A vulnerability has been discovered in the handling of multiplexed streams in the HTTP/2 protocol.

What is this about?

The HTTP/2 protocol allows for a denial-of-service attack because canceling requests can quickly reset many connections, as has been exploited in real-world scenarios.

The CVSS score for this vulnerability is 7.5.

Known as HTTP/2 Rapid Reset, this attack strategy exploits a specific feature of HTTP/2: its ability to multiplex requests within a single TCP connection.
Attackers establish multiple HTTP/2 connections in which they send requests immediately followed by resets (RST_STREAM frames).
This method results in overwhelming the server without exceeding the limit on concurrent connections, because the server is powerless against these resets—since they are initiated unilaterally by the client, and the server has no way to counter or reject them.

Affected products:
Web servers using the HTTP/2 protocol.

Potential impacts:

– Server malfunction,
– Impact on website availability,
– Potential for data breaches and theft of sensitive information.

Remediation:

  • Waiting for official fixes from software vendors and open-source project maintainers.

Temporary workarounds:

For web servers using NGINX, it is possible to mitigate the vulnerability by modifying certain settings, including:
â—Ź Set thekeepalive_requestssetting to its default value (1,000 requests).
â—Ź Set the`http2_max_concurrent_streams` parameter to its default value (1,000 streams).
â—Ź`limit_conn`and`limit_req`should be set to a value that balances application performance and security.
Disable the HTTP/2 protocol using the Registry Editor.

Additional recommendations:

Use IS security mechanisms: SIEM, EDR, or contact your cybersecurity monitoring provider (managed SOC).

> Do not leave these types of services exposed and unprotected. ITrust provides tools to detect cyberthreats, ransomware, viruses, and anomalous behavior within your IS, such as our Reveelium UEBA SIEM.

> Regularly scan your network to detect security vulnerabilities and patches to apply. Our vulnerability scanner IKare, available as a free trial, enables the detection of new security flaws.

If you need assistance in remediating these vulnerabilities, call us. (+33 5 67 34 67 80)

*Sources:
https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/