{"id":114790,"date":"2024-04-04T18:25:42","date_gmt":"2024-04-04T16:25:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0"},"modified":"2024-04-04T18:25:42","modified_gmt":"2024-04-04T16:25:42","slug":"ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0","title":{"rendered":"\u00datok Continuation flood, kter\u00fd zp\u016fsobuje probl\u00e9my na serverech pou\u017e\u00edvaj\u00edc\u00edch HTTP\/2.0.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Byly zve\u0159ejn\u011bny informace o metod\u011b \u00fatoku \u201eContinuation flood\u201c, kter\u00e1 se t\u00fdk\u00e1 r\u016fzn\u00fdch implementac\u00ed protokolu HTTP\/2, mezi kter\u00e9 pat\u0159\u00ed Apache httpd, Apache Traffic Server, Node.js, oghttp, Go net\/http2, Envoy, oghttp a nghttp2. Zranitelnost m\u016f\u017ee b\u00fdt vyu\u017eita k \u00fatok\u016fm na servery podporuj\u00edc\u00ed HTTP\/2.0 a v z\u00e1vislosti na implementaci zp\u016fsobuje vy\u010derp\u00e1n\u00ed pam\u011bti (ukon\u010den\u00ed zpracov\u00e1n\u00ed po\u017eadavk\u016f nebo hav\u00e1rii proces\u016f) nebo vytv\u00e1\u0159\u00ed vysokou z\u00e1t\u011b\u017e na CPU (zpoma\u013euje zpracov\u00e1n\u00ed po\u017eadavk\u016f). Podle n\u00e1zoru v\u00fdzkumn\u00edka, kter\u00fd zranitelnost objevil, je tento probl\u00e9m nebezpe\u010dn\u011bj\u0161\u00ed ne\u017e zranitelnost \u201eRapid Reset\u201c, kter\u00e1 byla nalezena minul\u00fd rok a byla pou\u017eita k proveden\u00ed nejv\u011bt\u0161\u00edch DDoS \u00fatok\u016f t\u00e9 doby. <\/p>\n

Vysok\u00e1 \u00farove\u0148 nebezpe\u010d\u00ed je vysv\u011btlena t\u00edm, \u017ee k naru\u0161en\u00ed funkce serveru<\/a>, k z\u00e1niku nebo v\u00e1\u017en\u00e9mu sn\u00ed\u017een\u00ed v\u00fdkonu sta\u010d\u00ed vytvo\u0159it tok speci\u00e1ln\u011b form\u00e1tovan\u00fdch po\u017eadavk\u016f z jednoho b\u011b\u017en\u00e9ho po\u010d\u00edta\u010de. V ur\u010dit\u00e9m p\u0159\u00edpad\u011b posta\u010duje k proveden\u00ed \u00fatoku dokonce jedno TCP spojen\u00ed. P\u0159itom souvisej\u00edc\u00ed s \u00fatokem provoz nijak nevy\u010dn\u00edv\u00e1 v log\u00e1ch na pozad\u00ed b\u011b\u017en\u00fdch u\u017eivatelsk\u00fdch po\u017eadavk\u016f. <\/p>\n

Zranitelnost je zp\u016fsobena zvl\u00e1\u0161tnostmi zpracov\u00e1n\u00ed r\u00e1mc\u016f HEADERS a CONTINUATION v po\u017eadavc\u00edch podle protokolu HTTP\/2. R\u00e1mce HEADERS se pou\u017e\u00edvaj\u00ed v HTTP\/2 k p\u0159enosu HTTP hlavi\u010dek a r\u00e1mce CONTINUATION pro rozd\u011blen\u00ed odes\u00edl\u00e1n\u00ed HTTP hlavi\u010dek na n\u011bkolik f\u00e1z\u00ed (nap\u0159\u00edklad kdy\u017e se hlavi\u010dky nevejdou do jednoho r\u00e1mce nebo kdy\u017e je nejprve t\u0159eba odeslat hlavi\u010dky, kter\u00e9 lze vyplnit v aktu\u00e1ln\u00edm kroku, a pot\u00e9 p\u0159idat hlavi\u010dky, jejich\u017e hodnoty nejsou zat\u00edm ur\u010deny). P\u0159i p\u0159enosu hlavi\u010dek ve v\u00edce f\u00e1z\u00edch je nejprve odesl\u00e1n r\u00e1mec HEADERS bez flagu END_HEADERS, za n\u00edm n\u00e1sleduje n\u011bkolik r\u00e1mc\u016f CONTINUATION s dal\u0161\u00edmi hlavi\u010dkami a seznam kon\u010d\u00ed r\u00e1mcem CONTINUATION s flagem END_HEADERS. <\/p>\n

