Classic Load Balancer desync mitigation mode is defensive or strictest
elb_desync_mitigation_mode
Classic Load Balancer desync_mitigation_mode is evaluated to determine whether it is configured as defensive or strictest. Any other mode (such as monitor) is identified for attention.
Risk
Without strict desync mitigation, HTTP request smuggling can occur, enabling:
- Cache/queue poisoning (integrity)
- Session hijacking and data exposure (confidentiality)
- Unintended backend actions and abuse (availability)
prowler aws --checks elb_desync_mitigation_mode
Recommendation
Set CLB desync mitigation to defensive or, where compatible, strictest. Validate in staging to avoid client breakage. Apply defense in depth: enforce strict header handling, pair with WAF controls, and monitor non-compliant request indicators.
Remediation
aws elb modify-load-balancer-attributes --load-balancer-name <load-balancer-name> --load-balancer-attributes '{"AdditionalAttributes":[{"Key":"elb.http.desyncmitigationmode","Value":"defensive"}]}'
- Open the AWS Management Console and go to EC2
- Under Load Balancing, select Load Balancers
- Select your Classic Load Balancer
- On the Attributes tab, click Edit
- Set Desync mitigation mode to Defensive or Strictest
- Click Save changes
Source Code
Resource Type
AwsElbLoadBalancer
References
- https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/config-desync-mitigation-mode.html
- https://docs.aws.amazon.com/securityhub/latest/userguide/elb-controls.html#elb-14
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/ELB/enable-configure-desync-mitigation-mode.html
- https://support.icompaas.com/support/solutions/articles/62000233337-ensure-classic-load-balancer-is-configured-with-defensive-or-strictest-desync-mitigation-mode