GCP ESPv2 Hit with Critical API Authorization Bypass CVE-2023-30845

This post delves into a very impactful JWT Authentication Bypass vulnerability CVE-2023-30845 found in ESP-v2, an open-source service proxy that provides API management capabilities using Google Service Infrastructure. This vulnerability allows malicious API clients to bypass JWT authentication...

Authentication Bypass

github.com/GoogleCloudPlatform/esp-v2 is vulnerable to Authentication Bypass. The vulnerability exists because the library does not properly filter the malicious HTTP headers, which allows an attacker to send maliciously crafted X-HTTP-Method-Override header values to bypass JWT authentication in...

esp-v2:service_control_filter_fuzz_test: Global-buffer-overflow in google::api_proxy::service_control::set_response_code_class

Project: https://github.com/GoogleCloudPlatform/esp-v2.git Detailed Report: https://oss-fuzz.com/testcase?key=5753507539058688 Project: esp-v2 Fuzzing Engine: libFuzzer Fuzz Target: servicecontrolfilterfuzztest Job Type: libfuzzerasanesp-v2 Platform Id: linux Crash Type: Global-buffer-overflow RE...