JWT authentication bypass via `X-HTTP-Method-Override` header

github.com

JWT authentication bypass via `X-HTTP-Method-Override` header

github.com

0xCBE@infosec.pub to

Red Team@infosec.pubEnglish · 3 years ago

## Summary ESPv2 contains an authentication bypass vulnerability. API clients can craft a malicious `X-HTTP-Method-Override` header value to bypass JWT authentication in specific cases. ## Ba...

You must log in or # to comment.

Chat

Red Team@infosec.pub

redteam@infosec.pub

Create a post

You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !redteam@infosec.pub

Red Teamers are here to break into your stuff before the bad guys do, and help you secure it. This is a place to discuss novel research, pentest tools and techniques, physical security and post memes about the Blue Team.

Join us! We have cookies. Blue Team’s cookies. >:)

Visibility: Public

This community can be federated to other instances and be posted/commented in by their users.

5 users / day
5 users / week
5 users / month
5 users / 6 months
1 local subscriber
515 subscribers
13 Posts
0 Comments
Modlog

mods:
administrator@infosec.pub

JWT authentication bypass via X-HTTP-Method-Override header

JWT authentication bypass via X-HTTP-Method-Override header

JWT authentication bypass via `X-HTTP-Method-Override` header

JWT authentication bypass via `X-HTTP-Method-Override` header