Search papers, labs, and topics across Lattice.
This study investigates the vulnerabilities of Content Delivery Networks (CDNs) to Denial-of-Service (DoS) attacks leveraging the transition from HTTP/1.1 to HTTP/3. By exploiting the disparity between these protocols, the authors develop two attack methods鈥擧TTP/3 Bandwidth Amplification (HBA) and HTTP/3 Connection Amplification (HCA)鈥攚hich can significantly increase the volume of traffic directed at host websites. The research identifies over 42,000 potentially vulnerable subdomains and has led to actionable mitigations from CDN vendors, highlighting the urgent need for enhanced security measures in the evolving web architecture.
Adversaries can amplify DoS attacks by exploiting the transition from HTTP/1.1 to HTTP/3, affecting over 42,000 subdomains in the wild.
Content Delivery Networks (CDNs) provide high availability, accelerate content delivery for their host websites, but are also vulnerable to different types of Denial-of-Service (DoS) attacks. Prior works have studied a variety of DoS attacks with HTTP/1.1 or HTTP/2 connections, but most of them are being fixed, making CDNs robust against such attacks. One unexplored research area is how the recent introduction of HTTP/3 at CDNs affects the DoS attack landscape, especially when there are heterogeneous deployments of HTTP/3 and HTTP/1.1 between CDNs and host websites. In this paper, we design the first study of DoS attacks against HTTP/3 protocols deployed at CDNs. Our key insight is that when the CDN adopts HTTP/3 but the host websites use HTTP/1.1, an adversary can utilize the disparity to amplify a small amount of traffic to the CDN using HTTP/3 to a large amount from the CDN to the host website using HTTP/1.1. More specifically, we design two attack variations-HTTP/3 Bandwidth Amplification (HBA) and HTTP/3 Connection Amplification (HCA)-targeting the bandwidth and the number of connections, respectively. Furthermore, we conduct a large-scale measurement upon the Tranco Top 1M domain list to quantify the real-world impact of these attacks, identifying 42,330 subdomains that are potentially vulnerable to our attacks. Finally, we responsibly disclose the details of our attacks to the affected CDN vendors: so far, two vendors have already acknowledged their vulnerabilities with bounties and have deployed our mitigations.
