A flaw was found in Istio in all versions released after 1.3 (included). The flaw is in Istio's Authentication Policy exact path matching logic and can allow unauthorized access to a HTTP path, even if the path is configured to be only accessed with a valid JWT token.
Mitigation: Depending on the paths used in the exact match clause, it is possible to update the path to a regex. As provided by the Istio Product Committee, the following mitigation can be employed. The original policy specifying a JWT protected path is as follows: --- apiVersion: "authentication.istio.io/v1alpha1" kind: "Policy" metadata: name: "jwt-example" namespace: istio-system spec: targets: - name: istio-ingressgateway origins: - jwt: issuer: "testing.io" jwksUri: "https://raw.githubusercontent.com/istio/istio/release-1.4/security/tools/jwt/samples/jwks.json" trigger_rules: - included_paths: - exact: /productpage The exact path definition can then be updated to a regular expression: --- - jwt: issuer: "testing.io" jwksUri: "https://raw.githubusercontent.com/istio/istio/release-1.4/security/tools/jwt/samples/jwks.json" trigger_rules: - included_paths: - regex: '/productpage(\?.*)?' - regex: '/productpage(#.*)?'
Acknowledgments: Name: The Istio Product Security Committee
This issue has been addressed in the following products: OpenShift Service Mesh 1.0 Via RHSA-2020:0477 https://access.redhat.com/errata/RHSA-2020:0477
External References: https://istio.io/news/security/istio-security-2020-001/
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-8595