Contour, a Kubernetes ingress controller using Envoy proxy, contains a code injection vulnerability (CWE-94) in its Cookie Rewriting feature in versions >=1.19.0 and <1.31.6, >=1.32.0 and <1.32.5, and >=1.33.0 and <1.33.4. The vulnerability occurs because user-controlled values in HTTPProxy resources are interpolated into Lua code without sufficient sanitization, enabling an attacker with RBAC permissions to inject arbitrary Lua code executed by Envoy's HTTP Lua filter. This can lead to arbitrary code execution within the Envoy proxy process, including reading xDS client credentials or causing denial of service for other tenants. The vulnerability is fixed in versions 1.31.6, 1.32.5, and 1.33.4.

An attacker with RBAC permissions to create or modify HTTPProxy resources can exploit this vulnerability to execute arbitrary Lua code within the Envoy proxy process. This can compromise the confidentiality of Envoy's xDS client credentials and disrupt service availability for other tenants sharing the Envoy instance. The vulnerability does not allow code execution outside the Envoy process or on routes not controlled by the attacker.

This vulnerability is fixed in contour versions 1.31.6, 1.32.5, and 1.33.4. Users should upgrade to one of these fixed versions to remediate the issue. Patch status is not explicitly stated beyond these fixed versions, so verify with the vendor advisory for the latest remediation guidance. No alternative mitigations are provided in the available data.