GSD-2022-1002524

    Dashboard / Vulnerabilities / GSD-2022-1002524

    GSD-2022-1002524

    Published: 30 May 2022Last Modified: 14 Mar 2023

    Summary: input validation (CWE-20) in Elastic Load Balancer (ELB) version ELB prior to 2022-01-29 when "Legacy cache settings" is enabled

    Details: In Amazon Elastic Load Balancer (ELB) prior to 2022-01-29 when "Legacy cache settings" is enabled an input validation (CWE-20) vulnerability exists in the HTTP Header processing that can be attacked via the network (using a trailing space in the requests) resulting in HTTP Header Smuggling.

    References: https://twitter.com/nJoyneer/status/1526593840928411650, https://www.reddit.com/r/netsec/comments/uyz6zw/aws_universal_ratelimiter_bypass/, https://github.com/SummitRoute/csp_security_mistakes/issues/48

    Affected packages

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GSD-2022-1002524 | CVE-DB