CVE-2024-45397
NoneCVSS
—
EPSS
0.4%
Published
Oct 11, 2024
CISA due date
—
Cloudanix analysis
An attacker on the same network can make the server accept web requests that should have been blocked because of their origin address.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Moderate
- Impact
- Other
- Component
- Network Service
- Class
- Authorization Bypass
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
The flaw bypasses IP-address-based access control for HTTP requests delivered via TLS 1.3 early data over TCP Fast Open or QUIC 0-RTT packets, allowing spoofed source addresses to reach the server.
Why it matters to the business
Attackers on the network can reach resources or perform actions that should have been blocked by address-based rules, increasing the chance of unauthorized access or misuse of the server.
How an attack unfolds
An attacker on the network spoofs an allowed source address and sends an HTTP request inside a TLS 1.3 early-data or 0-RTT packet carried by TCP Fast Open or QUIC; because the access-control check occurs after the packet is accepted, the request is processed even though the real source address would have been rejected.
How to fix it
Upgrade to commit 15ed15a2efb83a77bb4baaa5a119e639c2f6898a; alternatively disable TCP Fast Open and QUIC until the fix can be applied.
How to confirm the fix worked
Confirm the running binary or source tree contains commit 15ed15a2efb83a77bb4baaa5a119e639c2f6898a; test by sending a spoofed-address request over 0-RTT or early data and verifying it is now rejected.
Typical attack path
- Locate an h2o instance that uses IP-based access control together with TCP Fast Open or QUIC 0-RTT
- Spoof a source IP address that the access-control list permits
- Craft an HTTP request and transmit it inside a TLS 1.3 early-data or QUIC 0-RTT packet
- Observe that the request is accepted and executed despite the spoofed origin
How to detect it
Inspect server access logs for HTTP requests that arrived via early data or 0-RTT from source addresses that would normally be denied; correlate with network flow records showing TCP Fast Open or QUIC handshakes.
What your security team should do
- Apply the upstream commit or a later release as soon as possible
- Disable TCP Fast Open and QUIC 0-RTT if the features are not required
- Review all IP-based access-control lists for reliance on source-address validation alone
- Monitor network logs for sudden changes in request origin patterns
The record
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or QUIC 0-RTT packets is received and the IP-address-based access control is used, the access control does not detect and prohibit HTTP requests conveyed by packets with a spoofed source address. This behavior allows attackers on the network to execute HTTP requests from addresses that are otherwise rejected by the address-based access control. The vulnerability has been addressed in commit 15ed15a. Users may disable the use of TCP FastOpen and QUIC to mitigate the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | h2o | 0 | No fix |
| Debian:12 | h2o | 0 | No fix |
| Debian:13 | h2o | 0 | No fix |
| Ubuntu:20.04:LTS | h2o | 0 | No fix |
| Ubuntu:22.04:LTS | h2o | 0 | No fix |
| Ubuntu:24.04:LTS | h2o | 0 | No fix |
| Ubuntu:24.10 | h2o | 0 | No fix |
| Ubuntu:25.04 | h2o | 0 | No fix |
| Ubuntu:25.10 | h2o | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | h2o | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | h2o | 0 | No fix |
| Ubuntu:Pro:22.04:LTS | h2o | 0 | No fix |