Best practicesApplication load balancer without invalid HTTP header drop
Platform(s)
Compliance Frameworks
- AWS Foundational Security Best Practices Controls ,
- CCM-CSA ,
- iso_27001_2022 ,
- iso_27002_2022 ,
- New Zealand Information Security Manual ,
- NIST 800-53
Description
Application Load Balancers (ALB) are used to route HTTP and HTTPS traffic of web applications. HTTP headers contain information about the request and response messages between server and client (sender and receiver). Invalid HTTP headers might be subject to an HTTP desync attack. This attack exploits the way servers process HTTP requests by manipulating how the front-end and back-end interpret the HTTP request in order to smuggle content through the HTTP header. The smuggled content might help the attacker bypass security measures. It was found that the ALB '{AwsEc2Elbv2}' is not configured to drop invalid HTTP headers. It is recommended to remove invalid headers to prevent HTTP desync attacks.
Eyebrow option
Demo the Orca Platform
In just 10 minutes, you’ll see how Orca Security can revolutionize your cloud security strategy. Watch a recorded demo from a cloud security expert now.