Envoy has RBAC Header Validation Bypass via Multi-Value Header Concatenation

1. Summary

The Envoy RBAC (Role-Based Access Control) filter contains a logic vulnerability in how it validates HTTP headers when multiple values are present for the same header name. Instead of validating each header value individually, Envoy concatenates all values into a single comma-separated string. This behavior allows attackers to bypass RBAC policies—specifically "Deny" rules—by sending duplicate headers, effectively obscuring the malicious value from exact-match mechanisms.

2. Attack Scenario

Consider an environment where an administrator wants to block external access to internal resources using a specific header flag.

Configuration

The Envoy proxy is configured with a Deny rule to reject requests containing the header internal: true.

• Rule Type: Exact Match
• Target: internal header must not equal true.

The Bypass Logic

1. Standard Request (Blocked):

   • Input: internal: true
   • Envoy Processing: Sees string "true".
   • Result: Match found. Request Denied.

2. Exploit Request (Bypassed):

   • Input:

     internal: true
     internal: true
     

   • Envoy Processing: Concatenates values into "true,true".
   • Matcher Evaluation: Does "true,true" equal "true"? No.
   • Result: The Deny rule fails to trigger. Request Allowed.

3. Implications

• RBAC Bypass: Remote attackers can bypass configured access controls.
• Unauthorized Access: Sensitive internal resources or administrative endpoints protected by header-based Deny rules become accessible.
• Risk: High, particularly for deployments relying on "Exact Match" strategies for security blocking.

4. Reproduction Steps

To verify this vulnerability:

1. Deploy Envoy: Configure an instance with an RBAC rule that performs an on a specific header (e.g., ).