Listen to this Post
This vulnerability, CVE-2025-53007, affects Envoy’s certificate validation when using the `match_typed_subject_alt_names` filter with the `OTHERNAME` type. When a client certificate’s Subject Alternative Name (SAN) is encoded as a `BMPSTRING` or `UNIVERSALSTRING` and contains an embedded null byte (\0), the string conversion process within Envoy incorrectly truncates the comparison. Internally, during UTF-8 conversion for string assignment, the string is terminated at the first null byte. This means a certificate containing the SAN value “victim\0evil” will be incorrectly matched against a rule configured for an exact match of “victim”. The matcher fails to validate the entire string length, allowing a malformed certificate with a suffix after the null to impersonate a trusted identity.
Platform: Envoy proxy
Version: 1.33.12 to 1.36.2
Vulnerability : SAN Null Byte
Severity: Moderate
date: 2025-12-03
Prediction: Patched 2025-12-05
What Undercode Say:
Generate a malicious certificate with null byte in SAN openssl req -new -key client.key -out client_null.csr -subj "/CN=client" -addext "otherName=1.3.6.1.4.1.311.20.2.3;UTF8:victim\0evil"
Envoy vulnerable configuration snippet transport_socket: name: envoy.transport_sockets.tls typed_config: "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext require_client_certificate: true match_typed_subject_alt_names: - san_type: OTHERNAME oid: 1.3.6.1.4.1.311.20.2.3 matcher: exact: "victim"
How Exploit:
Obtain trusted certificate.
Embed null byte.
Bypass identity check.
Impersonate authorized service.
Protection from this CVE
Upgrade to patched versions: 1.33.13, 1.34.11, 1.35.7, or 1.36.3.
Impact:
Unauthorized impersonation.
Access protected APIs.
Security policy bypass.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
