Summary
An AuthorizationPolicy DENY rule that specifies methods — or an ALLOW rule that specifies notMethods — is compiled to a case-sensitive :method matcher in Istio's Envoy configuration. Over HTTP/2, a request whose method differs only in case (for example, post instead of POST) does not match the rule and is forwarded to the workload, bypassing the authorization policy. HTTP/1.1 is not affected because the HTTP/1.1 codec rejects non-uppercase methods before authorization is evaluated. This is the same class of issue as CVE-2021-39155, which affected case-sensitive host matching.
Impact
Any service mesh workload protected by an AuthorizationPolicy that uses DENY with a methods list, or ALLOW with a notMethods list, may be reachable over HTTP/2 by sending the same HTTP method in a non-canonical case. An unauthenticated network attacker who can reach the workload over HTTP/2 can bypass method-based access controls — for example, calling a POST-only endpoint blocked by a DENY methods: [POST] rule by sending post. The CVSS:3.1/AV:N/AC:H vector reflects that the attacker must know the target policy's method restriction and be able to send HTTP/2 requests to the service, but no authentication or user interaction is required.
Detection
Audit your AuthorizationPolicy resources for any rule that contains a methods field under a DENY action, or a notMethods field under an ALLOW action. If such policies are present and the protected workloads accept HTTP/2 traffic, those policies are vulnerable on Istio versions prior to 1.29.9, 1.30.6, or 1.31.2. Review ingress and sidecar access logs for requests with lowercase or mixed-case HTTP methods that reached workloads they should have been denied access to.
Mitigation
Upgrade Istio to 1.29.9, 1.30.6, or 1.31.2, which fix the case-insensitive :method matching. As an immediate workaround without upgrading, replace DENY rules with a methods allow-list (use ALLOW policies with an explicit methods field instead of DENY/notMethods rules) — a case-mismatched method will not match the ALLOW rule's allow-list and will be denied by default.