Metoda \u00fatoku spo\u010d\u00edv\u00e1 v odes\u00edl\u00e1n\u00ed nep\u0159etr\u017eit\u00e9ho toku r\u00e1mc\u016f CONTINUATION bez nastaven\u00ed flagu END_HEADERS. Takov\u00e1 aktivita vede k p\u0159enosu na server<\/a> velk\u00e9ho mno\u017estv\u00ed hlavi\u010dek, kter\u00e9 server uchov\u00e1v\u00e1 v opera\u010dn\u00ed pam\u011bti, dokud nen\u00ed vy\u010derp\u00e1na dostupn\u00e1 pam\u011b\u0165 procesu. K vytvo\u0159en\u00ed vysok\u00e9ho zat\u00ed\u017een\u00ed CPU m\u016f\u017ee \u00fato\u010dn\u00edk krom\u011b vy\u010derp\u00e1n\u00ed pam\u011bti vyu\u017e\u00edt kompresi obsahu r\u00e1mc\u016f CONTINUATION pomoc\u00ed form\u00e1tu HPACK, jeho\u017e rozbor vy\u017eaduje v\u00fdpo\u010dty. V implementac\u00edch protokolu HTTP\/1.1 byl pro ochranu proti zaplavov\u00e1n\u00ed serveru hlavi\u010dkami pou\u017eit limit velikosti hlavi\u010dek a \u010dasov\u00fd limit pro odes\u00edl\u00e1n\u00ed p\u0159ipojen\u00ed. U HTTP\/2, vzhledem ke slo\u017eitosti protokolu, mnoho implementac\u00ed nenab\u00edz\u00ed podobn\u00e9 metody ochrany proti nekone\u010dn\u00e9mu odes\u00edl\u00e1n\u00ed hlavi\u010dek. <\/p>\n

Nejv\u011bt\u0161\u00ed hrozbu p\u0159edstavuje zranitelnost pro u\u017eivatele Node.js (CVE-2024-27983), proto\u017ee tato implementace umo\u017e\u0148uje zp\u016fsobit hav\u00e1rii odesl\u00e1n\u00edm pouh\u00fdch n\u011bkolika r\u00e1mc\u016f na server. Kv\u016fli podm\u00ednce z\u00e1vodu v Node.js sta\u010d\u00ed uzav\u0159\u00edt p\u0159ipojen\u00ed b\u011bhem odes\u00edl\u00e1n\u00ed nedokon\u010den\u00e9ho proudu hlavi\u010dek (hav\u00e1rie, pokud b\u011bhem uzav\u0159en\u00ed p\u0159ipojen\u00ed je\u0161t\u011b nedorazil r\u00e1mec CONTINUATION s p\u0159\u00edznakem END_HEADERS). Zranitelnost byla opravena v Node.js 18.20.1, 21.7.2 a 20.12.1, stejn\u011b jako v nejnov\u011bj\u0161\u00edch vyd\u00e1n\u00edch knihoven llhttp a undici. V nov\u00fdch verz\u00edch Node.js byla tak\u00e9 odstran\u011bna m\u00e9n\u011b nebezpe\u010dn\u00e1 zranitelnost (CVE-2024-27982) t\u0159\u00eddy \u201erequest smuggling\u201c, kter\u00e1 umo\u017e\u0148uje prost\u0159ednictv\u00edm manipulace se hodnotou \u201eContent Length\u201c proniknout do obsahu po\u017eadavk\u016f jin\u00fdch u\u017eivatel\u016f zpracov\u00e1van\u00fdch ve stejn\u00e9m vl\u00e1kn\u011b mezi frontendem a backendem. <\/p>\n

Zranitelnosti souvisej\u00edc\u00ed se zpracov\u00e1n\u00edm CONTINUATION v dal\u0161\u00edch implementac\u00edch HTTP\/2.0: <\/p>\n