Cyber Posture

CVE-2025-24030

High

Published: 23 January 2025

Published
23 January 2025
Modified
04 September 2025
KEV Added
—
Patch
—
CVSS Score 7.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
EPSS Score 0.0018 39.4th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may access network configuration files to collect sensitive data about the device and the network.

Security Summary

CVE-2025-24030 is a path traversal vulnerability in Envoy Gateway, an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. It affects all versions of Envoy Gateway prior to 1.2.6, allowing unauthorized execution of commands on the Envoy Admin interface of managed proxies. The issue is classified under CWE-419 (Unrestricted Upload of File with Dangerous Type) with a CVSS v3.1 base score of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H), highlighting high availability impact alongside low confidentiality risk.

A user with access to the Kubernetes cluster can exploit this vulnerability via a path traversal attack to invoke Envoy Admin interface commands on affected proxies. Successful exploitation enables termination of the Envoy process, causing denial of service, and extraction of the Envoy configuration, which may contain confidential data.

Version 1.2.6 of Envoy Gateway resolves the vulnerability. As a workaround, administrators can use the EnvoyProxy API to apply a bootstrap configuration patch that restricts Admin interface access strictly to the Prometheus stats endpoint. Additional details are available in the Envoy Gateway security advisory (GHSA-j777-63hf-hx76) and the fixing commit (3eb3301ab3dbf12b201b47bdb6074d1233be07bd), along with Envoy documentation on edge best practices and Admin interface operations.

Details

CWE(s)
CWE-419

Affected Products

envoyproxy
gateway
≤ 1.2.6

MITRE ATT&CK Enterprise Techniques

T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1489 Service Stop Impact
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
attack.mitre.org →
T1602.002 Network Device Configuration Dump Collection
Adversaries may access network configuration files to collect sensitive data about the device and the network.
attack.mitre.org →
Why these techniques?

Path traversal via Prometheus metrics endpoint enables exploitation of the Envoy Admin interface (T1210), process termination (T1489), and extraction of proxy configuration data (T1602.002).

References