CDN Judo: Breaking the CDN DoS Protection with Itself

Abstract

A content delivery network (CDN) improves the accessing performance and availability of websites via its globally distributed network infrastructures, which contributes to the thriving of CDN-powered websites on the Internet. Because CDNpowered websites normally operate important businesses or critical services, attackers are mostly interested in taking down these high-value websites, to achieve severe damage with maximum influence. Because the CDN absorbs distributed attacking traffic with its massive bandwidth resources, it is commonly believed that CDN vendors provide effective DoS protection for the CDNpowered websites. However, we reveal that implementation or protocol weaknesses in the forwarding mechanisms of the CDN can be exploited to break this CDN protection. By sending crafted but legal requests, an attacker can launch an efficient DoS attack against the website origin behind it. In particular, we present three CDN threats in this study. By abusing the HTTP/2 requestconverting behavior and HTTP pre-POST behavior of a CDN, an attacker can saturate the CDN-origin bandwidth and exhaust the connection limits of the origin. What is more concerning is that some CDN vendors use only a small set of traffic forwarding IPs with lower IP-churning rates to establish connections with the origin. This characteristic provides a great opportunity for an attacker to effectively degrade the global availability of a website just by cutting off specific CDN-origin connections. In this work, we examine the CDN request-forwarding behaviors across six well-known CDN vendors and perform real-world experiments to evaluate the severity of the threats. Because the threats are caused by flawed trade-offs made by the CDN vendors between usability and security, we discuss possible mitigation and received positive feedback after responsible disclosure to the aforementioned CDN vendors.

ReqsMiner: Automated Discovery of CDN Forwarding Request Inconsistencies and DoS Attacks with Grammar-based Fuzzing

“…These vulnerabilities allow powerful DoS attacks against origin servers, utilizing minimal bandwidth, yet yielding substantial effects. The amplification factor reach a 2,000 times in general, and under certain conditions, can even surpass 1,920,000 times, which is significantly higher than previous attacks [25], [32], [40].…”

“…CDNs might adopt this approach for commercial purposes, such as enhancing cache hit rates, or for safety measures leading to normalized requests. However, these disparities, known as CDN forwarding request inconsistencies, may also engender security vulnerabilities, including Denial of Service (DoS), Cache Poisoned Denial of Service (CPDoS), Forwarding Loop (FL), and Web Cache Poisoning (WCP) [11], [25], [32], [50].…”

“…Historically, the majority of proposed request discrepancies have been discovered manually in prior research [11], [25], [32]. This method may result in some variations in the forwarding request being overlooked.…”

“…A wealth of significant research reveals that CDNs frequently alter client requests as they relay them to the original server, thereby unveiling operational inconsistencies. These inconsistencies could potentially lead to security vulnerabilities, including the Host of Trouble (HoT), HTTP Request Smuggling (HRS), Denial of Service (DoS), and Cache Poisoned Denial of Service (CPDoS) [11], [25], [32], [50]. Concurrently, innovative attacks that exploit these inconsistencies pose substantial security threats to HTTP servers and CDNs, with HTTP/2 amplification attacks [25] and RangeAmp attacks [32] being notable examples.…”

Quantifying User Password Exposure to Third-Party CDNs

“…Besides CDN cache, researchers also presented approaches to disclosing the IP addresses of origin servers hidden behind CDNs, demonstrating insufficient DDoS protection of CDNs [54,30]. Moreover, attackers may utilize a CDN to launch DoS to an origin server or to the CDN itself [52,16,23]. In addition, Durumeric et al's measurement shows that the HTTPS interception on CDNs may downgrade the TLS version or cipher suites and thus reduce connection security [17].…”