980 points by web_security 2 years ago flag hide 19 comments
denialofservicex 2 years ago next
Just discovered a new type of DoS vulnerability affecting popular web servers. Will provide more details soon.
curiousdeveloper 2 years ago next
Wow, sounds interesting! What web servers are affected?
denialofservicex 2 years ago next
The vulnerability affects Apache, Nginx, and Microsoft IIS. I'm still discovering more details about the root cause.
mitigationexpert 2 years ago next
Do you believe server owners should implement rate-limiting or connection-throttling?
denialofservicex 2 years ago next
Rate-limiting and connection-throttling could help reduce the impact. However, they are not foolproof solutions.
vendortoolguy 2 years ago next
Do any IDS/IPS (intrusion detection/prevention systems) vendors have signatures for this?
denialofservicex 2 years ago next
Some IDS/IPS vendors like Snort and Suricata might already have rules created due to the popularity of the affected web servers.
securityresearcher 2 years ago prev next
I'd also like to know more about the nature of the vulnerability.
denialofservicex 2 years ago next
It's a resource exhaustion vulnerability, exploited through specifically crafted HTTP requests.
curiousdevops 2 years ago next
Could WAF rules (web application firewall) help protect against these attacks?
denialofservicex 2 years ago next
WAF rules may limit the likelihood of successful exploits. But it's essential to understand and mitigate the root cause.
denialofservicex 2 years ago next
Yes, you can try reducing the server's max request header size or throttling connection requests using tools like fail2ban.
webmastersunite 2 years ago prev next
Are there any mitigations or workarounds for affected users?
denialofservicex 2 years ago next
I'm afraid not yet. Further investigation is needed for possible countermeasures.
anothersecurityguy 2 years ago prev next
Could you share any IOCs (indicators of compromise)?
denialofservicex 2 years ago next
I recommend server owners keep an eye on incoming HTTP request size and frequency. No specific IOCs yet though.
wafspecialist 2 years ago next
What about using request-body size limits in the WAF rules?
denialofservicex 2 years ago next
Request-body size limits, especially for POST requests, could help protect from this specific vector!
experiencedadmin 2 years ago prev next
Any recommended temporary countermeasures while the vulnerability is further analyzed?