Vulnerability-Lookup

CVE-2025-25294 (GCVE-0-2025-25294)

Vulnerability from cvelistv5 – Published: 2025-03-06 18:46 – Updated: 2025-03-06 20:34

Title

Envoy Gateway Log Injection Vulnerability

Summary

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the attacker uses a specially crafted user-agent which performs json injection, then he could add and overwrite fields to the access log. This vulnerability is fixed in 1.3.1 and 1.2.7. One can overwrite the old text based default format with JSON formatter by modifying the "EnvoyProxy.spec.telemetry.accessLog" setting.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-06 20:33 UTC

CWE

CWE-117 - Improper Output Neutralization for Logs

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/envoyproxy/gateway/security/ad…	x_refsource_CONFIRM
https://github.com/envoyproxy/gateway/commit/8f48…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
envoyproxy	gateway	Affected: >= 1.3.0-rc.1, < 1.3.1 Affected: < 1.2.7	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-25294",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-06T20:33:40.307756Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-06T20:34:27.649Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gateway",
          "vendor": "envoyproxy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.3.0-rc.1, \u003c 1.3.1"
            },
            {
              "status": "affected",
              "version": "\u003c 1.2.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the attacker uses a specially crafted user-agent which performs json injection, then he could add and overwrite fields to the access log. This vulnerability is fixed in 1.3.1 and 1.2.7. One can overwrite the old text based default format with JSON formatter by modifying the \"EnvoyProxy.spec.telemetry.accessLog\" setting."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117: Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-06T18:46:23.913Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-mf24-chxh-hmvj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-mf24-chxh-hmvj"
        },
        {
          "name": "https://github.com/envoyproxy/gateway/commit/8f48f5199cf1bbb9a8ac0695c5171bfef6c9198a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/envoyproxy/gateway/commit/8f48f5199cf1bbb9a8ac0695c5171bfef6c9198a"
        }
      ],
      "source": {
        "advisory": "GHSA-mf24-chxh-hmvj",
        "discovery": "UNKNOWN"
      },
      "title": "Envoy Gateway Log Injection Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-25294",
    "datePublished": "2025-03-06T18:46:23.913Z",
    "dateReserved": "2025-02-06T17:13:33.122Z",
    "dateUpdated": "2025-03-06T20:34:27.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-25294",
      "date": "2026-09-14",
      "epss": "0.0028",
      "percentile": "0.20452"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-25294\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2025-03-06T19:15:27.267\",\"lastModified\":\"2026-06-17T09:00:38.020\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the attacker uses a specially crafted user-agent which performs json injection, then he could add and overwrite fields to the access log. This vulnerability is fixed in 1.3.1 and 1.2.7. One can overwrite the old text based default format with JSON formatter by modifying the \\\"EnvoyProxy.spec.telemetry.accessLog\\\" setting.\"},{\"lang\":\"es\",\"value\":\"Envoy Gateway es un proyecto de c\u00f3digo abierto para administrar Envoy Proxy como una puerta de enlace de aplicaciones independiente o basada en Kubernetes. En todas las versiones de Envoy Gateway anteriores a 1.2.7 y 1.3.1 se utiliza una configuraci\u00f3n de registro de acceso de Envoy Proxy predeterminada. Este formato es vulnerable a ataques de inyecci\u00f3n de registros. Si el atacante utiliza un agente de usuario especialmente manipulado que realiza una inyecci\u00f3n JSON, podr\u00eda agregar y sobrescribir campos en el registro de acceso. Esta vulnerabilidad se solucion\u00f3 en 1.3.1 y 1.2.7. Se puede sobrescribir el antiguo formato predeterminado basado en texto con el formateador JSON modificando la configuraci\u00f3n \\\"EnvoyProxy.spec.telemetry.accessLog\\\".\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"envoyproxy\",\"product\":\"gateway\",\"versions\":[{\"version\":\"\u003e= 1.3.0-rc.1, \u003c 1.3.1\",\"status\":\"affected\"},{\"version\":\"\u003c 1.2.7\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-03-06T20:33:40.307756Z\",\"id\":\"CVE-2025-25294\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-117\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:gateway:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.2.7\",\"matchCriteriaId\":\"6993284B-B381-40CA-83B2-A03F3AB4664A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:gateway:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.3.0\",\"versionEndExcluding\":\"1.3.1\",\"matchCriteriaId\":\"200AFC8A-EE02-46F6-A8F2-AE6D222921BE\"}]}]}],\"references\":[{\"url\":\"https://github.com/envoyproxy/gateway/commit/8f48f5199cf1bbb9a8ac0695c5171bfef6c9198a\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/envoyproxy/gateway/security/advisories/GHSA-mf24-chxh-hmvj\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T08:20:24+00:00",
      "cve": "CVE-2025-25294",
      "id": "CVE-2025-25294",
      "initial_release_date": "2025-03-06T18:46:23.913000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "envoyproxy/gateway: Envoy Gateway Log Injection Vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-25294.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-27T00:35:16Z",
      "cve": "CVE-2025-25294",
      "id": "CVE-2025-25294",
      "initial_release_date": "2025-03-14T02:57:23Z",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-25294",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-25294.json",
      "version": "8"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-25294\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-06T20:33:40.307756Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-06T20:34:16.724Z\"}}], \"cna\": {\"title\": \"Envoy Gateway Log Injection Vulnerability\", \"source\": {\"advisory\": \"GHSA-mf24-chxh-hmvj\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"envoyproxy\", \"product\": \"gateway\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 1.3.0-rc.1, \u003c 1.3.1\"}, {\"status\": \"affected\", \"version\": \"\u003c 1.2.7\"}]}], \"references\": [{\"url\": \"https://github.com/envoyproxy/gateway/security/advisories/GHSA-mf24-chxh-hmvj\", \"name\": \"https://github.com/envoyproxy/gateway/security/advisories/GHSA-mf24-chxh-hmvj\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/envoyproxy/gateway/commit/8f48f5199cf1bbb9a8ac0695c5171bfef6c9198a\", \"name\": \"https://github.com/envoyproxy/gateway/commit/8f48f5199cf1bbb9a8ac0695c5171bfef6c9198a\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the attacker uses a specially crafted user-agent which performs json injection, then he could add and overwrite fields to the access log. This vulnerability is fixed in 1.3.1 and 1.2.7. One can overwrite the old text based default format with JSON formatter by modifying the \\\"EnvoyProxy.spec.telemetry.accessLog\\\" setting.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-117\", \"description\": \"CWE-117: Improper Output Neutralization for Logs\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-03-06T18:46:23.913Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-25294\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-06T20:34:27.649Z\", \"dateReserved\": \"2025-02-06T17:13:33.122Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-03-06T18:46:23.913Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-25294

