Back to Checks
aws

Classic Load Balancer desync mitigation mode is defensive or strictest

elb_desync_mitigation_mode
Service: elbSeverity: medium
OfficialBuilt-inVerified
Resource Type:AwsElbLoadBalancer

Classic Load Balancer desync_mitigation_mode is evaluated to determine whether it is configured as defensive or strictest. Any other mode (such as monitor) is identified for attention.

Prowler logoProwlerprowler-provider-aws

Risk

Without strict desync mitigation, HTTP request smuggling can occur, enabling:

  • Cache/queue poisoning (integrity)
  • Session hijacking and data exposure (confidentiality)
  • Unintended backend actions and abuse (availability)

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elb_desync_mitigation_mode

Recommendation

Set CLB desync mitigation to defensive or, where compatible, strictest. Validate in staging to avoid client breakage. Apply defense in depth: enforce strict header handling, pair with WAF controls, and monitor non-compliant request indicators.

Remediation

CLI

aws elb modify-load-balancer-attributes --load-balancer-name <load-balancer-name> --load-balancer-attributes '{"AdditionalAttributes":[{"Key":"elb.http.desyncmitigationmode","Value":"defensive"}]}'

Terraform

resource "aws_elb" "<example_resource_name>" {
  name               = "<example_resource_name>"
  availability_zones = ["<example_az>"]

  listener {
    instance_port     = 80
    instance_protocol = "http"
    lb_port           = 80
    lb_protocol       = "http"
  }

  desync_mitigation_mode = "defensive" # Critical: sets CLB desync mitigation to defensive to pass the check
}

Other

1Open the AWS Management Console and go to EC2
2Under Load Balancing, select Load Balancers
3Select your Classic Load Balancer
4On the Attributes tab, click Edit
5Set Desync mitigation mode to Defensive or Strictest
6Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elb.elb_client import elb_client


class elb_desync_mitigation_mode(Check):
    def execute(self):
        findings = []
        for lb in elb_client.loadbalancers.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=lb)
            if (
                lb.desync_mitigation_mode == "defensive"
                or lb.desync_mitigation_mode == "strictest"
            ):
                report.status = "PASS"
                report.status_extended = f"ELB {lb.name} has desync mitigation mode set to {lb.desync_mitigation_mode}."
            else:
                report.status = "FAIL"
                report.status_extended = f"ELB {lb.name} has desync mitigation mode set to {lb.desync_mitigation_mode}, not to strictest or defensive."

            findings.append(report)

        return findings

References