CDN Tsunami Attack Leverages HTTP/3 Translation for Massive DoS Amplification
Researchers have discovered the 'CDN Tsunami' attack, which exploits HTTP/3 to HTTP/1.1 translation by major CDNs to amplify denial-of-service attacks by up to 350x.
Cybersecurity researchers have unveiled a novel denial-of-service (DoS) attack, dubbed 'CDN Tsunami,' that exploits a fundamental translation process within major content delivery networks (CDNs). The attack targets the conversion of client-facing HTTP/3 traffic into HTTP/1.1 requests directed at origin servers, enabling attackers to amplify low-bandwidth requests by a staggering factor of up to 350x.
The research evaluated the vulnerability across six prominent CDN providers: Alibaba, Baidu, Cloudflare, Amazon CloudFront, Fastly, and Tencent. The study found that all six providers were susceptible to the bandwidth amplification variant of the attack, while five were vulnerable to the connection amplification variant. Cloudflare, however, was noted as unaffected by the connection variant due to its architecture, which buffers complete requests before establishing a connection to the origin server.
The attack's prerequisites are straightforward: a website hosted on one of the affected CDN providers, with HTTP/3 enabled at the CDN's edge, and crucially, no specific configuration changes required on the part of the website owner. The research indicated that HTTP/3 is enabled by default on services like Cloudflare and CloudFront, though documentation suggests it might be an optional feature on some plans or default to HTTP/2 for new distributions.
The most significant amplification factor of 350x was observed on Alibaba, Baidu, and Tencent. This higher amplification is attributed to their support for the QPACK dynamic table, a header compression format used in HTTP/3. When translating to HTTP/1.1, which lacks this compression, the CDN must decompress small index values into full headers, dramatically increasing the data load on the origin server. The amplification factors for Cloudflare, CloudFront, and Fastly ranged from approximately 36x to 51x.
Two distinct techniques form the basis of the CDN Tsunami attack: HTTP/3 Bandwidth Amplification (HBA) and HTTP/3 Connection Amplification (HCA). HBA leverages QPACK's header compression, where small compressed headers sent by the attacker are expanded by the CDN into much larger headers for the origin server. HCA, on the other hand, exploits the way CDNs manage connections. Many CDNs open an HTTP/1.1 connection to the origin server upon receiving only the HTTP/3 HEADERS frame, before the request body is fully transmitted. HTTP/3's multiplexing allows multiple streams to be carried over a single client connection, with each stream potentially triggering a separate backend TCP connection, thus overwhelming the origin's connection capacity.
While no specific CVE identifiers have been assigned to this vulnerability, and no exploitation in the wild has been reported, the findings have prompted action. Baidu and Tencent have confirmed the reports and implemented proposed fixes. Importantly, the researchers emphasize that all proposed mitigations are applied at the CDN level, not on the origin websites themselves, meaning website owners are reliant on their CDN provider for protection.
To assess the potential exposure, researchers scanned over 151,000 subdomains from the Tranco Top 1M list. Of these, approximately 42,000 responded to HTTP/3 requests, indicating potential vulnerability. CloudFront, Cloudflare, and Fastly hosted the largest numbers of these potentially vulnerable subdomains. The experiments confirmed that the attacks could scale to high-capacity servers, though the researchers imposed their own limits during testing.
This discovery draws parallels to the 'CDN Judo' study from 2020, which identified similar amplification risks in HTTP/2-to-HTTP/1.1 translation. The CDN Tsunami attack highlights the ongoing challenges in managing protocol translations at the network edge and the potential for sophisticated DoS attacks to emerge from these complexities.