Vulnerability from fkie_nvd - Published: 2025-03-06 19:15 - Updated: 2026-06-17 09:00

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/envoyproxy/gateway/commit/8f48f5199cf1bbb9a8ac0695c5171bfef6c9198a	Patch
	security-advisories@github.com	https://github.com/envoyproxy/gateway/security/advisories/GHSA-mf24-chxh-hmvj	Mitigation, Third Party Advisory

Impacted products

	Vendor	Product	Version
	envoyproxy	gateway	*
	envoyproxy	gateway	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "gateway",
          "vendor": "envoyproxy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.3.0-rc.1, \u003c 1.3.1"
            },
            {
              "status": "affected",
              "version": "\u003c 1.2.7"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:envoyproxy:gateway:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6993284B-B381-40CA-83B2-A03F3AB4664A",
              "versionEndExcluding": "1.2.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:envoyproxy:gateway:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "200AFC8A-EE02-46F6-A8F2-AE6D222921BE",
              "versionEndExcluding": "1.3.1",
              "versionStartIncluding": "1.3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the attacker uses a specially crafted user-agent which performs json injection, then he could add and overwrite fields to the access log. This vulnerability is fixed in 1.3.1 and 1.2.7. One can overwrite the old text based default format with JSON formatter by modifying the \"EnvoyProxy.spec.telemetry.accessLog\" setting."
    },
    {
      "lang": "es",
      "value": "Envoy Gateway es un proyecto de c\u00f3digo abierto para administrar Envoy Proxy como una puerta de enlace de aplicaciones independiente o basada en Kubernetes. En todas las versiones de Envoy Gateway anteriores a 1.2.7 y 1.3.1 se utiliza una configuraci\u00f3n de registro de acceso de Envoy Proxy predeterminada. Este formato es vulnerable a ataques de inyecci\u00f3n de registros. Si el atacante utiliza un agente de usuario especialmente manipulado que realiza una inyecci\u00f3n JSON, podr\u00eda agregar y sobrescribir campos en el registro de acceso. Esta vulnerabilidad se solucion\u00f3 en 1.3.1 y 1.2.7. Se puede sobrescribir el antiguo formato predeterminado basado en texto con el formateador JSON modificando la configuraci\u00f3n \"EnvoyProxy.spec.telemetry.accessLog\"."
    }
  ],
  "id": "CVE-2025-25294",
  "lastModified": "2026-06-17T09:00:38.020",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-25294",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-03-06T20:33:40.307756Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-03-06T19:15:27.267",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/envoyproxy/gateway/commit/8f48f5199cf1bbb9a8ac0695c5171bfef6c9198a"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-mf24-chxh-hmvj"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-117"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-MF24-CHXH-HMVJ

