Cloudflare mitigated 89 hyper-volumetric HTTP distributed DDoS attacks exceeding 100 million rps
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-44487 | Rapid Reset Denial-of-Service in HTTP/2 (CWE-400 Resource Exhaustion) CVE-2023-44487 is a flaw in the HTTP/2 protocol's stream handling (CWE-400, uncontrolled resource consumption) in which a client opens a large number of streams and immediately cancels them with RST_STREAM frames, forcing the server to repeatedly allocate and tear down per-stream state. When this 'rapid reset' pattern is driven at high volume from many sources, it exhausts server CPU and memory, producing a distributed denial-of-service; Google, Cloudflare and AWS all reported record-scale attacks using this technique. The only impact is availability (denial of service), not code execution or data exposure, but any system speaking HTTP/2 is in scope, including web servers, load balancers, API gateways and CDN edges, and client-side implementations are also affected in a reverse-direction variant. Because the weakness is in the protocol specification itself (attributed to IETF HTTP/2), virtually every deployment with HTTP/2 enabled is affected until vendors ship mitigations or patches. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-10-10, and EPSS assigns a 100% probability of exploitation within 30 days. Do: Apply mitigations per vendor instructions as required by CISA KEV/BOD 22-01 guidance — most major web server, load balancer, and CDN vendors have shipped patches or tuning knobs, so check and update each HTTP/2-facing component in your estate. Where patching is not yet possible, limit the number of concurrent HTTP/2 streams per connection, rate-limit new stream creation and inbound HTTP/2 connections, or disable HTTP/2 on internet-exposed servers. Confirm with your CDN or cloud provider that rapid-reset DDoS mitigations are in place at the edge. | 7.5 | 100% | KEV |
| massmillions of servers and network edges (HTTP/2 is negotiated on a large share of HTTPS-capable hosts in public internet scans) |
Full article391 words · extracted from securityaffairs.com · click to collapse
Cloudflare mitigated thousands of hyper-volumetric HTTP distributed denial-of-service (DDoS) attacks exploiting the flaw HTTP/2 Rapid Reset.
Cloudflare DDoS threat report of 2023 states that the company has mitigated thousands of hyper-volumetric HTTP distributed denial-of-service attacks.
89 of the attacks mitigated by the company exceeded 100 million requests per second (rps), the largest attack peaked at 201 million rps, which is three times higher than the previous largest attack on record (71M rps). These attacks exploited the HTTP/2 Rapid Reset vulnerability (CVE-2023-44487).
“The campaign contributed to an overall increase of 65% in HTTP DDoS attack traffic in Q3 compared to the previous quarter. Similarly, L3/4 DDoS attacks also increased by 14% alongside numerous attacks in the terabit-per-second range — the largest peaked at 2.6 Tbps.” reads the report published by the company.
The frequency of HTTP DDoS attacks in Q3 rose by 15% compared to Q2. The researchers reported that, in the current quarter, this trend intensified significantly. In Q2, the volume of attacks increased 65% compared to the previous quarter, the researchers reported a total of 8.9 trillion HTTP DDoS requests automatically detected and mitigated by Cloudflare infrastructure.
The botnets used to launch the attacks leverage cloud computing platforms and exploit HTTP/2, they were able to generate up to x5,000 more force per botnet node. This amplification factor allows a small botnet ranging 5-20 thousand nodes to launch hyper-volumetric DDoS attacks.
According to the report, the analysis of the two-month-long DDoS campaign revealed that Cloudflare infrastructure was the main target of the attacks. 19% of all attacks targeted Cloudflare websites and infrastructure, 18% targeted Gaming companies, and 10% targeted well-known VoIP providers.
The top sources of the attacks are the U.S., China, Brazil, Germany, and Indonesia.
The U.S., Singapore, China, Vietnam, and Canada are the main targets of HTTP DDoS attacks.
The top attacked industries by HTTP DDoS attacks are the Gaming and Gambling industry and Cryptocurrency industry.
“Aside from the most common attack vectors, we also saw significant increases in lesser known attack vectors. These tend to be very volatile as threat actors try to “reduce, reuse and recycle” older attack vectors. These tend to be UDP-based protocols that can be exploited to launch amplification and reflection DDoS attacks.” concludes the report.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Cloudflare)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/153082/hacking/cloudflare-hyper-volumetric-http-distributed-ddos-attacks.html