Summary

Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme checks in Envoy are case-sensitive, leading to incorrect handling of requests and responses with mixed case schemes.

Affected component(s)

HTTP and some related HTTP filters, like http/cache, OAuth2, and ssl redirect checks.

Details

Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme checks are case-sensitive, which can lead to the rejection of requests with mixed-case schemes such as htTp or htTps, or the bypassing of some requests such as https in unencrypted connections.

With this fix, Envoy will now lowercase scheme values by default, and change the internal scheme checks that were case-sensitive to be case-insensitive.

Attack vector(s)

A HTTP request with mixed case scheme

PoC

For example, if a request with mixed scheme htTp is sent to the OAuth2 filter, it will fail the exact-match checks for http, and inform the remote endpoint the scheme is https, thus potentially bypassing OAuth2 checks specific to HTTP requests.

Impact

Bypass some requests with mixed schemes.

Mitigation

None