{"id":114790,"date":"2024-04-04T18:25:42","date_gmt":"2024-04-04T16:25:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0"},"modified":"2024-04-04T18:25:42","modified_gmt":"2024-04-04T16:25:42","slug":"ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0","title":{"rendered":"Sulmi Continuation flood, i cili shkakton probleme n\u00eb server\u00ebt q\u00eb p\u00ebrdorin HTTP\/2.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Informacionet mbi metod\u00ebn e sulmit \"Continuation flood\", e cila prek implementime t\u00eb ndryshme t\u00eb protokollit HTTP\/2, p\u00ebrfshir\u00eb Apache httpd, Apache Traffic Server, Node.js, oghttp, Go net\/http2, Envoy, oghttp dhe nghttp2. \u00c7\u00ebshtja e siguris\u00eb mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb kryer sulme ndaj server\u00ebve q\u00eb mb\u00ebshtesin HTTP\/2.0 dhe n\u00eb var\u00ebsi t\u00eb implementimit, \u00e7on n\u00eb shterimin e memories (ndalimi i p\u00ebrpunimit t\u00eb k\u00ebrkesave ose d\u00ebshtimi i proceseve) ose krijimin e ngarkes\u00ebs s\u00eb lart\u00eb n\u00eb CPU (ngadal\u00ebsimi i p\u00ebrpunimit t\u00eb k\u00ebrkesave). Sipas mendimit t\u00eb hulumtuesit q\u00eb zbuloi k\u00ebt\u00eb \u00e7\u00ebshtje, problemi i zbuluar \u00ebsht\u00eb m\u00eb i rreziksh\u00ebm se \u00e7\u00ebshtja e vitit t\u00eb kaluar \"Rapid Reset\", e cila u p\u00ebrdor p\u00ebr t\u00eb kryer sulmet m\u00eb t\u00eb m\u00ebdha DDoS deri at\u00ebher\u00eb. <\/p>\n

Niveli i lart\u00eb i rrezikut shpjegohet nga fakti se p\u00ebr t\u00eb penguar funksionimin server\u00eb<\/a>, p\u00ebr t\u00eb \u00e7uar n\u00eb nj\u00eb p\u00ebrfundim emergjent ose p\u00ebr t\u00eb ulur ndjesh\u00ebm performanc\u00ebn, mjafton t\u00eb krijohet nj\u00eb flux i k\u00ebrkesave t\u00eb dizajnuara ve\u00e7mas nga nj\u00eb kompjuter i zakonsh\u00ebm. N\u00eb disa raste, p\u00ebr t\u00eb kryer sulmin mjafton madje nj\u00eb lidhje TCP. N\u00eb k\u00ebt\u00eb rast, trafiku i lidhur me sulmin nuk dallohet fare n\u00eb log-et krahasuar me k\u00ebrkesat e zakonshme t\u00eb p\u00ebrdoruesve. <\/p>\n

Dob\u00ebsia shkaktohet nga ve\u00e7orit\u00eb e p\u00ebrpunimit t\u00eb frame-ve HEADERS dhe CONTINUATION n\u00eb k\u00ebrkesat e protokollit HTTP\/2. Frames HEADERS p\u00ebrdoren n\u00eb HTTP\/2 p\u00ebr t\u00eb transmetuar titujt HTTP, nd\u00ebrsa frames CONTINUATION p\u00ebrdoren p\u00ebr t\u00eb ndar\u00eb d\u00ebrgimin e titujve HTTP n\u00eb disa faza (p\u00ebr shembull, kur titujt nuk p\u00ebrshtaten n\u00eb nj\u00eb frame ose kur fillimisht duhet t\u00eb d\u00ebrgohen tituj q\u00eb mund t\u00eb plot\u00ebsohen n\u00eb k\u00ebt\u00eb faz\u00eb, dhe m\u00eb pas t\u00eb d\u00ebrgohen titujt t\u00eb cil\u00ebt nuk mund t\u00eb caktohen ende). Kur titujt d\u00ebrgohen n\u00eb disa faza, m\u00eb par\u00eb d\u00ebrgohet nj\u00eb frame HEADERS pa flamurin END_HEADERS, pasuar nga disa frames CONTINUATION me titujt shtes\u00eb dhe p\u00ebrfundimi i list\u00ebs ndodh me nj\u00eb frame CONTINUATION me flamurin END_HEADERS. <\/p>\n

