⬇ Download holy card: ·
Blessed ALBeast, the Beast of the Load Balancer
Patron of AWS load balancers, tokens signed by the wrong service, and configurations that "work as intended".
Life
On 20 August 2024 Miggo described ALBeast, a weakness in apps that rely on AWS Application Load Balancer authentication. An attacker could stand up their own ALB, sign a token of their choosing and change its issuer to match the victim's: AWS signed it anyway, and the app accepted it. Miggo estimated over 15,000 potentially exposed applications.
Prayer
O Blessed ALBeast, who makes AWS sign the tokens you write, let our apps always check who signed, and not merely that a signature exists. Amen.
How to celebrate
Celebrated by verifying the issuer and the load balancer's ARN and accepting traffic only from your own ALB.
Right signature, wrong signer.