CVE-2021-32783: 
NixOS vulnerability analysis and mitigation

Contour, a Kubernetes ingress controller using Envoy proxy, disclosed a vulnerability (CVE-2021-32783) in versions prior to 1.17.1. The vulnerability allowed specially crafted ExternalName type Services to potentially access Envoy's admin interface, which Contour normally restricts to the Envoy container (GitHub Advisory).

The vulnerability stems from insufficient validation of ExternalName type Services, which could be exploited to expose Envoy's admin interface to the internet through a Service with an ExternalName of localhost or similar. The issue affects all versions <= 1.16 and version 1.17.0. The vulnerability has a CVSS v3.1 base score of 8.5 (High), with attack vector being Network, low attack complexity, low privileges required, and no user interaction needed (GitHub Advisory).

Successful exploitation of this vulnerability could allow attackers to shut down Envoy remotely (denial of service), expose the existence of any Secret that Envoy is using for its configuration (including TLS Keypairs metadata, but not their contents), change traffic routing, or drain traffic. While the admin interface cannot easily be used for making changes to the cluster or in-flight requests, it provides significant control over Envoy's operation (GitHub Advisory).

The vulnerability requires an attacker to have access to create Service objects inside a cluster running Contour. The attack involves creating a specially crafted ExternalName type Service pointing to localhost or similar addresses. It's noted that controlling access to ExternalName Services through RBAC alone is not sufficient without additional admission control measures (GitHub Advisory).

The vulnerability was patched in versions v1.14.2, 1.15.2, 1.16.1, 1.17.1, and 1.18.0. The fix includes two main changes: 1) ExternalName Service processing is disabled by default and must be explicitly enabled via the enableExternalNameService configuration option, and 2) When ExternalName Services are enabled, obvious attempts to expose localhost are prevented. Users are recommended to migrate away from ExternalName Services, particularly in production clusters (GitHub Release).