CVE-2025-24030

Description

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior to 1.2.6. The admin interface can be used to terminate the Envoy process and extract the Envoy configuration (possibly containing confidential data). Version 1.2.6 fixes the issue. As a workaround, the `EnvoyProxy` API can be used to apply a bootstrap config patch that restricts access strictly to the prometheus stats endpoint. Find below an example of such a bootstrap patch.

CVSS v3.1 Score

7.1

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Weakness Type (CWE)

CWE-419 CWE-419

Affected Products

Vendor	Product	Versions
envoyproxy	gateway	< 1.2.6

References

Advisories & Patches

https://github.com/envoyproxy/gateway/commit/3eb3301ab3dbf12b201b47bdb6074d1233be07bd

Other References

https://github.com/envoyproxy/gateway/security/advisories/GHSA-j777-63hf-hx76 https://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/edge https://www.envoyproxy.io/docs/envoy/latest/operations/admin

Frequently Asked Questions

What is CVE-2025-24030? +

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior to 1.2.6. The admin interface can be used to terminate the Envoy process and extract the Envoy configuration (possibly containing confidential data). Version 1.2.6 fixes the issue. As a workaround, the `EnvoyProxy` API can be used to apply a bootstrap config patch that restricts access strictly to the prometheus stats endpoint. Find below an example of such a bootstrap patch. It has a CVSS v3.1 base score of 7.1 (HIGH).

How severe is CVE-2025-24030? +

CVE-2025-24030 has a CVSS v3.1 score of 7.1 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2025-24030? +

CVE-2025-24030 affects products from envoyproxy, specifically: gateway. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-24030? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-50588 9.8

An unauthenticated attacker with access to the local network of the medical office can use known default credentials to gain …

CVE-2024-2414 8.8

The primary channel is unprotected on Movistar 4G router affecting E version S_WLD71-T1_v2.0.201820. This device has the 'adb' service open …

CVE-2024-3051 7.5

Malformed Device Reset Locally command classes can be sent to temporarily deny service to an end device. Any frames sent …

CVE-2023-6533 6.5

Malformed Device Reset Locally Command Class packets can be sent to the controller, causing the controller to assume the end …

CVE-2024-39886 3.7

TONE store App version 3.4.2 and earlier contains an issue with unprotected primary channel. Since TONE store App communicates with …

CVE-2024-23324 8.6

Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients can force invalid gRPC …