PT-2023-23000 · Espv2 · Espv2

Panagiotisvasilikos · Published 2023-04-26 · Updated 2026-04-10 · CVE-2023-30845

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions ESPv2 versions 2.20.0 through 2.42.0

Description The issue allows API clients to bypass JWT authentication by crafting a malicious X-HTTP-Method-Override header value under specific conditions. This occurs when the requested HTTP method is not in the API service definition, and the specified X-HTTP-Method-Override is a valid HTTP method in the API service definition. As a result, ESPv2 will forward the request to the backend without checking the JWT, enabling attackers to bypass authentication. Restricting API access with API keys is not affected by this issue.

Recommendations Upgrade deployments to release v2.43.0 or higher to receive a patch, ensuring JWT authentication occurs even when the caller specifies x-http-method-override. As a temporary workaround, consider restricting the use of the X-HTTP-Method-Override header until the patch is applied.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-30845

GHSA-6QMP-9P95-FC5F

Affected Products

Espv2

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30845.json · Exploit
• 🔥 https://github.com/himori123/-CVE-2023-30845 · Exploit
• https://github.com/GoogleCloudPlatform/esp-v2/security/advisories/GHSA-6qmp-9p95-fc5f · Vendor Advisory
• https://github.com/GoogleCloudPlatform/esp-v2/commit/0bcdfc024ce96b34db4e1b4f2211b509d9be93cd · Patch
• https://github.com/GoogleCloudPlatform/esp-v2/commit/e95670146f5e96bb5565b0a9c1e153886b3e04ce · Patch
• https://github.com/GoogleCloudPlatform/esp-v2/commit/e98061ee4527a564506ba4e814c0ecf324dc2c6f · Patch
• https://osv.dev/vulnerability/CVE-2023-30845 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30845 · Security Note
• https://reddit.com/r/CVEWatch/comments/1sfoi9t/top_10_trending_cves_08042026 · Reddit Post
• https://twitter.com/hack_git/status/1706193148433572035 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1shi6yg/top_10_trending_cves_10042026 · Reddit Post
• https://t.me/cybersecuritytechnologies/9072 · Telegram Post
• https://t.me/cibsecurity/62949 · Telegram Post