{"id":114790,"date":"2024-04-04T18:25:42","date_gmt":"2024-04-04T16:25:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0"},"modified":"2024-04-04T18:25:42","modified_gmt":"2024-04-04T16:25:42","slug":"ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0","title":{"rendered":"Atacul Continuation flood, care cauzeaz\u0103 probleme pe serverele ce utilizeaz\u0103 HTTP\/2.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Informa\u021biile despre metoda de atac \u201eContinuation flood\u201d au fost dezv\u0103luite, afect\u00e2nd diverse implement\u0103ri ale protocolului HTTP\/2, printre care Apache httpd, Apache Traffic Server, Node.js, oghttp, Go net\/http2, Envoy, oghttp \u0219i nghttp2. Vulnerabilitatea poate fi exploatat\u0103 pentru a lansa atacuri asupra serverelor care suport\u0103 HTTP\/2.0 \u0219i, \u00een func\u021bie de implementare, poate duce la epuizarea memoriei (oprirea proces\u0103rii cererilor sau \u00eenchiderea brusc\u0103 a proceselor) sau la o \u00eenc\u0103rcare mare a CPU-ului (\u00eencetinirea proces\u0103rii cererilor). Potrivit cercet\u0103torului care a descoperit vulnerabilitatea, problema identificat\u0103 este mai periculoas\u0103 dec\u00e2t vulnerabilitatea \u201eRapid Reset\u201d descoperit\u0103 anul trecut, care a fost folosit\u0103 pentru a ini\u021bia cele mai mari atacuri DDoS de p\u00e2n\u0103 atunci.    <\/p>\n<p>Nivelul ridicat de periculozitate se explic\u0103 prin faptul c\u0103, pentru a perturba func\u021bionarea <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/server\/dts-los-angeles\/\"   title=\"server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3609\">server<\/a>, \u00eencheierea necontrolat\u0103 sau sc\u0103derea sever\u0103 a performan\u021bei, este suficient s\u0103 creezi un flux de cereri special concepute dintr-un computer obi\u0219nuit. \u00cen anumite cazuri, pentru a efectua atacul, este suficient chiar \u0219i un singur TCP-connection. \u00cen acest context, traficul asociat cu atacul nu se distinge \u00een loguri fa\u021b\u0103 de cererile normale ale utilizatorilor.      <\/p>\n<p>Vulnerabilitatea este cauzat\u0103 de particularit\u0103\u021bile proces\u0103rii cadrelor HEADERS \u0219i CONTINUATION \u00een cererile prin protocolul HTTP\/2. Cadrele HEADERS sunt utilizate \u00een HTTP\/2 pentru transmiterea anteturilor HTTP, iar cadrele CONTINUATION pentru fragmentarea trimiterea anteturilor HTTP \u00een mai multe etape (de exemplu, c\u00e2nd anteturile nu \u00eencap \u00eentr-o singur\u0103 cadru sau c\u00e2nd, la \u00eenceput, trebuie s\u0103 se trimit\u0103 anteturi care pot fi completate \u00een prezent, iar mai apoi s\u0103 se completeze anteturile ale c\u0103ror valori nu pot fi determinate \u00een acest moment). Atunci c\u00e2nd anteturile sunt transmise \u00een mai multe etape, la \u00eenceput se trimite un cadru HEADERS f\u0103r\u0103 semnalul END_HEADERS, urmat de mai multe cadre CONTINUATION cu anteturi suplimentare \u0219i lista se \u00eencheie cu un cadru CONTINUATION cu semnalul END_HEADERS.      <\/p>\n<p>Metoda de atac const\u0103 \u00een trimiterea unui flux ne\u00eentrerupt de cadre CONTINUATION f\u0103r\u0103 a seta semnalul END_HEADERS. O astfel de activitate duce la transmiterea pe <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/server\/\"   title=\"serverul\" data-wpil-keyword-link=\"linked\">serverul<\/a> un num\u0103r mare de antete pe care serverul le p\u0103streaz\u0103 \u00een memoria opera\u021bional\u0103 p\u00e2n\u0103 c\u00e2nd memoria disponibil\u0103 procesului este epuizat\u0103. Pentru a crea o \u00eenc\u0103rcare mare pe CPU, pe l\u00e2ng\u0103 epuizarea memoriei, atacatorul poate utiliza comprimarea con\u021binutului cadrelor CONTINUATION cu ajutorul formatului HPACK, a c\u0103rei analiz\u0103 necesit\u0103 calcule. \u00cen implement\u0103rile protocolului HTTP\/1.1, pentru a proteja serverul \u00eempotriva inunda\u021biilor cu antete, s-a aplicat o limitare a dimensiunii antetelor \u0219i un timeout pentru timpul de transmisie a conexiunii. \u00cen HTTP\/2, din cauza complexit\u0103\u021bii protocolului, multe implement\u0103ri nu au prev\u0103zut asemenea metode de protec\u021bie \u00eempotriva trimiterii infinite de antete.      <\/p>\n<p>Cea mai mare amenin\u021bare a vulnerabilit\u0103\u021bii o reprezint\u0103 utilizatorii Node.js (CVE-2024-27983), deoarece aceast\u0103 implementare permite provocarea unei c\u0103deri prin trimiterea doar a c\u00e2torva cadre c\u0103tre server. Datorit\u0103 st\u0103rii de competi\u021bie \u00een Node.js, pentru a provoca o \u00eenchidere brusc\u0103 prin activarea verific\u0103rii Assert, este suficient s\u0103 se \u00eenchid\u0103 conexiunile \u00een timpul trimiterii unui flux de anteturi incomplet (c\u0103dere, dac\u0103 \u00een timpul \u00eenchiderii conexiunilor nu a sosit \u00eenc\u0103 un cadru CONTINUATION cu semnul END_HEADERS). Vulnerabilitatea a fost remediat\u0103 \u00een Node.js 18.20.1, 21.7.2 \u0219i 20.12.1, precum \u0219i \u00een versiunile recente ale bibliotecilor llhttp \u0219i undici. \u00cen noile versiuni Node.js a fost remediat\u0103, de asemenea, o vulnerabilitate mai pu\u021bin periculoas\u0103 (CVE-2024-27982) de tip \u201erequest smuggling\u201d, care permite prin manipularea valorii \u201eContent Length\u201d s\u0103 se interpun\u0103 \u00een con\u021binutul cererilor altor utilizatori care sunt procesate \u00een acela\u0219i fir \u00eentre frontend \u0219i backend.     <\/p>\n<p>Vulnerabilit\u0103\u021bile legate de procesarea CONTINUATION \u00een alte implement\u0103ri HTTP\/2.0:    <\/p>\n<ul>\n<li class=\"l\"> oghttp (CVE-2024-27919) \u2014 consum nelimitat de memorie.\n<li class=\"l\"> Tempesta FW (CVE-2024-2758) \u2014 ocolirea restric\u021biilor.\n<li class=\"l\"> Biblioteca PHP amphp\/http, amphp\/http-client \u0219i amphp\/http-server (CVE-2024-2653) \u2014 consum nelimitat de memorie, p\u00e2n\u0103 la epuizarea total\u0103 a memoriei disponibile.\n<li class=\"l\"> Pachetul Go net\/http (CVE-2023-45288) \u2014 generarea unei \u00eenc\u0103rc\u0103ri mari a CPU-ului.\n<li class=\"l\"> Biblioteca nghttp2 (CVE-2024-28182) \u2014 provocarea unei neg\u0103ri a serviciului.\n<li class=\"l\"> Apache Httpd (CVE-2024-27316) \u2014 consum excesiv de memorie \u0219i generarea de sarcini pe CPU.\n<li class=\"l\"> Apache Traffic Server (CVE-2024-31309) \u2014 consum excesiv de resurse.\n<li class=\"l\"> Envoy (CVE-2024-30255) \u2014 generarea unei \u00eenc\u0103rc\u0103ri mari a CPU-ului (pentru o \u00eenc\u0103rcare complet\u0103 a unui nucleu CPU este necesar un flux de 300Mbit\/s).  <\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=60924\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u043c\u0435\u0442\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 &#171;Continuation flood&#187;, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2, \u0441\u0440\u0435\u0434\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 Apache httpd, Apache Traffic Server, Node.js, oghttp, Go net\/http2, Envoy, oghttp \u0438 nghttp2. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0441 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 HTTP\/2.0 \u0438 \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044e \u043f\u0430\u043c\u044f\u0442\u0438 (\u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0438\u043b\u0438 \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432) \u0438\u043b\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114790","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u043c\u0435\u0442\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 &quot;Continuation flood&quot;, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2, \u0441\u0440\u0435\u0434\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 Apache httpd, Apache Traffic Server, Node.js, oghttp, Go net\/http2, Envoy, oghttp \u0438 nghttp2.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 Continuation flood, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 HTTP\/2.0 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u043c\u0435\u0442\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 &quot;Continuation flood&quot;, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2, \u0441\u0440\u0435\u0434\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 Apache httpd, Apache Traffic Server, Node.js, oghttp, Go net\/http2, Envoy, oghttp \u0438 nghttp2.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2024-04-04T16:25:42+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2024-04-04T16:25:42+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Atacul Continuation flood, care cauzeaz\u0103 probleme pe serverele care utilizeaz\u0103 HTTP\/2.0 | ProHoster","description":"Informa\u021biile despre metoda de atac \"Continuation flood\", care afecteaz\u0103 diverse implement\u0103ri ale protocolului HTTP\/2, inclusiv Apache httpd, Apache Traffic Server, Node.js, oghttp, Go net\/http2, Envoy, oghttp \u0219i nghttp2, au fost dezv\u0103luite.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 Continuation flood, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 HTTP\/2.0 | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u043c\u0435\u0442\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438 &quot;Continuation flood&quot;, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u043c \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2, \u0441\u0440\u0435\u0434\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 Apache httpd, Apache Traffic Server, Node.js, oghttp, Go net\/http2, Envoy, oghttp \u0438 nghttp2.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-04-04T16:25:42+00:00","article:modified_time":"2024-04-04T16:25:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114790","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:41:47","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-22 21:24:22","updated":"2026-02-22 15:41:47","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114790","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=114790"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114790\/revisions"}],"predecessor-version":[{"id":172815,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114790\/revisions\/172815"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=114790"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=114790"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=114790"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}