Description
A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate service account access tokens. For successful exploitation, an administrator must initially establish an insecure configuration of the API proxy.
Problem types
CWE-918 Server-Side Request Forgery (SSRF)
Product status
Any version before 1.14.4
Any version before 1.15.2
Any version before 1.16.1
Credits
Nikita Markevich
References
docs.cloud.google.com/...curity-bulletins/security-bulletins