CVE-2023-44487 HTTP/2 Rapid Reset Testing Tool - Enhanced Edition

A comprehensive Python testing tool for CVE-2023-44487, the HTTP/2 Rapid Reset vulnerability. This repository contains both attack testing and verification-focused tools.

⚠️ IMPORTANT DISCLAIMER

This tool is for educational and authorized testing purposes ONLY!

Only use against systems you own or have explicit written permission to test
Unauthorized use may be illegal and could cause service disruption
The tools perform attack tests that can impact server availability
Always ensure you have proper authorization before testing

🔍 About CVE-2023-44487

CVE-2023-44487, also known as "HTTP/2 Rapid Reset," is a critical vulnerability in the HTTP/2 protocol that allows attackers to:

Cause denial of service by rapidly sending and canceling HTTP/2 streams
Consume excessive server resources with minimal client resources
Bypass many traditional rate limiting mechanisms
Affect major web servers and load balancers

CVSS Score: 7.5 (High)

Impact: Denial of Service, Resource Exhaustion

📋 Requirements

Python 3.7 or higher
h2 library: pip install h2

📖 Installation

Clone or download the repository:

git clone https://github.com/madhusudhan-in/CVE_2023_44487-Rapid_Reset.git
cd CVE_2023_44487-Rapid_Reset

Install dependencies:

pip install h2

Make scripts executable:

chmod +x *.py

Verify Python version:

python3 --version  # Should be 3.7+

🛡️ Verification Tool (Enhanced)

`cve_2023_44487_verifier_enhanced.py`

Purpose: Enforcement-signal detection for post-patch verification and compliance checking

Key Features

📡 Server SETTINGS Capture: Logs the server's initial HTTP/2 SETTINGS frame
🛡️ GOAWAY Frame Analysis: Captures and categorizes all GOAWAY frames with RFC 9113-compliant error codes
📊 Per-Second Rate Tracking: Monitors reset rate per second to detect adaptive throttling patterns
🔍 Enforcement Signal Detection:
- ✅ ENHANCE_YOUR_CALM (0xb) GOAWAY — protocol-layer enforcement
- ✅ TCP RST at transport layer — edge-level intervention
- ✅ REFUSED_STREAM (0x7) responses — stream-level rate limiting
- ✅ Adaptive throttling patterns — intelligent rate-limiting detection
📈 Connection Close Classification: Identifies how and why connections close
⚡ Concurrent Connection Testing: Test multiple HTTP/2 connections simultaneously
🎯 Intelligent Verdict System: Classifies vulnerability status based on actual enforcement signals

Quick Start

# Basic verification
python3 cve_2023_44487_verifier_enhanced.py target.com

# Multiple concurrent connections
python3 cve_2023_44487_verifier_enhanced.py target.com -c 5 -s 500

# Verbose output with debugging
python3 cve_2023_44487_verifier_enhanced.py target.com -v -c 3 -s 1000

# Baseline test only (normal requests)
python3 cve_2023_44487_verifier_enhanced.py target.com --baseline-only

Command Line Options

Option	Description	Default
`host`	Target hostname (required)	-
`-p, --port`	Target port	443
`--no-ssl`	Disable SSL/TLS	False (SSL enabled)
`-s, --streams`	Number of streams per connection	1000
`-d, --delay`	Delay between stream operations (seconds)	0.001
`-c, --connections`	Number of concurrent connections	1
`--baseline-only`	Only perform baseline test (no attack)	False
`-v, --verbose`	Verbose/debug output	False

Understanding the Verdict

The script provides an intelligent verdict based on RFC 9113-compliant enforcement signals:

✅ ENFORCEMENT CONFIRMED

Server sends GOAWAY with ENHANCE_YOUR_CALM (0xb) error code
Classification: NOT VULNERABLE — protocol-layer enforcement is active
Meaning: HTTP/2 implementation has proper rate-limiting controls

