations implementing TCP proxying with proxy protocol support are particularly vulnerable to this logging discrepancy, potentially affecting their ability to enforce access controls, perform security analytics, and maintain audit compliance.
This vulnerability aligns with CWE-200, which addresses improper logging of sensitive information, and can be categorized under ATT&CK technique T1070.006 for Indicator Removal on Host, as the incorrect logging may obscure malicious activities from security monitoring systems. The flaw also relates to ATT&CK technique T1562.001 for Impairing Security Tools, since accurate logging is essential for effective security monitoring and detection capabilities. Organizations should prioritize updating to Envoy version 1.16.1 or later to address this vulnerability, as the fix ensures proper handling of proxy protocol headers and accurate downstream address logging. Additionally, security teams should review existing log analysis procedures to identify any potential misconfigurations or false negatives that may have resulted from this logging discrepancy, and consider implementing additional monitoring controls to compensate for the vulnerability during the remediation period.