Vulnerability from github – Published: 2025-03-06 19:11 – Updated: 2025-03-11 17:15

Summary

Envoy Gateway Log Injection Vulnerability

Details

Impact

In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks.

If the attacker uses a specially crafted user-agent which performs json injection, then he could add and overwrite fields to the access log.

Examples of attacks include:

Using following string as user agent : HELLO-WORLD", "evil-ip": "1.1.1.1", "x-forwarded-for": "1.1.1.1 would lead to setting of new access log properties and overwrite of existing properties. Existing properties such as the value of the X-Forwarded-For header may have importance for security analysis of access logs, and their overwrite can be used to hide malicious activity.
Using the following string as user-agent : " which renders an invalid json document. The invalid document may fail to be processed by observability solutions, which would allow attacker to hide malicious activity.

Patches

1.3.1, 1.2.7

Fix

Using JSON format as the default format for access logs. The logged document will contain the same key and values as before. Only the order of properties is different inside the logged document.

Workaround

One can overwrite the old text based default format with JSON formatter by setting the following property: "EnvoyProxy.spec.telemetry.accessLog" to

settings:
- format:
    type: JSON
    json:
      start_time: '%START_TIME%'
      method: '%REQ(:METHOD)%'
      x-envoy-origin-path: '%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%'
      protocol: '%PROTOCOL%'
      response_code: '%RESPONSE_CODE%'
      response_flags: '%RESPONSE_FLAGS%'
      response_code_details: '%RESPONSE_CODE_DETAILS%'
      connection_termination_details: '%CONNECTION_TERMINATION_DETAILS%'
      upstream_transport_failure_reason: '%UPSTREAM_TRANSPORT_FAILURE_REASON%'
      bytes_received: '%BYTES_RECEIVED%'
      bytes_sent: '%BYTES_SENT%'
      duration: '%DURATION%'
      x-envoy-upstream-service-time: '%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%'
      x-forwarded-for: '%REQ(X-FORWARDED-FOR)%'
      user-agent: '%REQ(USER-AGENT)%'
      x-request-id: '%REQ(X-REQUEST-ID)%'
      :authority: '%REQ(:AUTHORITY)%'
      upstream_host: '%UPSTREAM_HOST%'
      upstream_cluster: '%UPSTREAM_CLUSTER%'
      upstream_local_address: '%UPSTREAM_LOCAL_ADDRESS%'
      downstream_local_address: '%DOWNSTREAM_LOCAL_ADDRESS%'
      downstream_remote_address: '%DOWNSTREAM_REMOTE_ADDRESS%'
      requested_server_name: '%REQUESTED_SERVER_NAME%'
      route_name: '%ROUTE_NAME%'

see API definition here

References

Are there any links users can visit to find out more?

