CVE-2024-34363: 
NixOS vulnerability analysis and mitigation

Envoy, a cloud-native open source edge and service proxy, was found to contain a vulnerability (CVE-2024-34363) where incomplete UTF-8 strings could trigger an uncaught exception in the nlohmann JSON library, leading to a crash. The vulnerability affects Envoy versions from 1.28.0 and has been patched in versions 1.30.2, 1.29.5, and 1.28.4 (GitHub Advisory).

The vulnerability stems from how Envoy invokes the nlohmann JSON library during JSON serialization. When processing untrusted user input with incomplete UTF-8 strings, particularly in scenarios where JSON access logs with sort_properties are enabled or when using the HTTP composite filter with downstream data stored in filter state objects, the library throws an uncaught exception. This exception results in a crash of the Envoy process. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (GitHub Advisory).

When exploited, this vulnerability leads to a denial of service condition by causing Envoy to crash. This is particularly impactful as it can be triggered with a simple request containing malformed UTF-8 strings, making it trivial to disrupt service operations (GitHub Advisory).

The vulnerability is easily exploitable through HTTP requests with specifically crafted headers. A proof of concept demonstrates that the issue can be triggered by sending a request with a malformed X-Forwarded-For header when JSON access logs with sort_properties are enabled (GitHub Advisory).

Users should upgrade to the patched versions: Envoy 1.30.2, 1.29.5, or 1.28.4. These versions contain fixes for the vulnerability (GitHub Advisory).