{"id":114790,"date":"2024-04-04T18:25:42","date_gmt":"2024-04-04T16:25:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0"},"modified":"2024-04-04T18:25:42","modified_gmt":"2024-04-04T16:25:42","slug":"ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0","title":{"rendered":"A Continuation flood attack leads to issues on servers using HTTP\/2.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nyilv\u00e1noss\u00e1gra ker\u00fclt a \"Continuation flood\" t\u00e1mad\u00e1si m\u00f3dszer, amely k\u00fcl\u00f6nb\u00f6z\u0151 HTTP\/2 protokoll megval\u00f3s\u00edt\u00e1sokat \u00e9rint, k\u00f6zt\u00fck az Apache httpd, Apache Traffic Server, Node.js, oghttp, Go net\/http2, Envoy \u00e9s nghttp2-t. A sebezhet\u0151s\u00e9get HTTP\/2.0 t\u00e1mogat\u00e1ssal rendelkez\u0151 szerverek ellen lehet kihaszn\u00e1lni, \u00e9s a megval\u00f3s\u00edt\u00e1st\u00f3l f\u00fcgg\u0151en mem\u00f3ria kimer\u00fcl\u00e9st (k\u00e9r\u00e9sek feldolgoz\u00e1s\u00e1nak le\u00e1ll\u00edt\u00e1sa vagy folyamatok v\u00e1ratlan le\u00e1ll\u00e1sa) vagy CPU-ra gyakorolt magas terhel\u00e9st (a k\u00e9r\u00e9sek feldolgoz\u00e1s\u00e1nak lassul\u00e1s\u00e1t) eredm\u00e9nyez. A sebezhet\u0151s\u00e9get felfedez\u0151 kutat\u00f3 v\u00e9lem\u00e9nye szerint a felismert probl\u00e9ma vesz\u00e9lyesebb, mint a tavaly felfedezett \"Rapid Reset\" sebezhet\u0151s\u00e9g, amelyet a legnagyobb DDoS t\u00e1mad\u00e1sok v\u00e9grehajt\u00e1s\u00e1ra haszn\u00e1ltak. <\/p>\n

The high level of danger is explained by the fact that disrupting operation a szerver<\/a>, crashing or significantly reducing performance can be achieved by creating a stream of specially crafted requests from a regular computer. In certain cases, a single TCP connection is sufficient to execute the attack. Additionally, the traffic related to the attack is not distinguishable in the logs against the background of normal user requests. <\/p>\n

The vulnerability is caused by the peculiarities of processing HEADERS and CONTINUATION frames in HTTP\/2 requests. HEADERS frames are used in HTTP\/2 to transmit HTTP headers, while CONTINUATION frames are used to break the transmission of HTTP headers into several stages (for example, when the headers do not fit into one frame or when headers that can be filled at the current stage are sent first, and then the headers, the values of which cannot yet be determined, are sent afterwards). When transmitting headers in multiple stages, a HEADERS frame is sent first without the END_HEADERS flag, followed by several CONTINUATION frames with additional headers, and the list is completed by a CONTINUATION frame with the END_HEADERS flag. <\/p>\n

The attack method consists of sending an uninterrupted stream of CONTINUATION frames without setting the END_HEADERS flag. Such activity leads to the transmission of szerver<\/a> A nagy sz\u00e1m\u00fa fejl\u00e9c, amelyet a szerver a mem\u00f3ri\u00e1ban tart, am\u00edg a folyamat sz\u00e1m\u00e1ra rendelkez\u00e9sre \u00e1ll\u00f3 mem\u00f3ria ki nem mer\u00fcl. A CPU magas terhel\u00e9s\u00e9nek l\u00e9trehoz\u00e1sa \u00e9rdek\u00e9ben a t\u00e1mad\u00f3 a CONTINUATION keretek tartalm\u00e1nak t\u00f6m\u00f6r\u00edt\u00e9s\u00e9t is kihaszn\u00e1lhatja az HPACK form\u00e1tum haszn\u00e1lat\u00e1val, amelynek elemz\u00e9se sz\u00e1m\u00edt\u00e1sokat ig\u00e9nyel. A HTTP\/1.1 protokoll megval\u00f3s\u00edt\u00e1saiban a szerver fejl\u00e9cel\u00e1raszt\u00e1s\u00e1nak v\u00e9delme \u00e9rdek\u00e9ben korl\u00e1toz\u00e1st vezettek be a fejl\u00e9cm\u00e9retre \u00e9s kapcsolatk\u00fcld\u00e9si id\u0151korl\u00e1tot alkalmaztak. A HTTP\/2 eset\u00e9ben azonban a bonyolultabb protokoll miatt sok megval\u00f3s\u00edt\u00e1s nem biztos\u00edtott hasonl\u00f3 v\u00e9delmi m\u00f3dszereket a v\u00e9gtelen fejl\u00e9ck\u00fcld\u00e9s ellen. <\/p>\n

A sebezhet\u0151s\u00e9g legnagyobb vesz\u00e9lyt a Node.js felhaszn\u00e1l\u00f3kra jelent (CVE-2024-27983), mivel ez a megval\u00f3s\u00edt\u00e1s lehet\u0151v\u00e9 teszi a rendszer \u00f6sszeoml\u00e1s\u00e1t mind\u00f6ssze n\u00e9h\u00e1ny keret k\u00fcld\u00e9s\u00e9vel a szerverre. A Node.js ben l\u00e9v\u0151 versenyhelyzet miatt a rendszer v\u00e1ratlan le\u00e1ll\u00edt\u00e1sa az Assert-ellen\u0151rz\u00e9s aktiv\u00e1l\u00e1sa r\u00e9v\u00e9n el\u00e9g, ha a kapcsolatokat a befejezetlen fejl\u00e9cfolyam k\u00fcld\u00e9se k\u00f6zben z\u00e1rjuk le (\u00f6sszeoml\u00e1s, ha a kapcsolatok lez\u00e1r\u00e1sa k\u00f6zben m\u00e9g nem \u00e9rkezett meg a CONTINUATION keret az END_HEADERS flaggel). A sebezhet\u0151s\u00e9get a Node.js 18.20.1, 21.7.2 \u00e9s 20.12.1 verzi\u00f3kban, valamint az \u00fajabb llhttp \u00e9s undici k\u00f6nyvt\u00e1rak kiad\u00e1s\u00e1ban jav\u00edtott\u00e1k. Az \u00faj Node.js verzi\u00f3kban egy kev\u00e9sb\u00e9 vesz\u00e9lyes sebezhet\u0151s\u00e9g (CVE-2024-27982) is megsz\u00fcntet\u00e9sre ker\u00fclt, amely a \"request smuggling\" oszt\u00e1lyba tartozik, \u00e9s lehet\u0151v\u00e9 teszi, hogy a \"Content Length\" \u00e9rt\u00e9k manipul\u00e1l\u00e1s\u00e1val m\u00e1s felhaszn\u00e1l\u00f3k k\u00e9r\u00e9s\u00e9nek tartalm\u00e1ba be\u00e9kel\u0151dj\u00fcnk, amelyek azonos sz\u00e1lon ker\u00fclnek feldolgoz\u00e1sra a frontend \u00e9s a backend k\u00f6z\u00f6tt. <\/p>\n

A CONTINUATION kezel\u00e9s\u00e9vel kapcsolatos sebezhet\u0151s\u00e9gek m\u00e1s HTTP\/2.0 megval\u00f3s\u00edt\u00e1sokban: <\/p>\n