Metoda e sulmit p\u00ebrfshin d\u00ebrgimin e nj\u00eb fluksi t\u00eb pand\u00ebrprer\u00eb t\u00eb frames CONTINUATION pa vendosur flamurin END_HEADERS. Aktivitet t\u00eb till\u00eb \u00e7on n\u00eb d\u00ebrgimin e server<\/a> nj\u00eb numri t\u00eb madh t\u00eb titujve q\u00eb serveri mban n\u00eb memorie deri sa memoria e disponueshme p\u00ebr procesin t\u00eb jet\u00eb e shpenzuar. P\u00ebr t\u00eb krijuar nj\u00eb ngarkes\u00eb t\u00eb lart\u00eb n\u00eb CPU, p\u00ebrve\u00e7 shpenzimit t\u00eb memories, sulmuesi mund t\u00eb p\u00ebrfitoj\u00eb nga kompresimi i p\u00ebrmbajtjes s\u00eb kadrove CONTINUATION duke p\u00ebrdorur formatin HPACK, analiza e s\u00eb cil\u00ebs k\u00ebrkon llogaritje. N\u00eb implementimet e protokollit HTTP\/1.1, p\u00ebr t\u00eb mbrojtur nga mbingarkesa e serverit me tituj, \u00ebsht\u00eb aplikuar nj\u00eb kufizim mbi madh\u00ebsin\u00eb e titujve dhe nj\u00eb koh\u00eb e \u00e7akorduar p\u00ebr d\u00ebrgimin e lidhjes. P\u00ebr HTTP\/2, p\u00ebr shkak t\u00eb komplikuar\u00ebsis\u00eb s\u00eb protokollit, shum\u00eb implementime nuk parashikuan metoda t\u00eb tilla mbrojtjeje nga d\u00ebrgimi i pafund i titujve. <\/p>\n

Kjo \u00e7\u00ebshtje e siguris\u00eb paraqet rrezikun m\u00eb t\u00eb madh p\u00ebr p\u00ebrdoruesit e Node.js (CVE-2024-27983), pasi kjo implementim lejon q\u00eb t\u00eb shkaktoj\u00eb falimentimin duke d\u00ebrguar vet\u00ebm disa frame n\u00eb server. P\u00ebr shkak t\u00eb nj\u00eb gjendjeje garance n\u00eb Node.js, p\u00ebr t\u00eb shkaktuar d\u00ebshtim p\u00ebrmes aktivizimit t\u00eb kontrollit Assert, mjafton t\u00eb mbyllen lidhjet gjat\u00eb d\u00ebrgimit t\u00eb nj\u00eb fluksi t\u00eb pap\u00ebrfunduar t\u00eb headers (d\u00ebshtimi ndodh n\u00ebse gjat\u00eb mbylljes s\u00eb lidhjeve nuk ka mb arrived asnj\u00eb frame CONTINUATION me flamurin END_HEADERS). \u00c7\u00ebshtja e siguris\u00eb \u00ebsht\u00eb rregulluar n\u00eb Node.js 18.20.1, 21.7.2 dhe 20.12.1, si dhe n\u00eb versionet e reja t\u00eb bibliotekave llhttp dhe undici. N\u00eb versionet e reja t\u00eb Node.js \u00ebsht\u00eb rregulluar gjithashtu nj\u00eb \u00e7\u00ebshtje m\u00eb pak t\u00eb rrezikshme (CVE-2024-27982) e klas\u00ebs \"request smuggling\", q\u00eb lejon q\u00eb t\u00eb nd\u00ebrhyhet n\u00eb p\u00ebrmbajtjen e k\u00ebrkesave t\u00eb p\u00ebrdoruesve t\u00eb tjer\u00eb, t\u00eb p\u00ebrpunuara n\u00eb t\u00eb nj\u00ebjtin rrjedh midis frontend-it dhe backend-it p\u00ebrmes manovrimit t\u00eb vler\u00ebs \"Content Length\". <\/p>\n

Vulnerabilitetet q\u00eb lidhen me trajtimin e CONTINUATION n\u00eb implementime t\u00eb tjera t\u00eb HTTP\/2.0: <\/p>\n