Mitigating the HTTP/2 Rapid Reset Vulnerability- CVE-2023-44487

The HTTP/2 protocol was introduced in 2015 as a major revision of HTTP/1.1 aimed at improving web performance and security. HTTP/2 provides various optimizations like multiplexing requests over a single connection, header compression, and server push capabilities. While adoption of HTTP/2 has steadily grown over the years, a serious vulnerability dubbed “Rapid Reset” was publicly disclosed in October 2023 that impacts many HTTP/2 implementations.

This post will dive into the details of CVE-2023-44487, explaining how this HTTP/2 vulnerability works and how it is being exploited in the wild to conduct massive denial-of-service (DoS) attacks. We will also cover key steps to mitigate risk from Rapid Reset attacks while vendors issue patches.

The Rapid Reset HTTP/2 Vulnerability Explained

A core capability provided by HTTP/2 is multiplexing, which allows multiple requests and responses to be sent over a single TCP connection. This is accomplished by dividing streams of data into frames, with each stream allocated a unique integer ID. The protocol allows clients to open new streams by sending frame requests with new stream IDs. Streams can be abruptly closed via a RST_STREAM frame specifying the stream ID to terminate.

The Rapid Reset vulnerability arises from the fact that HTTP/2 clients can repeatedly open streams and immediately reset them via RST_STREAM frames in quick succession. Servers typically allocate resources like memory and threads to manage each open stream. A malicious client can easily automate rapid cycles of opening and closing streams to overwhelm the server’s available resources. Even though each stream is promptly canceled, the cumulative effect is to exhaust server capacity leading to denial-of-service.

This vector was exploited in the wild starting in August 2023 to conduct extremely large DDoS attacks. By saturating HTTP/2 implementations with continuous streams of reset frames, attackers were able to take down high-profile sites by exploiting vulnerable server software. Reportedly, these novel HTTP/2 DDoS assaults reached unprecedented sizes upwards of 30 million requests per second.

Summary of CVE-2023-44487

Vulnerable Products

The following table lists Cisco products that are affected by the vulnerability that is described in this advisory. If a future release date is indicated for software, the date provided represents an estimate based on all information known to Cisco as of the Last Updated date at the top of the advisory. Availability dates are subject to change based on a number of factors, including satisfactory testing results and delivery of other priority features and fixes. If no version or date is listed for an affected component (indicated by a blank field and/or an advisory designation of Interim), Cisco is continuing to evaluate the fix and will update the advisory as additional information becomes available. After the advisory is marked Final, customers should refer to the associated Cisco bug(s) for further details.

How Servers are Impacted?

Because support for HTTP/2 is implemented in most major web servers and load balancers, a wide range of products are affected by the Rapid Reset bug. Unfortunately, the stream management logic that hastily allocates resources per stream makes servers susceptible to resource exhaustion via this attack vector.

Notable software impacted includes nginx, Envoy, Apache Tomcat, Caddy, Akamai CDN, and F5 load balancers among many others. Microsoft Azure and Google Cloud products were also confirmed vulnerable. Developers using common HTTP/2 libraries like Netty and nghttp2 are exposed as well. Essentially any product or service relying on affected HTTP/2 implementations could be taken offline by Rapid Reset attacks.

Mitigating HTTP/2 Rapid Reset Attacks

Users are strongly urged to update their software as soon as fixes are available. Several web server moderators released updates. Visit their pages to see more about the mitigations.

While vendors urgently issue patches, organizations can take steps to mitigate potential HTTP/2 DDoS attacks leveraging Rapid Reset:

Organizations lacking robust DDoS defenses should seriously consider adding services or on-premise solutions to absorb and block HTTP-layer assaults. Slow pipe DoS attacks aimed at bandwidth exhaustion are also a risk.

Protecting Your Infrastructure

Defending against emerging threats like Rapid Reset requires proactive security measures:

With cyber threats inevitably evolving, organizations must take swift action when new vulnerabilities emerge. Adopting proactive security measures and response plans for high-risk scenarios can reduce operational impacts.

Bottom Line

The novel Rapid Reset vulnerability showcases how newly discovered software flaws can be rapidly weaponized to fuel widespread attacks before mitigations are developed. All organizations relying on the ubiquitous HTTP/2 protocol face exposure to this easily exploited denial-of-service vector.

By understanding the mechanics behind this HTTP/2 bug and following recommended patching and workarounds, the risk of disruptive downtime can be substantially reduced. But long term, improving the security posture across the web services ecosystem will require more resilient software and infrastructure designs not vulnerable to resource exhaustion issues.

Extra vigilance and collaboration across the security industry is needed to swiftly identify and eradicate serious defects like Rapid Reset before they are mass exploited. We face an increasingly complex and hostile threat landscape, so the push for improved cyber resilience must persist.

We hope this post helps you know how to fix CVE-2023-44487, a Mitigating the HTTP/2 Rapid Reset Vulnerability. Please share this post and help secure the digital world.Visit our website thesecmaster.com, and our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium, and Instagram and subscribe to receive updates like this.