⚠️ EDGE/TRANSPORT-LEVEL INTERVENTION DETECTED

50%+ of connections terminated via TCP reset
Classification: LIKELY PROTECTED — verify with edge/infrastructure team
Meaning: Edge appliance or DDoS protection engaged at transport layer

⚠️ ADAPTIVE THROTTLING DETECTED

Per-second reset rate drops significantly over time (late buckets <60% of early)
Classification: PARTIAL PROTECTION — confirm with infrastructure team
Meaning: Server or edge slowing the attack adaptively

⚠️ STREAM REFUSAL DETECTED

Server sends REFUSED_STREAM (0x7) responses
Classification: PARTIAL PROTECTION — review rate limits
Meaning: Some stream-level rate-limiting in place

❌ NO PROTOCOL-LAYER ENFORCEMENT OBSERVED

No ENHANCE_YOUR_CALM GOAWAY, no TCP resets, no throttling detected
Classification: VECTOR EXERCISABLE — exploitability unconfirmed
Important: This doesn't prove DoS exploitability. Edge volumetric/behavioral 
protections (Akamai, CloudFlare) may engage at higher scales

Sample Output

============================================================
ENFORCEMENT SIGNAL ANALYSIS
============================================================
Server SETTINGS (initial frame):
  HEADER_TABLE_SIZE = 4096
  ENABLE_PUSH = True
  MAX_CONCURRENT_STREAMS = 128
  INITIAL_WINDOW_SIZE = 65535
  MAX_FRAME_SIZE = 16384
  → MAX_CONCURRENT_STREAMS=128 is conservative (good post-CVE default)

GOAWAY breakdown across connections:
  ENHANCE_YOUR_CALM (0xb): 3/5
  Other GOAWAY codes:      1/5
  No GOAWAY received:      1/5
  TCP reset (RST at transport): 0/5
  Total RST_STREAM frames from server: 2
  REFUSED_STREAM frames from server:   0
  Connections showing adaptive throttling: 1/5

============================================================
VERDICT
============================================================
✅ ENFORCEMENT CONFIRMED
   3/5 connection(s) received GOAWAY with ENHANCE_YOUR_CALM (0xb).
   This is the canonical signal that the CVE-2023-44487 mitigation is active.
   Classification: NOT VULNERABLE — protocol-layer enforcement is engaged.

Advanced Usage Examples

1. Post-Patch Verification

# Verify patch deployment with 10 connections, 500 streams each
python3 cve_2023_44487_verifier_enhanced.py prod-api.example.com \
    -c 10 \
    -s 500 \
    -d 0.0001 \
    -v

2. Custom Port and Protocol

# Test non-standard HTTPS port
python3 cve_2023_44487_verifier_enhanced.py example.com \
    -p 8443 \
    -c 5 \
    -s 1000

3. Infrastructure Compliance Check

# Minimal load compliance test
python3 cve_2023_44487_verifier_enhanced.py example.com \
    -c 3 \
    -s 200 \
    --baseline-only

Technical Details

HTTP/2 Enforcement Signals

ENHANCE_YOUR_CALM (Error Code 0xb):

Canonical HTTP/2 rate-limiting signal (RFC 9113)
Server responds to rapid reset attack with GOAWAY 0xb
Indicates protocol-layer defense is active
Best practice post-CVE-2023-44487 mitigation

REFUSED_STREAM (Error Code 0x7):

Server refuses to open new streams
Alternative stream-level rate-limiting mechanism
Less common but still valid defense

Per-Second Reset Rate Analysis:

Buckets stream resets into 1-second windows
Detects adaptive throttling: if late buckets <<early buckets, server is adapting
Suggests intelligent rate-limiting (not just hard limits)

TCP RST at Transport Layer:

Connection terminated at TCP layer before graceful HTTP/2 close
Suggests edge appliance or firewall intervention
Not HTTP/2 protocol-layer enforcement, but effective

CVE_2023_44487-Rapid_Reset

Most Popular