5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2023-30851

GHSA ID

GHSA-2h44-x2wx-49f4

EPSS Score

0.29165%

CWE

CWE-693

Published

5/22/2023

Updated

11/7/2023

KEV Status

Technology

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-30851

CVE-2023-30851: Potential HTTP policy bypass when using header rules in Cilium

Impact

This issue only impacts users who:

Have a HTTP policy that applies to multiple toEndpoints AND
Have an allow-all rule in place that affects only one of those endpoints

In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies.

Patches

This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.

Workarounds

Rewrite HTTP rules for each endpoint separately. For example, if the initial rule looks like:

  egress:
    - toEndpoints:
        - matchLabels:
            k8s:kind: echo
        - matchLabels:
            k8s:kind: example
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
          rules:
            http:
              - method: "GET"

It should be rewritten to:

  egress:
    - toEndpoints:
        - matchLabels:
            k8s:kind: echo
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
          rules:
            http:
              - method: "GET"
    - toEndpoints:
        - matchLabels:
            k8s:kind: example
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
          rules:
            http:
              - method: "GET"

Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @jrajahalme for investigating and fixing the issue.

For more information

If you have any questions or comments about this advisory, please reach out on Slack.

As usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: security@cilium.io - first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-30851

CVE-2023-30851:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2023-30851

GHSA ID

GHSA-2h44-x2wx-49f4

EPSS Score

0.29165%

CWE

CWE-693

Published

5/22/2023

Updated

11/7/2023

KEV Status

Technology

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/cilium/cilium	go	< 1.11.16	1.11.16
github.com/cilium/cilium	go	>= 1.12.0, < 1.12.9	1.12.9
github.com/cilium/cilium	go	>= 1.13.0, < 1.13.2	1.13.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from improper merging of HTTP rules when multiple toEndpoints are specified. The workaround requires separating rules per endpoint, indicating the core issue was in rule aggregation logic. The patched versions fix 'incorrect merging of L7 rules' (per release notes), and the CWE-693 (Protection Mechanism Failure) aligns with flawed policy enforcement. The most logical location for this logic is in HTTP rule merging functions within the policy API layer.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2023-30851: Potential HTTP policy bypass when using header rules in Cilium

Impact

Patches

Workarounds

Acknowledgements

For more information

CVE-2023-30851:

5.3

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

CVE-2023-30851: Potential HTTP policy bypass when using header rules in Cilium

Impact

Patches

Workarounds

Acknowledgements

For more information

5.3

5.3

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI