CVE-2024-8912: Google Cloud Looker HTTP Smuggling Flaw

CVE-2024-8912 Overview

CVE-2024-8912 is an HTTP Request Smuggling vulnerability [CWE-444] in Google Cloud Looker. The flaw allowed an unauthenticated attacker to capture HTTP responses intended for legitimate users, exposing sensitive session data and application content over the network.

Google reports that the Looker (Google Cloud core) hosted offering was vulnerable but has been mitigated, with no signs of exploitation observed. The Looker (original) hosted product was not affected. Customer-hosted Looker instances remain vulnerable until upgraded to a patched release.

Critical Impact
An unauthenticated, network-based attacker can intercept HTTP responses destined for other Looker users, leading to disclosure of confidential analytics data and session information.

Affected Products

Google Cloud Looker (Google Cloud core) — mitigated by Google
Looker customer-hosted instances prior to patched versions
Affected branches: 23.12, 23.18, 24.0, 24.6, 24.8, 24.10, 24.12, 24.14

Discovery Timeline

2024-10-11 - CVE-2024-8912 published to the National Vulnerability Database (NVD)
2025-07-30 - Last updated in the NVD database

Technical Details for CVE-2024-8912

Vulnerability Analysis

HTTP Request Smuggling [CWE-444] arises when front-end and back-end HTTP processors disagree on where one request ends and the next begins. In Looker, inconsistent parsing of request boundaries between intermediaries and the application server allowed an attacker to inject a partial request into the connection stream. The server then attached the response for a legitimate user's request to the attacker's smuggled request.

The outcome is response queue poisoning. An attacker reading from the shared connection receives HTTP responses generated for other authenticated users. These responses can contain dashboards, query results, authentication cookies, and other session-bound material.

Exploitation requires only network access to the Looker HTTP endpoint and does not require valid credentials or user interaction. Because Looker handles business intelligence data, intercepted responses commonly include regulated or proprietary content.

Root Cause

The root cause is inconsistent handling of HTTP message framing headers — Content-Length and Transfer-Encoding — between an upstream proxy and the Looker application stack. Discrepancies in how each layer interprets these headers permit a single TCP connection to carry attacker-controlled boundaries.

Attack Vector

The attack vector is remote and unauthenticated. An attacker sends a crafted HTTP request containing ambiguous or conflicting framing to the Looker endpoint. By keeping the connection open or reusing pooled back-end connections, the attacker captures responses queued for concurrent legitimate users. No prior authentication or social engineering is required, though the attack complexity is increased by the need to time requests against legitimate traffic.

No public proof-of-concept exploit code has been released for CVE-2024-8912. Refer to the Google Cloud Security Bulletin for vendor-confirmed technical context.

Detection Methods for CVE-2024-8912

Indicators of Compromise

HTTP requests to Looker containing both Content-Length and Transfer-Encoding: chunked headers, or duplicated framing headers
Unexpected pairing of client IP addresses with responses containing other users' session identifiers or dashboard payloads
Anomalous spikes in long-lived keep-alive connections to Looker front-end services from a small set of source IPs

Detection Strategies

Inspect proxy and load-balancer access logs for malformed framing headers and reject requests with conflicting Content-Length/Transfer-Encoding values
Correlate Looker authentication events with source IP addresses to surface sessions reused or hijacked across distinct clients
Run signature checks for known HTTP smuggling payloads using tools such as smuggler.py or commercial WAF rule sets tuned for CL.TE and TE.CL variants

Monitoring Recommendations

Forward Looker, reverse proxy, and load balancer logs to a centralized analytics platform for correlation against the indicators above
Alert on HTTP 400-class responses that immediately precede successful authenticated responses on the same connection
Monitor for outbound data volume anomalies from Looker, which may indicate bulk response capture by an attacker

How to Mitigate CVE-2024-8912

Immediate Actions Required

Identify all customer-hosted Looker deployments and inventory their current versions against the fixed releases listed below
Upgrade vulnerable instances to a patched build available on the Looker download page as soon as possible
Rotate Looker session secrets, API keys, and user credentials after upgrading, given the possibility of prior response capture

Patch Information

Upgrade Looker customer-hosted instances to one of the following minimum versions: 23.12.123+, 23.18.117+, 24.0.92+, 24.6.77+, 24.8.66+, 24.10.78+, 24.12.56+, or 24.14.37+. Google has already remediated Looker (Google Cloud core); Looker (original) was not affected. Full vendor guidance is available in the Google Cloud Security Bulletin.

Workarounds

Place a strict HTTP/1.1-compliant reverse proxy in front of Looker that rejects requests containing both Content-Length and Transfer-Encoding headers
Disable HTTP connection reuse (keep-alive) between front-end proxies and Looker back-ends until patching is complete
Restrict network access to Looker endpoints to known corporate IP ranges via firewall or VPN where business requirements allow

bash

# Example NGINX configuration to drop ambiguous HTTP framing
if ($http_transfer_encoding ~* "chunked") {
    set $smuggle_risk "1";
}
if ($http_content_length) {
    set $smuggle_risk "${smuggle_risk}1";
}
if ($smuggle_risk = "11") {
    return 400;
}