CVE-2024-8912
📋 TL;DR
An HTTP Request Smuggling vulnerability in Looker allows attackers to intercept HTTP responses intended for legitimate users. This affects customer-hosted Looker instances, while Google Cloud-hosted Looker has already been mitigated.
💻 Affected Systems
- Looker (customer-hosted)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal sensitive user data, session tokens, or credentials from intercepted HTTP responses.
Likely Case
Unauthorized data access and potential session hijacking for users of vulnerable instances.
If Mitigated
No impact if patched or using Google Cloud-hosted Looker (already mitigated).
🎯 Exploit Status
HTTP Request Smuggling typically requires understanding of HTTP protocol manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 23.12.123+, 23.18.117+, 24.0.92+, 24.6.77+, 24.8.66+, 24.10.78+, 24.12.56+, 24.14.37+
Vendor Advisory: https://cloud.google.com/looker/docs/best-practices/security-bulletin-09-16-24
Restart Required: Yes
Instructions:
1. Download latest supported version from https://download.looker.com/ 2. Backup current installation 3. Install update following Looker documentation 4. Restart Looker service
🔧 Temporary Workarounds
WAF Configuration
allConfigure Web Application Firewall to detect and block HTTP request smuggling attempts
🧯 If You Can't Patch
- Implement strict WAF rules for HTTP request validation
- Monitor for unusual HTTP traffic patterns and response interception attempts
🔍 How to Verify
Check if Vulnerable:
Check Looker version against vulnerable versions list. If running older than patched versions, assume vulnerable.Check Version:
Check Looker admin interface or configuration files for version informationVerify Fix Applied:
Verify Looker version matches or exceeds patched versions listed in advisory.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP request patterns
- Multiple requests with same connection
- Malformed HTTP headers
Network Indicators:
- HTTP traffic with TE/CL transfer encoding confusion
- Unexpected response interceptions
SIEM Query:
Look for HTTP requests with conflicting Transfer-Encoding and Content-Length headers to Looker instances