8 New HTTP/2 Implementation Flaws Expose Websites to DoS Attacks

Launched in May 2015, HTTP/2 has been designed for
better security and improved online experience by
speeding up page loads. Today, over hundreds of millions of
websites, or some 40 percent of all the sites on the Internet, are
running using HTTP/2 protocol.

A total of eight high-severity HTTP/2 vulnerabilities,
seven discovered by Jonathan Looney of Netflix and one by Piotr
Sikora of Google, exist due to resource exhaustion when handling
malicious input, allowing a client to overload server’s queue
management code.

The vulnerabilities can be exploited to launch Denial of Service
(DoS) attacks against millions of online services and websites that
are running on a web server with the vulnerable implementation of
HTTP/2, knocking them offline for everyone.
^[2]

The attack scenario, in layman’s terms, is that a malicious client
asks a targeted vulnerable server to do something which generates a
response, but then the client refuses to read the response, forcing
it to consume excessive memory and CPU while processing requests.

1. CVE-2019-9511 — HTTP/2 “Data Dribble”
2. CVE-2019-9512 — HTTP/2 “Ping Flood”
3. CVE-2019-9513 — HTTP/2 “Resource Loop”
4. CVE-2019-9514 — HTTP/2 “Reset Flood”
5. CVE-2019-9515 — HTTP/2 “Settings Flood”
6. CVE-2019-9516 — HTTP/2 “0-Length Headers Leak”
7. CVE-2017-9517 — HTTP/2 “Internal Data Buffering”
8. CVE-2019-9518 — HTTP/2 “Request Data/Header Flood”

“Some are efficient enough that a single end-system could
potentially cause havoc on multiple servers. Other attacks are less
efficient; however, even less efficient attacks can open the door
for DDoS attacks which are difficult to detect and block,” the
advisory states.

However, it should be noted that the vulnerabilities can only be
used to cause a DoS condition and do not allow attackers to
compromise the confidentiality or integrity of the data contained
within the vulnerable servers.

Netflix security team, who teamed up with Google and CERT
Coordination Center to disclose the reported HTTP/2 flaws,
discovered seven out of eight vulnerabilities in several HTTP/2
server implementations in May 2019 and responsibly reported them to
each of the affected vendors and maintainers.

According to CERT, affected vendors include NGINX^[4], Apache^[5], H2O^[6], Nghttp2, Microsoft
(IIS), Cloudflare^[7], Akamai^[8], Apple (SwiftNIO^[9]), Amazon, Facebook
(Proxygen), Node.js^[10], and Envoy proxy, many
of which have already released security patches and advisories.

^[1]