Manipulating health-check endpoints or responses can cause healthy targets to be marked unavailable, leading to denial of service.
Health Checks Are Exploited to Take Services Offline
CCC.LB.TH05
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.LB.CP12 | Target Health Checks | The service automatically performs continuous health checks on backend targets by checking the response to an HTTP request, a TCP connection, or another application-specific parameter. |
| CCC.LB.CP13 | Health Checks-based Target Removal | The service automatically removes a backend target from its list of available targets when a health check detects that the target is unhealthy, so that traffic is no longer routed to that target. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.LB.CN10 | Protect Health-Check Endpoints | Ensure that health-check results cannot be influenced by entities other than the load balancer, so that healthy targets are not removed from service. |