What additional mitigation can be implemented on the Origin Shield?

Question

Firewall rules incorporating rate-limiting capabilities can be deployed on the Origin Shield. These rules are instrumental in curtailing the volume of incoming requests and are capable of rejecting those that are excessive. This mechanism serves to indirectly ameliorate the impact of the HTTP/2 Rapid Reset vulnerability.

Accepted Answer

The HTTP/2 protocol, as exploited in the CVE-2023-44487 vulnerability, allows for the rapid establishment and subsequent cancellation of data streams. Attackers leverage this by opening a multitude of streams concurrently and immediately issuing RST_STREAM frames to reset them. This behavior, characterized by a high rate of requests per second, can overwhelm target HTTP/2 servers by exhausting their resources, primarily through elevated CPU utilization. Implementing rate limits on the Origin Shield acts as a crucial control point. By setting thresholds for the number of requests or connection rates, excessive traffic can be identified and dropped before it reaches the origin servers. This proactive filtering helps to maintain server stability and availability, even under duress from such rapid reset attacks.

Reading history

Hide →

This history is cleared when the page is closed.

What additional mitigation can be implemented on the Origin Shield?

Loading

Was this article helpful?

Helpful

Not helpful

Report an issue

1

0

0

Share with friends