google cloud platform – GCP Loadbalancer allows Host header injection with “.” in URL

I have an API deployed on Google Cloud Run, which is exposed through a Google Cloud HTTP(S) Load Balancer. Recently, I noticed that adding a single . or ../ to the URL causes the service to return a 302 redirect.

Additionally, I discovered that by manipulating the Host header, I can redirect users to arbitrary domains.

Issue
When making requests like:

https://anydomain.com/./test
https://anydomain.com/../test

The server responds with a 302 redirect.

By adding a manipulated Host header, I can redirect users to an arbitrary domain:

Host: evil.com

Then I got a 302 with Location as

Location: https://evil.com/./test

This raises concerns about host header injection and its potential for malicious redirections.

This behavior doesn’t occur in a local development environment, only when the service is deployed to Cloud Run behind the Load Balancer.