Summary
A flaw in AWS API Gateway enabled hiding HTTP request headers. Tampering
with HTTP requests visibility enabled bypassing IP restrictions, cache poisoning
and request smuggling.
Affected Services
API Gateway
Remediation
None required
Tracked CVEs
No tracked CVEs
References
Contributed by https://github.com/a10ns
Entry Status
Finalized
Disclosure Date
Wed, Nov 10th, 2021
Exploitablity Period
-
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
Daniel Thatcher, intruder
