Summary
Envoy HTTP RBAC may incorrectly evaluate certain RFC-valid opaque header values when a negative safe_regex policy is combined with byte-oriented route matching. A downstream client able to send crafted header bytes could cause a request intended to be denied to reach a protected route, resulting in an authorization policy bypass.
Affected context
The issue occurs in Envoy HTTP RBAC configurations that use negative safe_regex matching for header-based authorization decisions alongside route matchers that inspect header bytes differently. It is most relevant when downstream clients can supply opaque header values containing a prohibited marker and an unrelated obs-text octet. Plain positive ALLOW regexes generally fail closed, and exact, prefix, suffix, and contains matchers are not known to exhibit the same subject-domain mismatch.
Exploit preconditions
- Attack surface: Envoy HTTP request handling and header-based RBAC evaluation
- Required access: Ability to send requests through an Envoy listener and control relevant header values
- Trigger point: Evaluation of a negative
safe_regexRBAC condition followed by byte-oriented route matching - Why exploitation is possible: RE2 evaluates the header subject using UTF-8 semantics, while another matcher may inspect the same opaque bytes directly, allowing inconsistent policy outcomes
Why this happens
The underlying defect is inconsistent handling of the input domain across security-relevant matchers. RFC-valid opaque header bytes are accepted, but RE2's UTF-8 subject semantics can cause a negative regular-expression check to return an ordinary no-match when the subject is not valid UTF-8. A byte-oriented route matcher can still detect the prohibited marker, creating a discrepancy between authorization evaluation and routing. This maps to CWE-20: Improper Input Validation, because the input's byte and encoding properties are not normalized or validated consistently before policy decisions are made.
Potential impact
- A request may bypass a negative RBAC rule
- Protected routes may become reachable by unauthorized clients
- Access to sensitive application operations or data could occur
- Authorization behavior may differ across equivalent header representations
General mitigation guidance
Mitigation generally focuses on making authorization matchers operate over a consistent, explicitly defined input domain.
Common defensive patterns include:
- Normalize or reject header values that do not conform to the encoding assumptions of the policy engine
- Prefer fail-closed authorization rules and avoid relying solely on negative regular-expression conditions
- Use matcher types whose byte and text semantics are well understood and consistent
- Keep route authorization decisions independent from ambiguous downstream header interpretation where possible
- Apply least-privilege RBAC policies and minimize the routes exposed to untrusted clients
- Test policy behavior with opaque, non-ASCII, malformed, and boundary-case header values
How teams detect issues like this
Detection can combine configuration review, targeted testing, and runtime monitoring:
- Flag negative
safe_regexRBAC rules applied to attacker-controlled headers - Review configurations for combinations of regex-based authorization and byte-oriented route matching
- Test equivalent header values across ASCII, obs-text, invalid UTF-8, and marker-containing cases
- Use policy checks to require explicit input normalization or rejection before authorization
- Monitor for denied-policy anomalies, unexpected route access, and divergent authorization outcomes
- Automated configuration and code review tools can help identify risky matcher combinations and missing fail-closed behavior
