In October 10 2023, it was announced that Google, Amazon Web Services (AWS) and Cloudflare took steps to mitigate a high number of DDoS (Distributed Denial-of-Service) attacks that relied on a new vulnerability called HTTP/2 Rapid Reset. According to them, the attacks were detected in late August 2023. HTTP/2 Rapid Reset is tracked as CVE-2023-44487, and carries a CVSS score of 7.5 out of a maximum of 10.
CVE Identifier: CVE-2023-44487
Severity: High (CVSS score: 7.5)
HTTP/2 Rapid Reset is a serious security flaw in layer 7 (application layer) that affects the HTTP/2 protocol, which is widely used by many websites and applications to communicate over the Internet.
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly according to MITRE.
Specifically, the HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending an RST_STREAM frame. The client may assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame. This attack is called Rapid Reset because it relies on the ability for an endpoint to send an RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled but leaves the HTTP/2 connection open.
This vulnerability allows attackers to launch massive DDoS attacks by sending and canceling requests in rapid succession. This leads to servers’ congestion and overload which then results in their inability to respond to legitimate traffic. The DDoS attacks can affect any server or application that supports HTTP/2, unless they have proper protection measures in place.
This vulnerability has been taken advantage of, by threat actors to carry out some of the largest DDoS attacks ever recorded. The attacks have affected huge providers like Google, AWS and Cloudflare. Specifically, according to Google “These attacks were significantly larger than any previously-reported Layer 7 attacks, with the largest attack surpassing 398 million requests per second”
As mentioned before, the above providers have coordinated and taken measures to mitigate the attacks. However, other servers and applications that use HTTP/2 may still be vulnerable.
It is necessary that the companies with servers and applications that use this protocol take measures as soon as possible.
https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/
https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
https://thehackernews.com/2023/10/http2-rapid-reset-zero-day.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-44487
https://aws.amazon.com/security/security-bulletins/AWS-2023-011/
https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/