bcdannyboy / cve-2023-44487

Basic vulnerability scanning to see if web servers may be vulnerable to CVE-2023-44487

CVE-2023-44487

Basic vulnerability scanning to see if web servers may be vulnerable to CVE-2023-44487

This tool checks to see if a website is vulnerable to CVE-2023-44487 completely non-invasively.

1. The tool checks if a web server accepts HTTP/2 requests without downgrading them
2. If the web server accepts and does not downgrade HTTP/2 requests the tool attempts to open a connection stream and subsequently reset it
3. If the web server accepts the creation and resetting of a connection stream then the server is definitely vulnerable, if it only accepts HTTP/2 requests but the stream connection fails it may be vulnerable if the server-side capabilities are enabled.

To run,

$ python3 -m pip install -r requirements.txt

$ python3 cve202344487.py -i input_urls.txt -o output_results.csv

You can also specify an HTTP proxy to proxy all the requests through with the --proxy flag

$ python3 cve202344487.py -i input_urls.txt -o output_results.csv --proxy http://proxysite.com:1234

The script outputs a CSV file with the following columns

• Timestamp: a timestamp of the request
• Source Internal IP: The internal IP address of the host sending the HTTP requests
• Source External IP: The external IP address of the host sending the HTTP requests
• URL: The URL being scanned
• Vulnerability Status: "VULNERABLE"/"LIKELY"/"POSSIBLE"/"SAFE"/"ERROR"
• Error/Downgrade Version: The error or the version the HTTP server downgrades the request to

Note: "Vulnerable" in this context means that it is confirmed that an attacker can reset the a stream connection without issue, it does not take into account implementation-specific or volume-based detections

Dockerized

Build

$ docker build -t py-cve-2023-44487 .

Run:

$ docker run --rm -v /path/to/urls:/shared py-cve-2023-44487 -i /shared/input_urls.txt -o /shared/output_results.csv

cve-2023-44487's Issues

Vulnerable

Hello, thank you for this PoC. Can you explain more on the "Vulnerable" determination. My understanding is that resetting the connection and sending another request is perfectly fine to do. The "fix" that seems to be recommended is to limit the number of concurrent connections on the web server as to not overwhelm it. This script does not test the limit of the connections, so not sure how you can say DDOS is 100% possible with just checking the reset and not the number of connections. Thank you!.

Missing License file

Hi

We'd like to include a variant of this in https://github.com/minvws/nl-kat-coordination
What license are you providing this code under?

Unclear responses for haproxy

According to https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487 haproxy >= 1.9 is not affected. The scan results are inconclusive though:

With version 2.7.6 and alpn h2 enabled:

Failed to send RST_STREAM: send_rst_stream_h2 - 'RemoteSettingsChanged' object has no attribute 'stream_id'

With version 2.2.9 and alpn h2 enabled:

Failed to send RST_STREAM: send_rst_stream_h2 - The read operation timed out

only ASCII encoding is supported for input file

Hello,
I have encountered a problem that only ASCII encoding is supported for input file. Update please a parameter description or fix this issue in source code.
Thank you.

I have a question about "server-side capabilities are enabled"

Hello Dear,

In the script instructions you state that "you only accept HTTP/2 requests but the flow connection fails, you may be vulnerable if server-side capabilities are enabled. "

I'd like to know which "server-side capabilities are enabled". ?

Thank you in advance

definition of Possible status

Thanks for creating the script
I have tried to check a Cloudflare URL, but the result is POSSIBLE

Cloudflare should mitigated the attack pathway, not sure anything can the script to adjust the correct status?