CVE-2025-4600: Google Cloud ALB Request Smuggling Flaw

CVE-2025-4600 Overview

A request smuggling vulnerability existed in the Google Cloud Classic Application Load Balancer due to improper handling of chunked-encoded HTTP requests. This allowed attackers to craft requests that could be misinterpreted by backend servers. The issue was fixed by disallowing stray data after a chunk, and is no longer exploitable. No action is required as Classic Application Load Balancer service after 2025-04-26 is not vulnerable.

Critical Impact

Attackers could exploit this HTTP Request Smuggling vulnerability to bypass security controls, poison web caches, hijack user sessions, or deliver malicious payloads to backend servers behind the Google Cloud Classic Application Load Balancer.

Affected Products

• Google Application Load Balancer (Classic)
• Google Cloud Classic Application Load Balancer versions prior to 2025-04-26
• Backend servers connected to vulnerable Classic Application Load Balancer instances

Discovery Timeline

• 2025-05-16 - CVE-2025-4600 published to NVD
• 2025-09-26 - Last updated in NVD database

Technical Details for CVE-2025-4600

Vulnerability Analysis

This vulnerability is classified under CWE-444 (Inconsistent Interpretation of HTTP Requests), which describes scenarios where a web server, intermediary, or backend system handles HTTP requests in an inconsistent manner, enabling request smuggling attacks.

The flaw resided in how the Google Cloud Classic Application Load Balancer processed chunked transfer encoding in HTTP requests. When handling chunked-encoded requests, the load balancer failed to properly validate and reject stray data appearing after a chunk. This inconsistency between how the load balancer and backend servers interpreted the same HTTP stream created a desynchronization condition.

Attackers could leverage this desynchronization to inject or "smuggle" additional HTTP requests within what appears to be a single legitimate request. The load balancer would process the outer request envelope while the backend server would interpret the smuggled request as a separate, valid request.

This type of vulnerability enables several attack scenarios including bypassing access controls, web cache poisoning, credential hijacking, and unauthorized access to backend resources that should be protected by the load balancer's security policies.

Root Cause

The root cause was improper handling of chunked transfer encoding in the Classic Application Load Balancer. Specifically, the load balancer did not properly discard or reject extraneous data following a complete chunk in chunked-encoded HTTP requests. This parsing inconsistency between the load balancer and backend servers allowed attackers to craft malformed requests that would be interpreted differently by each component in the request chain, leading to request boundary confusion.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction. An attacker could send specially crafted HTTP requests containing chunked transfer encoding with carefully positioned payload data. The attack flow involves:

1. The attacker sends a malformed HTTP request with chunked encoding containing embedded requests after the chunk terminator
2. The Classic Application Load Balancer processes the outer request and forwards it to the backend
3. The backend server interprets the stray data as the beginning of a new, separate HTTP request
4. This smuggled request executes in the context of the victim's session or bypasses security controls

The vulnerability mechanism exploits the discrepancy in how HTTP message boundaries are determined between the load balancer and origin servers. By manipulating Transfer-Encoding: chunked headers and chunk delimiters, an attacker could inject arbitrary HTTP requests that the backend would process as legitimate traffic originating from the load balancer.

Detection Methods for CVE-2025-4600

Indicators of Compromise

• Unusual patterns in HTTP request logs showing malformed or oversized Transfer-Encoding: chunked requests
• Backend server logs indicating unexpected requests appearing without corresponding load balancer logs
• Anomalous session behavior where requests appear to be processed in wrong user contexts
• Web cache entries containing unexpected or malicious content

Detection Strategies

• Monitor HTTP traffic for requests containing unusual chunked encoding patterns or multiple chunk terminators
• Implement deep packet inspection to identify HTTP desynchronization attempts
• Analyze backend server logs for requests that lack corresponding entries in the load balancer access logs
• Deploy web application firewall rules specifically targeting request smuggling patterns

Monitoring Recommendations

• Enable detailed logging on both the Classic Application Load Balancer and backend servers to correlate request patterns
• Configure alerts for HTTP 400 errors or parsing failures that may indicate smuggling attempts
• Monitor for cache poisoning indicators such as unexpected cache entries or cache key mismatches
• Review application-level logs for signs of unauthorized access or session anomalies

How to Mitigate CVE-2025-4600

Immediate Actions Required

• Verify your Classic Application Load Balancer deployment is using the patched version (post 2025-04-26)
• Review recent logs for any indicators of exploitation prior to the patch date
• Ensure backend servers have their own HTTP parsing hardening in place as defense-in-depth
• Consider implementing additional request validation at the application layer

Patch Information

Google has remediated this vulnerability in the Classic Application Load Balancer service. The fix was implemented by disallowing stray data after a chunk in chunked-encoded HTTP requests. As of 2025-04-26, the Classic Application Load Balancer service is no longer vulnerable, and no customer action is required. For complete details, refer to the Google Cloud Security Bulletin.

Workarounds

• Deploy web application firewall rules to detect and block HTTP request smuggling patterns
• Configure backend servers to use strict HTTP parsing modes that reject ambiguous requests
• Implement connection-level isolation between the load balancer and backends where feasible
• Monitor and alert on unusual HTTP traffic patterns indicative of smuggling attempts

# Verify your Google Cloud load balancer configuration
# Check the creation/modification date of your Classic Application Load Balancer
gcloud compute backend-services describe YOUR_BACKEND_SERVICE --global --format="get(creationTimestamp)"

# Review recent HTTP logs for suspicious chunked encoding patterns
gcloud logging read "resource.type=http_load_balancer AND httpRequest.requestMethod!=GET" --limit=100 --format=json