Notice on HTTP/2 Rapid Reset Attack Vulnerability (CVE-2023-4487)

Details

This HTTP/2 vulnerability allows malicious actors to launch a DDoS attack targeting HTTP/2 servers. The attack sends a group of HTTP requests using HEADERS and RST_STREAM and repeating this pattern to generate a high volume of traffic on the targeted HTTP/2 servers. By packing multiple HEADERS and RST_STREAM frames in a single connection, attackers can cause a significant increase in the request per second and high CPU utilization on the servers that eventually can cause resource consumption. This results in service request rejection.

Impact

This DDoS attack does not lead to the compromise of user data. However, malicious attackers may exploit this vulnerability to launch DDoS attacks targeting HTTP/2 servers, causing the servers to break down.

Solution

Harden security group protections in your VPC, so that interfaces are exposed only to trusted users.

Reference

HTTP/2 Rapid Reset Attack Vulnerability

Technical Details

The HTTP/2 protocol allows multiple requests or responses over a single connection. Each HTTP request or response uses a unique data stream. A data stream on a connection is called a data frame. Each data frame contains a fixed header, which specifies the data frame type and the ID of the data stream that the data frame belongs to. Table 2 lists some important data frame types.

Assume that the maximum number of concurrent streams set for the current TCP connection is 1. After sending request 1, the client sends request 2 immediately. In this case, the server does not process request 2 but directly responds to the RST_STREAM frame. If the client sends the RST_STREAM frame immediately after sending a request, the client can continuously send requests to the server without waiting for any response. The server, however, is trapped in a loop of continuously receiving requests, processing requests, and directly ending requests. This process consumes some system resources.

Malicious attackers can exploit this vulnerability to continuously pack HEADERS and RST_STREAM frames to consume server resources, affecting the processing of normal requests by the server and causing DDoS attacks.

• Maximum number of concurrent streams: HTTP/2 allows you to set the maximum number of concurrent streams on a TCP connection to limit the number of requests.
• DDoS attack: occurs when multiple machines are operating together to attack one target to disrupt the normal traffic of a targeted server, service or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic.