Summary

CORS filter will segfault and crash Envoy when the origin header is removed and deleted between decodeHeadersand encodeHeaders.

Affected components

HTTP CORS filter

Details

In the CORS filter's decodeHeaders method, a pointer to the origin header is captured. If the origin header is configured to be removed, a segfault crash will occur when the pointer is used again in encodeHeaders since it has been dereferenced.

PoC

• User configuration: origin header is configured to be removed with request_headers_to_remove: origin,
  https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route.proto
• decodeHeaders stores the pointer of origin, and then the header is removed.
• A segfault crash will occur in encodeHeader in CORS filter.

Impact

There will be a segfault crash in the CORS filter

Mitigation

Not removing the origin header in Envoy configuration

Detection

Crashes in CORS filter.