Description

Detects AWS Application Load Balancers (ALBs) that are not configured to drop invalid HTTP header fields. When this security control is disabled, malicious actors could potentially exploit header vulnerabilities by sending malformed HTTP headers that might lead to HTTP desync attacks or request smuggling.

Detection Strategy

• Checks each Application Load Balancer in the AWS account and region

• Examines the load balancer attribute 'routing.http.drop_invalid_header_fields.enabled'

• Reports a vulnerability if this attribute is set to 'false'

• Only evaluates Application Load Balancers (Type: 'application') - Network Load Balancers and Gateway Load Balancers are excluded