CVE-2023-44487 — HTTP/2 Rapid Reset 테스트 랩

LTAT.04.022 과제 4를 위한 교육용 환경입니다.
네 개의 컨테이너로 취약한 구성과 패치된 구성을 스캔하고 비교할 수 있습니다.

포트 맵

컨테이너	포트	소프트웨어	상태
nginx-vuln	8441	nginx 1.24	취약
nginx-secure	8442	nginx latest	패치됨
apache-vuln	8443	Apache 2.4.57	취약
apache-secure	8444	Apache latest	패치됨

1. 설정

# Generate self-signed TLS certs (required by all containers)
bash gen-certs.sh

# Start all 4 containers
docker compose up -d

# Verify all are running
docker compose ps

2. 기본 연결 테스트

# Check each container responds (ignore cert warning with -k)
curl -k --http2 -I https://localhost:8441   # nginx vulnerable
curl -k --http2 -I https://localhost:8442   # nginx secure
curl -k --http2 -I https://localhost:8443   # apache vulnerable
curl -k --http2 -I https://localhost:8444   # apache secure

예상: 네 개 모두에서 HTTP/2 200 응답.

3. HTTP/2 활성 확인

curl -k --http2 -v https://localhost:8441 2>&1 | grep -E "ALPN|HTTP/"

다음을 확인하세요:

* ALPN: server accepted h2
< HTTP/2 200

4. CVE 스캐너 실행

# Copy the scanner here first (or adjust the path)
cp ../scanner.py .

python3 scanner.py localhost 8441   # nginx vuln
python3 scanner.py localhost 8442   # nginx secure
python3 scanner.py localhost 8443   # apache vuln
python3 scanner.py localhost 8444   # apache secure

예상 결과:

대상	HTTP/2	판정

5. 스트림 제한 확인 (핵심 차이점)

nghttp를 사용하여 각 서버가 전송하는 SETTINGS 프레임을 검사합니다.
이를 통해 SETTINGS_MAX_CONCURRENT_STREAMS 값을 직접 확인할 수 있습니다.

# Install nghttp2 client
sudo apt install nghttp2-client   # Ubuntu/Debian
brew install nghttp2              # macOS

# Inspect SETTINGS frame
for port in 8441 8442 8443 8444; LIKELY PAdo
  streams=$(nghttp -nvy https://localhost:$port 2>&1 | grep "MAX_CONCURRENT" | tail -1 | awk -F: '{print $2}' | tr -d ']')
  echo "port $port → MAX_CONCURRENT_STREAMS: $streams"
done

# (Results)
port 8441 → MAX_CONCURRENT_STREAMS: 128
port 8442 → MAX_CONCURRENT_STREAMS: 32
port 8443 → MAX_CONCURRENT_STREAMS: 1000
port 8444 → MAX_CONCURRENT_STREAMS: 32

취약 서버: 높은 스트림 제한 (128+)
보안 서버: 32로 제한

6. Rapid Reset 압력 시뮬레이션 (안전, 로컬 전용)

이는 하나의 연결에서 50개의 요청을 빠르게 전송합니다. 실제 공격은 아니지만, 서버의 RST 처리 동작을 로그에서 확인할 수 있습니다.

# h2load is part of nghttp2-client
h2load -n 1000 -c 1 -m 50 https://localhost:8441   # vuln
h2load -n 1000 -c 1 -m 50 https://localhost:8442   # secure

예시 로그:

$ h2load -n 1000 -c 1 -m 1000 https://localhost:8441
starting benchmark...
spawning thread #0: 1 total client(s). 1000 total requests
TLS Protocol: TLSv1.3
Cipher: TLS_AES_256_GCM_SHA384
Server Temp Key: X25519 253 bits
Application protocol: h2
progress: 10% done
progress: 20% done
progress: 30% done
progress: 40% done
progress: 50% done
progress: 60% done
progress: 70% done
progress: 80% done
progress: 90% done
progress: 100% done

finished in 22.51ms, 44428.65 req/s, 5.38MB/s
requests: 1000 total, 1000 started, 1000 done, 1000 succeeded, 0 failed, 0 errored, 0 timeout
status codes: 1000 2xx, 0 3xx, 0 4xx, 0 5xx
traffic: 124.07KB (127049) total, 83.01KB (85000) headers (space savings 38.85%), 23.44KB (24000) data
                     min         max         mean         sd        +/- sd
time for request:      260us      2.98ms      2.25ms       384us    87.70%
time for connect:     2.51ms      2.51ms      2.51ms         0us   100.00%
time to 1st byte:     3.24ms      3.24ms      3.24ms         0us   100.00%
req/s           :   45059.11    45059.11    45059.11        0.00   100.00%

$ h2load -n 1000 -c 1 -m 1000 https://localhost:8442
starting benchmark...
spawning thread #0: 1 total client(s). 1000 total requests
TLS Protocol: TLSv1.3
Cipher: TLS_AES_256_GCM_SHA384
Server Temp Key: X25519 253 bits
Application protocol: h2
progress: 10% done

finished in 5.38ms, 18583.91 req/s, 2.33MB/s
requests: 1000 total, 1000 started, 167 done, 100 succeeded, 900 failed, 900 errored, 0 timeout
status codes: 100 2xx, 0 3xx, 0 4xx, 0 5xx
traffic: 12.83KB (13134) total, 8.30KB (8500) headers (space savings 38.85%), 2.25KB (2300) data
                     min         max         mean         sd        +/- sd
time for request:       83us      1.04ms       533us       256us    63.00%
time for connect:     2.96ms      2.96ms      2.96ms         0us   100.00%
time to 1st byte:     3.55ms      3.55ms      3.55ms         0us   100.00%
req/s           :   19316.22    19316.22    19316.22        0.00   100.00%

보안 컨테이너는 스트림 제한에 도달하면 연결 재설정 또는 거부를 표시하고, 취약한 컨테이너는 50개 모두를 문제없이 수락합니다.

7. 서버 헤더 비교

# Vulnerable servers expose version info
curl -k -I https://localhost:8441 2>/dev/null | grep -i server
curl -k -I https://localhost:8443 2>/dev/null | grep -i server

# Secure servers hide or minimize version info
curl -k -I https://localhost:8442 2>/dev/null | grep -i server
curl -k -I https://localhost:8444 2>/dev/null | grep -i server

8. 정리

docker compose down

구성 변경 사항 (요약)

nginx

Apache

설정	취약 (2.4.57)	보안 (2.4.58+)
`H2MaxSessionStreams`	1000	32
`ServerTokens`	Full	Prod

참고 자료

NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-44487
Cloudflare 보고서: https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
Google 보고서: https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack
CISA 권고: https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487

`http2_max_concurrent_streams`	128 (기본값)	32
`keepalive_requests`	10000	100
`keepalive_timeout`	300s	65s
RST_STREAM rate guard	없음	패치에 내장

8441	예	취약 가능성 높음
8442	예	패치 가능성 높음
8443	예	취약 가능성 높음
8444	예	알 수 없음

CVE-2023-44487

인기