Piercing the Cloud Armor – The 8KB Bypass in Google Cloud Platform WAF

Re:Piercing the Cloud Armor – The 8KB Bypass in Google Cloud... by flightofthefox on Saturday March 12, 2022 @02:28AM (#30649664)

Solution seems funky. Attackers could just omit the Content-Length header

[ Parent | on HN ]

Re:Piercing the Cloud Armor – The 8KB Bypass in Google Cloud... by parts on Saturday March 12, 2022 @01:45PM (#30653698)

If you omit the Content-Length header from an HTTP request, the server will not process the request body.

See: https://reqbin.com/Article/ContentLength

"If the value of the Content-Length header is zero, or if neither the Transfer-Encoding header nor the Content-Length header is specified, then the message has no body. "

[ Parent | on HN ]

Re:Piercing the Cloud Armor – The 8KB Bypass in Google Cloud... by ypeter on Saturday March 12, 2022 @02:35AM (#30649703)

Maybe Cloud Armor calculates en sets it?

[ Parent | on HN ]