Piercing the Cloud Armor – The 8KB Bypass in Google Cloud Platform WAF

Re:Piercing the Cloud Armor – The 8KB Bypass in Google Cloud... by parts on Saturday March 12, 2022 @01:51PM (#30653757)

Hi, article author here. Cloud Armor will drop requests without regard to the size of the request body for HTTP PUT or PATCH request (i.e., the payload won't have to padded with 8192 bytes, like in the case of POST requests.) Of course, for an attacker to successfully exploit this, the underlying application would have to be configured to accept and process PUT/PATCH requests.

As for query parameters in GET requests, I'm not entirely sure about Cloud Armor's limits there. I'll check and get back to you.

[ Parent | on HN ]

Re:Piercing the Cloud Armor – The 8KB Bypass in Google Cloud... by wafwafwaf on Monday March 14, 2022 @02:45AM (#30669201)

https://docs.aws.amazon.com/waf/latest/developerguide/limits...

Pad your POST query by 8k and you are through!

[ Parent | on HN ]

Re:Piercing the Cloud Armor – The 8KB Bypass in Google Cloud... by trulyme on Sunday March 13, 2022 @01:36AM (#30658556)

Thank you for the clarification!

[ Parent | on HN ]