I think the issue is that the servers "silently" support brotli. Then nobody uses it, but the attacker can still abuse the feature.
So as a hotfix I block this on my reverse proxy.
I think the issue is that the servers "silently" support brotli. Then nobody uses it, but the attacker can still abuse the feature.
So as a hotfix I block this on my reverse proxy.
But is that actually true?
It seems like node supports it with body parser enabled.
But im having trouble finding any docs suggesting anything else supports it on inbound requests.
Obviously there are other scenarios where it is exploitable, but it is a much less severe vuln if the attacker must first force the program to make an outbound request to a server of its chosing rather than just connect to a vulnerable server.