medium

ALB HTTP request smuggling

Published Fri, Oct 4th, 2019

Platforms

aws

Summary

ALBs found vulnerable to HTTP request smuggling (desync attack).

Affected Services

ALB

Remediation

Configure setting on your ALBs

Tracked CVEs

No tracked CVEs

References

https://twitter.com/arkadiyt/status/1180174359840862209https://docs.aws.amazon.com/elasticloadbalancing/latest/application/application-load-balancers.html

Contributed by https://github.com/0xdabbad00

Entry Status

Finalized

Disclosure Date

Fri, Oct 4th, 2019

Exploitability Period

-

Known ITW Exploitation

-

Detection Methods

None

Piercing Index Rating

-

Discovered by

James Kettle (Portswigger), Arkadiy Tetelman (Chime)

More vulnerabilities...

high

Google App Engine RCE Worth $36k

gcp

Researcher discovered access to non-production Google App Engine environments and internal APIs. This allowed configuring internal settings like Service Account IDs and quotas. Google considered it...

Ezequiel Pereira
high

Lake Formation data lake admin override

aws

Shortly after Lake Formation was made generally available, a bug was discovered that gave anyone the ability to view and override data lake admins for any account (an attacker would have only neede...

Ian Mckay
medium

AWS IAM role credential exfiltration via EC2 Instance Metadata Service (IMDSv1)

aws

AWS offers a metadata service accessible to most EC2 Instances via a simple GET request to 169.254.169.254. If an instance has an SSRF vulnerability, attackers can access the metadata service & exf...

View all