{"id":114790,"date":"2024-04-04T18:25:42","date_gmt":"2024-04-04T16:25:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0"},"modified":"2024-04-04T18:25:42","modified_gmt":"2024-04-04T16:25:42","slug":"ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/ataka-continuation-flood-privodyashhaya-k-problemam-na-serverah-ispolzuyushhih-http-2-0","title":{"rendered":"Continuation flood-attacker som orsakar problem p\u00e5 servrar som anv\u00e4nder HTTP\/2.0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Information has been revealed about the 'Continuation flood' attack method, affecting various implementations of the HTTP\/2 protocol, including Apache httpd, Apache Traffic Server, Node.js, oghttp, Go net\/http2, Envoy, oghttp, and nghttp2. The vulnerability can be exploited to launch attacks on servers supporting HTTP\/2.0 and, depending on the implementation, leads to memory exhaustion (stopping request processing or crashing processes) or high CPU load (slowing down request handling). According to the researcher who discovered the vulnerability, the identified issue is more dangerous than last year's 'Rapid Reset' vulnerability, which was used for the largest DDoS attacks at that time. <\/p>\n

Den h\u00f6ga riskniv\u00e5n f\u00f6rklaras av att det r\u00e4cker med att skapa en str\u00f6m av speciellt formaterade f\u00f6rfr\u00e5gningar fr\u00e5n en vanlig dator f\u00f6r att st\u00f6ra driften, servern<\/a>, krascha eller allvarligt f\u00f6rs\u00e4mra prestanda. I vissa fall r\u00e4cker det med en enda TCP-anslutning f\u00f6r att genomf\u00f6ra attacken. Den trafik som \u00e4r kopplad till attacken s\u00e4rskiljs inte p\u00e5 n\u00e5got s\u00e4tt i loggarna fr\u00e5n vanliga anv\u00e4ndarf\u00f6rfr\u00e5gningar. <\/p>\n

S\u00e5rbarheten orsakas av egenskaperna i behandlingen av HEADERS- och CONTINUATION-ramar i f\u00f6rfr\u00e5gningar via HTTP\/2-protokollet. HEADERS-ramar anv\u00e4nds i HTTP\/2 f\u00f6r att \u00f6verf\u00f6ra HTTP-rubriker, medan CONTINUATION-ramar anv\u00e4nds f\u00f6r att dela upp \u00f6verf\u00f6ringen av HTTP-rubriker i flera steg (till exempel n\u00e4r rubrikerna inte f\u00e5r plats i en ram eller n\u00e4r man f\u00f6rst m\u00e5ste skicka rubriker som kan fyllas i vid nuvarande steg, och sedan skicka rubriker vars v\u00e4rden f\u00f6r n\u00e4rvarande inte kan best\u00e4mmas). Vid \u00f6verf\u00f6ring av rubriker i flera steg skickas f\u00f6rst en HEADERS-ram utan flaggan END_HEADERS, f\u00f6ljt av flera CONTINUATION-ramar med ytterligare rubriker och avslutas med en CONTINUATION-ram med flaggan END_HEADERS. <\/p>\n

Attackmetoden g\u00e5r ut p\u00e5 att skicka en oavbruten str\u00f6m av CONTINUATION-ramar utan att s\u00e4tta flaggan END_HEADERS. S\u00e5dan aktivitet leder till \u00f6verf\u00f6ring av server<\/a> ett stort antal rubriker som servern lagrar i det aktiva minnet tills den tillg\u00e4ngliga minnet f\u00f6r processen \u00e4r utt\u00f6mt. F\u00f6r att skapa h\u00f6g belastning p\u00e5 CPU:n kan en angripare, f\u00f6rutom att utt\u00f6mma minnet, utnyttja komprimering av CONTINUATION-inneh\u00e5ll med hj\u00e4lp av HPACK-formatet, vars analys kr\u00e4ver ber\u00e4kningar. I implementationer av protokollet HTTP\/1.1 har det inf\u00f6rts begr\u00e4nsningar f\u00f6r storleken p\u00e5 rubriker och timeout f\u00f6r anslutningss\u00e4ndning f\u00f6r att skydda mot \u00f6versv\u00e4mning av servern med rubriker. F\u00f6r HTTP\/2, p\u00e5 grund av protokollets komplexitet, har m\u00e5nga implementationer inte f\u00f6rutsett s\u00e5dana skydd mot o\u00e4ndlig s\u00e4ndning av rubriker. <\/p>\n

The vulnerability poses the greatest danger to Node.js users (CVE-2024-27983), as this implementation allows for a crash by sending only a few frames to the server. Due to a race condition in Node.js, triggering a crash via an Assert check is enough to terminate connections while sending an unfinished header stream (a crash occurs if a CONTINUATION frame with the END_HEADERS flag hasn\u2019t arrived yet during connection closure). The vulnerability has been fixed in Node.js versions 18.20.1, 21.7.2, and 20.12.1, as well as in the latest releases of the llhttp and undici libraries. In the new versions of Node.js, a less dangerous vulnerability (CVE-2024-27982) of the 'request smuggling' class has also been fixed, which allows an attacker to manipulate the 'Content Length' value to inject into the content of requests from other users processed in the same thread between the frontend and backend. <\/p>\n

S\u00e5rbarheter i samband med hantering av CONTINUATION i andra implementationer av HTTP\/2.0: <\/p>\n