Summary
Envoy's HTML-formatted admin statistics endpoint can render attacker-influenced statistic names without HTML encoding. If a data-plane component stores attacker-controlled path text in dynamic statistic names and an operator views the stats page in a browser, the script may execute with the admin interface's origin and issue privileged same-origin requests.
Affected context
The issue affects Envoy deployments where the HTML statistics endpoint is browser-accessible and an enabled data-plane feature, such as grpc_stats with statistics for all methods enabled, persists attacker-influenced path segments in dynamic statistic names. Risk depends on an operator viewing the generated HTML page in a browser with access to the admin interface.
Exploit preconditions
- Attack surface: The Envoy
/stats?format=htmladmin endpoint - Required access: Ability to influence request path segments that are incorporated into dynamic statistic names
- Trigger point: An operator loads the HTML-formatted statistics page
- Required configuration: A compatible component must persist attacker-influenced text in statistic names
- Why exploitation is possible: Statistic names are emitted without HTML encoding, allowing stored markup or script content to be interpreted by the operator's browser
Why this happens
The vulnerability results from context-incomplete output encoding in the HTML statistics renderer. Although statistic values are sanitized, statistic names are inserted into generated HTML without escaping characters that have meaning in an HTML or script context. This maps to CWE-79: Improper Neutralization of Input During Web Page Generation, because attacker-influenced data can cross a trust boundary and become executable browser content.
Potential impact
- An attacker may execute script in the origin of the Envoy admin interface
- The script could issue privileged same-origin requests available to the viewing operator
- Administrative information may be exposed or modified
- An attacker could potentially alter runtime configuration if the interface permits such actions
- Operator sessions or accessible admin data could be abused
General mitigation guidance
Mitigation generally focuses on applying context-appropriate output encoding to every attacker-influenced field rendered into HTML, including statistic names.
Common defensive patterns include:
- HTML-encode statistic names and other dynamic content at the rendering boundary
- Prefer structured or non-HTML statistics views for operational workflows where practical
- Restrict browser access to administrative interfaces through network policy, authentication, and administrative segmentation
- Disable unnecessary dynamic statistics features that persist untrusted request data
- Apply least privilege to administrative identities and limit actions available through the admin interface
- Treat data-plane request metadata as untrusted until it is safely encoded for its output context
How teams detect issues like this
Organizations can look for this issue through:
- Static analysis rules identifying dynamic values inserted into HTML without context-aware encoding
- Code review checks covering every field emitted by HTML renderers, not only visible statistic values
- Tests that place HTML-sensitive characters in statistic names and verify they remain inert in rendered output
- Monitoring and policy enforcement that restricts exposure of administrative endpoints to trusted management networks
- Runtime review of unusual statistic names, unexpected markup, or administrative requests originating from operator browser sessions
Automated security testing and code-review tools may help identify missing output encoding when configured for server-side HTML generation.