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/envoyproxy/gateway"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/envoyproxy/gateway"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.3.0-rc.1"
            },
            {
              "fixed": "1.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-25294"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-117"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-06T19:11:39Z",
    "nvd_published_at": "2025-03-06T19:15:27Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nIn all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. \n\nIf the attacker uses a specially crafted user-agent which performs json injection, then he could add and overwrite fields to the access log. \n\nExamples of attacks include:\n\n-  Using following string as user agent : `HELLO-WORLD\", \"evil-ip\": \"1.1.1.1\", \"x-forwarded-for\": \"1.1.1.1` would lead to setting of new access log properties and overwrite of existing properties. Existing properties such as the value of the X-Forwarded-For header may have importance for security analysis of access logs, and their overwrite can be used to hide malicious activity. \n\n- Using the following string as user-agent : `\"` which renders an invalid json document. The invalid document may fail to be processed by observability solutions, which would allow attacker to hide malicious activity.  \n\n### Patches\n1.3.1, 1.2.7\n\n### Fix\nUsing JSON format as the default format for access logs. The logged document will contain the same key and values as before. Only the order of properties is different inside the logged document.\n\n### Workaround\nOne can overwrite the old text based default format with JSON formatter by setting the following property: \n\"EnvoyProxy.spec.telemetry.[accessLog](https://gateway.envoyproxy.io/v1.3/api/extension_types/#proxyaccesslog)\" to \n\n```\nsettings:\n- format:\n    type: JSON\n    json:\n      start_time: \u0027%START_TIME%\u0027\n      method: \u0027%REQ(:METHOD)%\u0027\n      x-envoy-origin-path: \u0027%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%\u0027\n      protocol: \u0027%PROTOCOL%\u0027\n      response_code: \u0027%RESPONSE_CODE%\u0027\n      response_flags: \u0027%RESPONSE_FLAGS%\u0027\n      response_code_details: \u0027%RESPONSE_CODE_DETAILS%\u0027\n      connection_termination_details: \u0027%CONNECTION_TERMINATION_DETAILS%\u0027\n      upstream_transport_failure_reason: \u0027%UPSTREAM_TRANSPORT_FAILURE_REASON%\u0027\n      bytes_received: \u0027%BYTES_RECEIVED%\u0027\n      bytes_sent: \u0027%BYTES_SENT%\u0027\n      duration: \u0027%DURATION%\u0027\n      x-envoy-upstream-service-time: \u0027%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%\u0027\n      x-forwarded-for: \u0027%REQ(X-FORWARDED-FOR)%\u0027\n      user-agent: \u0027%REQ(USER-AGENT)%\u0027\n      x-request-id: \u0027%REQ(X-REQUEST-ID)%\u0027\n      :authority: \u0027%REQ(:AUTHORITY)%\u0027\n      upstream_host: \u0027%UPSTREAM_HOST%\u0027\n      upstream_cluster: \u0027%UPSTREAM_CLUSTER%\u0027\n      upstream_local_address: \u0027%UPSTREAM_LOCAL_ADDRESS%\u0027\n      downstream_local_address: \u0027%DOWNSTREAM_LOCAL_ADDRESS%\u0027\n      downstream_remote_address: \u0027%DOWNSTREAM_REMOTE_ADDRESS%\u0027\n      requested_server_name: \u0027%REQUESTED_SERVER_NAME%\u0027\n      route_name: \u0027%ROUTE_NAME%\u0027\n```\nsee API definition [here](https://gateway.envoyproxy.io/v1.3/api/extension_types/#proxyaccesslogformat)\n\n### References\n_Are there any links users can visit to find out more?_",
  "id": "GHSA-mf24-chxh-hmvj",
  "modified": "2025-03-11T17:15:37Z",
  "published": "2025-03-06T19:11:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/envoyproxy/gateway/security/advisories/GHSA-mf24-chxh-hmvj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25294"
    },
    {
      "type": "WEB",
      "url": "https://github.com/envoyproxy/gateway/commit/041d474a70d5921e5d65e6e14ea60e14dac70b01"
    },
    {
      "type": "WEB",
      "url": "https://github.com/envoyproxy/gateway/commit/358bed50dcb7b32f39a2edb252fb1399c7fc65dc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/envoyproxy/gateway/commit/8f48f5199cf1bbb9a8ac0695c5171bfef6c9198a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/envoyproxy/gateway"
    },
    {
      "type": "WEB",
      "url": "https://github.com/envoyproxy/gateway/releases/tag/v1.2.7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/envoyproxy/gateway/releases/tag/v1.3.1"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2025-3504"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Envoy Gateway Log Injection Vulnerability"
}

OPENSUSE-SU-2025:14889-1

Vulnerability from csaf_opensuse - Published: 2025-03-13 00:00 - Updated: 2025-03-13 00:00

Summary

govulncheck-vulndb-0.0.20250312T181707-1.1 on GA media

Severity

Moderate

Scope

31 vulnerabilities in this advisory, including CVE-2025-25294.

CVE-2025-25294

Recommended: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2025-25294 (GCVE-0-2025-25294)

FKIE_CVE-2025-25294

GHSA-MF24-CHXH-HMVJ

Impact

Patches

Fix

Workaround

References

OPENSUSE-SU-2025:14889-1

Tags

Sightings

Nomenclature