CVE-2025-25294: Envoyproxy Gateway Log Injection Flaw

CVE-2025-25294 Overview

CVE-2025-25294 is a log injection vulnerability in Envoy Gateway, an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. All versions prior to 1.2.7 and 1.3.1 ship a text-based default Envoy Proxy access log configuration. Attackers can send a specially crafted User-Agent header containing JSON injection payloads to add or overwrite fields in downstream access logs. The vulnerability is tracked under [CWE-117] Improper Output Neutralization for Logs. Envoy Gateway versions 1.2.7 and 1.3.1 replace the default text formatter with a JSON formatter that safely encodes untrusted fields.

Critical Impact
Attackers can forge or overwrite fields in Envoy Proxy access logs by injecting crafted content through the User-Agent header, undermining audit integrity and downstream log analysis.

Affected Products

Envoy Gateway versions prior to 1.2.7
Envoy Gateway versions 1.3.0 and prior to 1.3.1
Deployments relying on the default EnvoyProxy.spec.telemetry.accessLog configuration

Discovery Timeline

2025-03-06 - CVE-2025-25294 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25294

Vulnerability Analysis

Envoy Gateway configures Envoy Proxy access logging using a default text-based formatter when EnvoyProxy.spec.telemetry.accessLog is not explicitly overridden. The text formatter concatenates request attributes, including the client-supplied User-Agent header, without escaping structural characters. Log aggregators and SIEM pipelines that parse these lines as JSON or delimited records will accept injected fields as legitimate log data.

An attacker crafts a User-Agent value containing JSON delimiters and additional key-value pairs. When downstream tooling ingests the emitted log line, the injected content splits into new fields or overwrites existing ones such as response_code, path, or authority. This corrupts forensic evidence and can mask malicious activity by rewriting attributes attributed to the request.

Root Cause

The root cause is the use of an unescaped text access log format as the default. Envoy's text formatter does not neutralize control characters or JSON syntax in header values, so any attacker-controlled field written verbatim into the log becomes an injection primitive.

Attack Vector

Exploitation requires only network reachability to a gateway route. The attacker sends an HTTP request with a malicious User-Agent header. No authentication or user interaction is required. Impact is limited to log integrity; confidentiality and availability are not directly affected.

// Patch: internal/gatewayapi/listener.go
		(!envoyproxy.Spec.Telemetry.AccessLog.Disable && len(envoyproxy.Spec.Telemetry.AccessLog.Settings) == 0) {
		// use the default access log
		return &ir.AccessLog{
-			Text: []*ir.TextAccessLog{
+			JSON: []*ir.JSONAccessLog{
				{
					Path: "/dev/stdout",
				},

Source: Envoy Gateway commit 8f48f51. The patch swaps the default TextAccessLog for a JSONAccessLog, which encodes field values so injected delimiters are neutralized.

Detection Methods for CVE-2025-25294

Indicators of Compromise

Access log entries containing unexpected JSON braces, quotes, or newline characters inside User-Agent values.
Log records with duplicated keys such as two response_code or path fields on the same request.
Requests whose logged User-Agent includes escape sequences like \", \n, or JSON control characters.
Discrepancies between upstream Envoy raw logs and downstream SIEM-parsed events for the same request ID.

Detection Strategies

Parse Envoy access logs with a strict JSON parser and alert on malformed records or fields containing embedded structural tokens.
Compare header lengths and character sets against RFC 7231 expectations, flagging User-Agent values with {, }, or unescaped quotes.
Correlate gateway access logs with upstream service logs to detect fields that appear only in gateway output.

Monitoring Recommendations

Ingest Envoy Gateway logs into a centralized platform and normalize with OCSF to spot schema anomalies.
Monitor for spikes in requests carrying oversized or high-entropy User-Agent headers.
Retain raw pre-parsed log lines so injected content can be reconstructed during incident response.

How to Mitigate CVE-2025-25294

Immediate Actions Required

Upgrade Envoy Gateway to version 1.2.7 or 1.3.1 as documented in the GHSA-mf24-chxh-hmvj advisory.
Audit EnvoyProxy.spec.telemetry.accessLog settings across all EnvoyProxy resources in the cluster.
Reprocess historical access logs to identify injected records before they influence detections or dashboards.

Patch Information

The fix is delivered in Envoy Gateway 1.2.7 and 1.3.1 via commit 8f48f519. The patch changes the default access log formatter from text to JSON, which escapes user-controlled fields. See the GitHub commit for the diff.

Workarounds

Override the default text formatter with a JSON formatter by populating EnvoyProxy.spec.telemetry.accessLog.settings before upgrading.
Strip or normalize the User-Agent header at an upstream proxy or WAF before requests reach Envoy Gateway.
Disable the default access log with EnvoyProxy.spec.telemetry.accessLog.disable: true if logging is handled elsewhere.

yaml

# Configuration example: force JSON access log formatter
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
  name: custom-proxy-config
  namespace: envoy-gateway-system
spec:
  telemetry:
    accessLog:
      settings:
        - format:
            type: JSON
            json:
              start_time: "%START_TIME%"
              method: "%REQ(:METHOD)%"
              path: "%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%"
              response_code: "%RESPONSE_CODE%"
              user_agent: "%REQ(USER-AGENT)%"
          sinks:
            - type: File
              file:
                path: /dev/stdout