CDN Tsunami: Exploiting HTTP/3-HTTP/1.1 Conversion for DoS Attacks
For CDN operators and host websites, this reveals a critical vulnerability in heterogeneous HTTP protocol deployments that can be exploited for DoS attacks.
This paper identifies a new class of DoS attacks exploiting the conversion between HTTP/3 and HTTP/1.1 at CDNs, achieving bandwidth and connection amplification. The authors found 42,330 vulnerable subdomains, and two CDN vendors have acknowledged and mitigated the attacks.
Content Delivery Networks (CDNs) provide high availability, accelerate content delivery for their host websites, but are also vulnerable to different types of Denial-of-Service (DoS) attacks. Prior works have studied a variety of DoS attacks with HTTP/1.1 or HTTP/2 connections, but most of them are being fixed, making CDNs robust against such attacks. One unexplored research area is how the recent introduction of HTTP/3 at CDNs affects the DoS attack landscape, especially when there are heterogeneous deployments of HTTP/3 and HTTP/1.1 between CDNs and host websites. In this paper, we design the first study of DoS attacks against HTTP/3 protocols deployed at CDNs. Our key insight is that when the CDN adopts HTTP/3 but the host websites use HTTP/1.1, an adversary can utilize the disparity to amplify a small amount of traffic to the CDN using HTTP/3 to a large amount from the CDN to the host website using HTTP/1.1. More specifically, we design two attack variations-HTTP/3 Bandwidth Amplification (HBA) and HTTP/3 Connection Amplification (HCA)-targeting the bandwidth and the number of connections, respectively. Furthermore, we conduct a large-scale measurement upon the Tranco Top 1M domain list to quantify the real-world impact of these attacks, identifying 42,330 subdomains that are potentially vulnerable to our attacks. Finally, we responsibly disclose the details of our attacks to the affected CDN vendors: so far, two vendors have already acknowledged their vulnerabilities with bounties and have deployed our mitigations.