Insecure service configuration - ELB
Description
A misconfiguration or default setting on Elastic Load Balancers that can cause to unintentionally increase the attack surface of the company cloud infrastructure.
Impact
- Result in the connection between load balancer and server being exploited.
- The front-end connection between the client and the load balancer is vulnerable to eavesdropping and man-in-the-middle (MitM) attacks.
Recommendation
- Application load balancers should use acceptable policies.
- Create a custom ELB SSL security policy that contains secure ciphers.
- Strongly advised that the load balancer uses a secure listener.
Threat
Unauthorized attacker from adjacent network performing a MitM.
Expected Remediation Time
⌚ 60 minutes.
Score
Default score using CVSS 3.1. It may change depending on the context of the src.
Base
- Attack vector: A
- Attack complexity: H
- Privileges required: N
- User interaction: R
- Scope: U
- Confidentiality: L
- Integrity: L
- Availability: N
Temporal
- Exploit code maturity: X
- Remediation level: X
- Report confidence: X
Result
- Vector string: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:X/RL:X/RC:X
- Score:
- Base: 3.7
- Temporal: 3.7
- Severity:
- Base: Low
- Temporal: Low
Score 4.0
Default score using CVSS 4.0 . It may change depending on the context of the src.
Base 4.0
- Attack vector: A
- Attack complexity: H
- Attack Requirements: N
- Privileges required: N
- User interaction: A
- Confidentiality (VC): L
- Integrity (VI): L
- Availability (VA): N
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: X
Result 4.0
- Vector string: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X
- Score:
- CVSS-BT: 2.0
- Severity:
- CVSS-BT: Low
Requirements
Fixes
free trial
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.