CERT-In Advisory
CIAD-2023-0035
Distributed Denial of Service (DDoS) Attacks against HTTP/2
Original Issue Date: October 11, 2023
Severity Rating: High
Software Affected
Overview
A vulnerability has been reported in HTTP/2 protocol which could allow an attacker to perform Distributed Denial of Service (DDoS) attacks on the targeted system.
Description
HTTP/2 protocols are used to make applications faster, simpler and more robust by streamlining communication between the browser and server. HTTP/2 Rapid Reset/DDoS attack was made possible by abusing some features of the HTTP/2 protocol and server implementation.
This vulnerability exists due to a flaw in the implementation of HTTP/2 protocol. An attacker could exploit this vulnerability by sending a set number of HTTP requests using HEADERS followed by RST_STREAM and repeating this pattern to generate a high volume of traffic on the targeted HTTP/2 servers. Successful exploitation of this vulnerability could allow an attacker to perform Distributed Denial of Service (DDoS) attacks on the targeted system.
Any vendor, organization or individual that is serving an HTTP-based workload using Web applications, services, and APIs on a server using the HTTP/2 protocol could be vulnerable to this attack.
Note: This attack technique is being exploited in the wild. Users are advised to apply patches and other mitigation techniques urgently.
Solution
Apply appropriate security updates to the latest product versions immediately or once they are released by the respective vendors and other mitigation techniques as applicable.
Vendor Information
Microsoft
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487
https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/
Google
https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps
Cloudflare
https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
Amazon
https://aws.amazon.com/security/security-bulletins/AWS-2023-011/
F5
https://my.f5.com/manage/s/article/K000137106
References
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487
https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/
https://www.helpnetsecurity.com/2023/10/10/cve-2023-44487-http-2-rapid-reset/
https://thehackernews.com/2023/10/http2-rapid-reset-zero-day.html
https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps
https://aws.amazon.com/security/security-bulletins/AWS-2023-011/
https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
CVE Name
CVE-2023-44487
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|