CVE-2023-45288

What it actually does

An unauthenticated remote attacker can cause a denial-of-service condition on an HTTP/2-enabled endpoint. The vulnerability lies in the excessive processing of HTTP/2 CONTINUATION frames. Even after a server determines that a request's headers exceed the allowed size limit, it continues to parse all associated CONTINUATION frames. This allows an attacker to force the server to perform computationally expensive parsing operations, particularly with Huffman-encoded headers, leading to CPU resource exhaustion and rendering the service unresponsive.

Why it matters to the business

This vulnerability can lead to a complete denial of service for critical web applications, APIs, and services. An attacker can make your services unavailable to customers, partners, and internal users, resulting in direct revenue loss, reputational damage, and potential violation of Service Level Agreements (SLAs). The extremely high EPSS score indicates a high probability of active exploitation, making this a high-priority threat to business continuity.

How an attack unfolds

A remote, unauthenticated attacker targets a public-facing server that supports the HTTP/2 protocol. The attacker crafts and sends a specially formed HTTP/2 request that begins with a HEADERS frame and is followed by an excessive number of CONTINUATION frames. The cumulative size of the headers is intentionally larger than the server's configured limit. Despite deciding to ultimately reject the request, the vulnerable server is forced to parse every CONTINUATION frame to maintain the HPACK state. By sending a continuous stream of these requests, the attacker monopolizes the server's CPU resources, causing it to become unresponsive to legitimate traffic and leading to a denial-of-service.

How to fix it

The primary remediation is to upgrade all components that terminate HTTP/2 traffic to a patched version. This includes web servers, reverse proxies, load balancers, and application-layer libraries. Consult vendor advisories for specific patches addressing CVE-2023-45288 or the 'HTTP/2 CONTINUATION Flood' attack. If patching is not immediately possible, consider temporary mitigations such as applying rate limits on edge devices, using a Web Application Firewall (WAF) to limit the number of frames per HTTP/2 stream, or temporarily disabling HTTP/2 if the business impact is acceptable.

How to confirm the fix worked

To validate the fix, ensure that all relevant software components have been upgraded to a version that explicitly addresses CVE-2023-45288. After patching, you can use a security testing tool or a custom script to simulate the 'CONTINUATION Flood' attack against a non-production endpoint. A successfully patched system should terminate the malicious connection promptly without a significant increase in CPU usage. To identify exposure, inventory all HTTP/2-enabled endpoints and check their software versions against vendor advisories for this vulnerability.

Typical attack path

1. The attacker identifies a target server, load balancer, or reverse proxy that accepts HTTP/2 connections.
2. The attacker crafts a malicious HTTP/2 stream containing a HEADERS frame followed by an abnormally large number of CONTINUATION frames.
3. The attacker sends the malicious stream to the target server over the network.
4. The target server begins parsing the excessive frames, causing its CPU utilization to spike to 100%.
5. The server becomes resource-exhausted and is unable to process legitimate user requests, resulting in a denial of service.

How to detect it

Detection of this attack is primarily behavioral. Monitor CPU utilization on HTTP/2-enabled servers for sustained, abnormally high levels. Analyze network traffic or server logs for an unusually high ratio of HTTP/2 CONTINUATION frames to HEADERS frames within a single stream. A high rate of HTTP/2 stream errors, particularly related to protocol errors or header size limits (e.g., HTTP 431), originating from a small number of source IPs can also indicate an attack. Some network security monitoring tools or WAFs may have specific signatures for 'HTTP/2 CONTINUATION Flood' that should be enabled.

• request header fields too large
• closing connection due to excessive continuation frames
• HTTP/2 stream error: protocol error
• HTTP/2 GOAWAY frame received with error code ENHANCE_YOUR_CALM
• refused stream due to excessive headers

What your security team should do

• Immediately patch all public-facing HTTP/2 endpoints, as the high CVSS score (7.5) and very high EPSS score (91.97%) indicate a significant and likely threat.
• If patching is delayed, deploy mitigation rules on Web Application Firewalls (WAFs) or other edge devices to limit the number of HTTP/2 CONTINUATION frames per stream.
• Implement monitoring and alerting for sustained high CPU utilization on servers that terminate HTTP/2 traffic, as this is the primary indicator of an ongoing attack.
• Ensure network and server logging can capture metadata about HTTP/2 streams, such as frame counts and stream errors, to aid in detection and forensic analysis.