{"id":114790,"date":"2024-04-04T18:25:42","date_gmt":"2024-04-04T16:25:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0"},"modified":"2024-04-04T18:25:42","modified_gmt":"2024-04-04T16:25:42","slug":"ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0","title":{"rendered":"Continuation flood attack leading to issues on servers using HTTP\/2.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Details have emerged about the \"Continuation flood\" attack method affecting various implementations of the HTTP\/2 protocol, including Apache httpd, Apache Traffic Server, Node.js, oghttp, Go net\/http2, Envoy, oghttp, and nghttp2. This vulnerability can be exploited to attack servers that support HTTP\/2.0 and, depending on the implementation, can lead to memory exhaustion (halting request processing or crashing processes) or creating high CPU load (slowing down request handling). According to the researcher who discovered the vulnerability, this issue is more dangerous than the \"Rapid Reset\" vulnerability found last year, which was used to execute some of the largest DDoS attacks at that time. <\/p>\n

The high level of danger is explained by the fact that disrupting operations, crashing, or significantly reducing performance server<\/a>, can be achieved by generating a stream of specially crafted requests from a regular computer. In certain cases, even a single TCP connection is sufficient to carry out an attack. Furthermore, the traffic associated with the attack is not distinguishable in logs against the backdrop of regular user requests. <\/p>\n

The vulnerability is caused by the way HEADERS and CONTINUATION frames are processed in HTTP\/2 requests. HEADERS frames are used in HTTP\/2 to transmission HTTP headers, while CONTINUATION frames are for breaking the transmission of HTTP headers into multiple stages (for example, when headers do not fit into a single frame, or when initial headers can be sent in the current stage and additional headers, the values of which cannot be determined yet, are sent later). When headers are transmitted in several stages, a HEADERS frame is sent first without the END_HEADERS flag, followed by several CONTINUATION frames with additional headers, and finishing the list with a CONTINUATION frame with the END_HEADERS flag. <\/p>\n

The attack method involves sending an unending stream of CONTINUATION frames without setting the END_HEADERS flag. Such activity leads to the transmission of server<\/a> a large number of headers that the server keeps in memory until the available memory for the process is exhausted. To create a high load on the CPU, in addition to exhausting memory, an attacker can utilize the compression of CONTINUATION frame content using the HPACK format, the parsing of which requires computations. In HTTP\/1.1 implementations, to protect against server header flooding, a limit on header size and a timeout for connection sending time were implemented. Due to the complexity of the protocol, many HTTP\/2 implementations did not provide similar protection methods against endless header sending. <\/p>\n

The vulnerability poses the greatest threat to Node.js users (CVE-2024-27983), as this implementation allows for a crash by sending just a few frames to the server. Due to a race condition in Node.js, triggering a crash via an Assert check is sufficient if connections are closed while an incomplete header stream is being sent (a crash occurs if a CONTINUATION frame with the END_HEADERS flag has not yet arrived during the closing of connections). The vulnerability has been fixed in Node.js versions 18.20.1, 21.7.2, and 20.12.1, as well as in recent releases of the llhttp and undici libraries. Additionally, less severe vulnerability (CVE-2024-27982) classified as \"request smuggling\" has also been resolved in the new versions of Node.js, which could allow for injecting into the content of other users' requests being processed in the same thread between the frontend and backend by manipulating the \"Content Length\" value. <\/p>\n

Vulnerabilities related to CONTINUATION handling in other HTTP\/2.0 implementations: <\/p>\n