Skip to content

Instantly share code, notes, and snippets.

@adulau
Last active May 21, 2024 23:52
Show Gist options
  • Save adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088 to your computer and use it in GitHub Desktop.
Save adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088 to your computer and use it in GitHub Desktop.
HTTP/2 Rapid Reset DDoS Attack

Introduction

This Gist aims to centralise the most relevant public sources of information related to the HTTP/2 Rapid Reset vulnerability. This vulnerability has been disclosed jointly by Google, Amazon AWS, and Cloudflare on 10 October 2023 at 12:00 UTC.

Please help us make this page as comprehensive as possible by contributing relevant references, vendor advisories and statements, mitigations, etc.

References

Vendor advisories and statements

Testing if HTTP/2 is enabled

OpenSSL

echo 1 | openssl s_client -alpn h2 -connect google.com:443 -status 2>&1  | grep "ALPN"

Nmap

nmap -p 443 --script=tls-nextprotoneg www.google.com

curl

curl -Is --http2-prior-knowledge https://example.com/| head -1

Testing if it's vulnerable (use at your own risk)

Potential remediation

NGINX

can be configured to mitigate the vulnerability

  • Disabling HTTP/2 in NGINX is not necessary. Simply ensure you have configured:

    • keepalive_requests should be kept at the default setting of 1000 requests
    • http2_max_concurrent_streams should be kept at the default setting of 128 streams
    • limit_conn and limit_req should be set "with a reasonable setting balancing application performance and security"

If you want to remove http2 support

  • Remove reference to http2 in the listening part

DDoS protection / CDNs

Web apps that are behind the following DDoS protection providers / CDNs should not be impacted:

  • AWS
  • Cloudflare
  • Google Cloud
  • Microsoft Azure
@lcrilly
Copy link

lcrilly commented Oct 10, 2023

Disabling HTTP/2 in NGINX is not necessary. Simply ensure you have configured:

Full details in the blog:
https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/

@adulau
Copy link
Author

adulau commented Oct 10, 2023

@lcrilly Thank you for the updates!

@rwhitworth
Copy link

You can prevent the openssl command from hanging by echoing input. Can also remove stderr output by redirecting stderr to stdout.

echo 1 | openssl s_client -alpn h2 -connect google.com:443 -status 2>&1 | grep "ALPN"

@adulau
Copy link
Author

adulau commented Oct 10, 2023

@rwhitworth Thanks a lot. It’s updated.

@cert-olivier
Copy link

@saadkadhi
Copy link

@adulau for your consideration. I reworked the MD, adding a source, some mitigations, and additional text for clarity etc.

Introduction

This Gist aims to centralise the most relevant public sources of information related to the HTTP/2 Rapid Reset vulnerability. This vulnerability has been disclosed jointly by Google, Amazon AWS, and Cloudflare on 10 October 2023 at 12:00 UTC.

Please help us make this page as comprehensive as possible by contributing relevant references, vendor advisories and statements, mitigations, etc.

References

Vendor advisories and statements

Testing if HTTP/2 is enabled

OpenSSL

echo 1 | openssl s_client -alpn h2 -connect google.com:443 -status 2>&1  | grep "ALPN"

Nmap

nmap -p 443 --script=tls-nextprotoneg www.google.com

Testing if it's vulnerable (use at your own risk)

Potential remediation

NGINX

can be configured to mitigate the vulnerability

  • Disabling HTTP/2 in NGINX is not necessary. Simply ensure you have configured:

    • keepalive_requests should be kept at the default setting of 1000 requests
    • http2_max_concurrent_streams should be kept at the default setting of 128 streams

If you want to remove http2 support

  • Remove reference to http2 in the listening part

DDoS protection / CDNs

Web apps that are behind the following DDoS protection providers / CDNs should not be impacted:

  • AWS
  • Cloudflare
  • Google Cloud
  • Microsoft Azure

@adulau
Copy link
Author

adulau commented Oct 10, 2023

@cert-olivier Thank you it's updated.
@saadkadhi Thank a zillion for the clean-up and the improvement. It's now included.

@INCIBE-CERT
Copy link

Disabling HTTP/2 in NGINX is not necessary. Simply ensure you have configured:

* keepalive_requests should be kept at the default setting of 1000 requests
* http2_max_concurrent_streams should be kept at the default setting of 128 streams

Full details in the blog: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/

The blog also says that, in addition of keeping those at its default values, you should add limit_conn and limit_req "with a reasonable setting balancing application performance and security"

@adulau
Copy link
Author

adulau commented Oct 11, 2023

@INCIBE-CERT Thanks a lot for the feedback. It's updated.

@ion-storm
Copy link

Anyone able to provide any PCAP's? We could design some suricata rules to detect and prevent the attacks

@marcin-gryszkalis
Copy link

There's draft proposal (from Mozilla engineer) for backporting QUIC (HTTP/3) stream id limits to HTTP/2
https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html

@adulau
Copy link
Author

adulau commented Oct 12, 2023

@marcin-gryszkalis Thanks for the info. It's updated.
@ion-storm There is a pcap from Cloudflare. Suricata rule would be indeed a good idea. Suricata seems to support HTTP/2 framing (not sure if it's complete) - https://docs.suricata.io/en/suricata-6.0.0/rules/http2-keywords.html

@ravager-dk
Copy link

@lcrilly
Copy link

lcrilly commented Oct 12, 2023

NGINX mitigation: please note the nginx.com blog has been updated to separate essential configuration from recommended.

Testing if HTTP/2 is enabled with curl(1)

curl -Is --http2-prior-knowledge https://example.com/| head -1

@adulau
Copy link
Author

adulau commented Oct 13, 2023

@lcrilly Thank you. it’s updated.

@adulau
Copy link
Author

adulau commented Oct 13, 2023

@ravager-dk Thank you it’s updated.

@secengjeff
Copy link

I wrote a tool that implements a sparse HTTP/2 client and emulates this attack. It can be used to test system behavior to rapid HEADERS + RST_STREAM frames.

@adulau
Copy link
Author

adulau commented Oct 14, 2023

@secengjeff Thank you. It's included.

@crstian19
Copy link

@adulau
Copy link
Author

adulau commented Oct 16, 2023

@crstian19 Thank you it's updated.

@theta682
Copy link

Apache Tomcat apache/tomcat@9cdfe25 was backported to the released 11.1.14. However, this version had a regression. So, it is better to use 11.1.15

@eduardojoaofonseca
Copy link

Hello, besides this information is there any public datasets related to this attacks? Im currently doing research about the topic and would be very useful to check traffic generated by this kind of attack. Thank you in advance.

@shblue21
Copy link

shblue21 commented Jan 3, 2024

Thanks you for docs. it's lightspeed rapid reset blog.
https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment