Details have been revealed about the 'Continuation flood' attack method, which affects various implementations of the HTTP/2 protocol, including Apache httpd, Apache Traffic Server, Node.js, oghttp, Go net/http2, Envoy, oghttp and nghttp2. This vulnerability can be exploited to launch attacks on servers that support HTTP/2.0, leading to memory exhaustion (causing request processing to stop or processes to crash) or creating high CPU load (slowing down request handling) depending on the implementation. According to the researcher who discovered the vulnerability, this issue is deemed more dangerous than the 'Rapid Reset' vulnerability found last year, which was used in the largest DDoS attacks of that time.
The high level of danger is explained by the fact that disrupting operations, crashing, or significantly reducing performance server, can be achieved by generating a stream of specially crafted requests from a regular computer. In certain cases, even a single TCP connection is sufficient to carry out an attack. Furthermore, the traffic associated with the attack is not distinguishable in logs against the backdrop of regular user requests.
The vulnerability is caused by the way HEADERS and CONTINUATION frames are processed in HTTP/2 requests. HEADERS frames are used in HTTP/2 to transmission HTTP headers, while CONTINUATION frames are for breaking the transmission of HTTP headers into multiple stages (for example, when headers do not fit into a single frame, or when initial headers can be sent in the current stage and additional headers, the values of which cannot be determined yet, are sent later). When headers are transmitted in several stages, a HEADERS frame is sent first without the END_HEADERS flag, followed by several CONTINUATION frames with additional headers, and finishing the list with a CONTINUATION frame with the END_HEADERS flag.
The attack method involves sending an unending stream of CONTINUATION frames without setting the END_HEADERS flag. Such activity leads to the transmission of server a large number of headers that the server keeps in memory until the available memory for the process is exhausted. To create a high load on the CPU, in addition to exhausting memory, an attacker can utilize the compression of CONTINUATION frame content using the HPACK format, the parsing of which requires computations. In HTTP/1.1 implementations, to protect against server header flooding, a limit on header size and a timeout for connection sending time were implemented. Due to the complexity of the protocol, many HTTP/2 implementations did not provide similar protection methods against endless header sending.
The vulnerability is especially dangerous for Node.js users (CVE-2024-27983), as this implementation allows crashing the server by sending just a few frames. Due to a race condition in Node.js, it is sufficient to close the connections during the sending of an unfinished headers stream to trigger a crash through an Assert check (the crash occurs if a CONTINUATION frame with the END_HEADERS flag has not yet arrived during connection closure). The vulnerability has been fixed in Node.js versions 18.20.1, 21.7.2, and 20.12.1, as well as in the latest releases of the llhttp and undici libraries. The new versions of Node.js also fixed a less dangerous vulnerability (CVE-2024-27982) of the 'request smuggling' class, which allows manipulation of the 'Content Length' value to intrude into the requests of other users handled in the same thread between the frontend and backend.
Vulnerabilities related to CONTINUATION handling in other HTTP/2.0 implementations:
- oghttp (CVE-2024-27919) — unbounded memory consumption.
- Tempesta FW (CVE-2024-2758) — bypassing limitations.
- PHP libraries amphp/http, amphp/http-client, and amphp/http-server (CVE-2024-2653) — unbounded memory consumption, leading to complete exhaustion of available memory.
- Go package net/http (CVE-2023-45288) — creating high CPU load.
- Library nghttp2 (CVE-2024-28182) — causing denial of service.
- Apache Httpd (CVE-2024-27316) — excessive memory consumption and CPU load generation.
- Apache Traffic Server (CVE-2024-31309) — excessive resource consumption.
- Envoy (CVE-2024-30255) — creating high CPU load (a stream of 300Mbit/s is required for full CPU core load).
Source: opennet.ru
