CVE-2023-30845: Improper Authentication (CWE-287)
value: ESPv2 is a service proxy that provides API management capabilities using Google Service Infrastructure. ESPv2 2.20.0 through 2.42.0 contains an authentication bypass vulnerability. API clients can craft a malicious `X-HTTP-Method-Override` header value to bypass JWT authentication in specific cases.

ESPv2 allows malicious requests to bypass authentication if both the conditions are true: The requested HTTP method is **not** in the API service definition (OpenAPI spec or gRPC `google.api.http` proto annotations, and the specified `X-HTTP-Method-Override` is a valid HTTP method in the API service definition. ESPv2 will forward the request to your backend without checking the JWT. Attackers can craft requests with a malicious `X-HTTP-Method-Override` value that allows them to bypass specifying JWTs. Restricting API access with API keys works as intended and is not affected by this vulnerability.

Upgrade deployments to release v2.43.0 or higher to receive a patch. This release ensures that JWT authentication occurs, even when the caller specifies `x-http-method-override`. `x-http-method-override` is still supported by v2.43.0+. API clients can continue sending this header to ESPv2.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.8
Published: 2023-04-26T21:15Z
Repository: https://github.com/GoogleCloudPlatform/esp-v2
Language: C++
Files changed: api/README.md, src/envoy/http/service_control/filter.cc
Commit date: 2023-03-28 12:09:59 -0500
Commit message: Add back in HTTP method override in service control filter (#802)

This is NOT used by ESPv2, but it is needed for CAG temporarily. We can remove once their rollout is complete.

Signed-off-by: Teju Nareddy <nareddyt@google.com>
Diff: diff --git a/api/README.md b/api/README.md
index e20679b9..09c07bf6 100644
--- a/api/README.md
+++ b/api/README.md
@@ -10,12 +10,12 @@ The proto package names contain version too, e.g. `espv2.api.envoy.v11.http.comm
 ## Versioning Rules:
 When making changes to the config proto files, make sure:
 * No breaking changes, the changes should be backward compatible,
 * If a breaking change is required, increase config version.
 
-When making changes to Config Manager, make sure the new config is compatible
-with older Envoy binaries under the current API version. If it's incompatible,
+When making changes to Config Manager, make sure that **older** config generator binaries are compatible
+with **newer** Envoy binaries under the current API version. If it's incompatible,
 increase the config version.
 
 ## Steps to increase config version
 If a breaking change is required, use following steps to increase config version.
 * Increase `api/VERSION` to a newer version, e.g. from `v6` to `v7`.
diff --git a/src/envoy/http/service_control/filter.cc b/src/envoy/http/service_control/filter.cc
index a2e5d9d2..8b9c451a 100644
--- a/src/envoy/http/service_control/filter.cc
+++ b/src/envoy/http/service_control/filter.cc
@@ -51,10 +51,18 @@ Envoy::Http::FilterHeadersStatus ServiceControlFilter::decodeHeaders(
                                            utils::kRcDetailErrorTypeBadRequest,
                                            utils::kRcDetailErrorMissingPath));
     return Envoy::Http::FilterHeadersStatus::StopIteration;
   }
 
+  // TODO(b/273531500): Temporary until CAG rollout is complete.
+  if (utils::handleHttpMethodOverride(headers)) {
+    // Update later filters that the HTTP method has changed by clearing the
+    // route cache.
+    ENVOY_LOG(debug, "HTTP method override occurred, recalculating route");
+    decoder_callbacks_->downstreamCallbacks()->clearRouteCache();
+  }
+
   // Make sure route is calculated
   auto route = decoder_callbacks_->route();
 
   // This shouldn't happen as the catch-all route match should catch all
   // the undefined requests.

Vulnerable code: When making changes to Config Manager, make sure the new config is compatible
with older Envoy binaries under the current API version. If it's incompatible,
Fixed code: When making changes to Config Manager, make sure that **older** config generator binaries are compatible
with **newer** Envoy binaries under the current API version. If it's incompatible,
  // TODO(b/273531500): Temporary until CAG rollout is complete.
  if (utils::handleHttpMethodOverride(headers)) {
    // Update later filters that the HTTP method has changed by clearing the
    // route cache.
    ENVOY_LOG(debug, "HTTP method override occurred, recalculating route");
    decoder_callbacks_->downstreamCallbacks()->clearRouteCache();
  }