CVE-2023-44487 — HTTP/2 Rapid Reset 测试实验室
LTAT.04.022 作业4的教育环境。
四个容器让你扫描和比较易受攻击与已修补的配置。
端口映射
| 容器 | 端口 | 软件 | 状态 |
|---|
| nginx-vuln | 8441 | nginx 1.24 | 易受攻击 |
| nginx-secure | 8442 | nginx latest | 已修补 |
| apache-vuln | 8443 | Apache 2.4.57 | 易受攻击 |
| apache-secure | 8444 | Apache latest | 已修补 |
1. 设置
# Generate self-signed TLS certs (required by all containers)
bash gen-certs.sh
# Start all 4 containers
docker compose up -d
# Verify all are running
docker compose ps
2. 基本连接测试
# Check each container responds (ignore cert warning with -k)
curl -k --http2 -I https://localhost:8441 # nginx vulnerable
curl -k --http2 -I https://localhost:8442 # nginx secure
curl -k --http2 -I https://localhost:8443 # apache vulnerable
curl -k --http2 -I https://localhost:8444 # apache secure
预期结果：全部四个返回 HTTP/2 200。
3. 确认 HTTP/2 已启用
curl -k --http2 -v https://localhost:8441 2>&1 | grep -E "ALPN|HTTP/"
查找：
* ALPN: server accepted h2
< HTTP/2 200
4. 运行 CVE 扫描器
# Copy the scanner here first (or adjust the path)
cp ../scanner.py .
python3 scanner.py localhost 8441 # nginx vuln
python3 scanner.py localhost 8442 # nginx secure
python3 scanner.py localhost 8443 # apache vuln
python3 scanner.py localhost 8444 # apache secure
预期结果：
5. 检查流限制（关键区别）
使用 nghttp 检查每个服务器发送的 SETTINGS 帧。
这会直接显示 SETTINGS_MAX_CONCURRENT_STREAMS 的值。
# Install nghttp2 client
sudo apt install nghttp2-client # Ubuntu/Debian
brew install nghttp2 # macOS
# Inspect SETTINGS frame
for port in 8441 8442 8443 8444; LIKELY PAdo
streams=$(nghttp -nvy https://localhost:$port 2>&1 | grep "MAX_CONCURRENT" | tail -1 | awk -F: '{print $2}' | tr -d ']')
echo "port $port → MAX_CONCURRENT_STREAMS: $streams"
done
# (Results)
port 8441 → MAX_CONCURRENT_STREAMS: 128
port 8442 → MAX_CONCURRENT_STREAMS: 32
port 8443 → MAX_CONCURRENT_STREAMS: 1000
port 8444 → MAX_CONCURRENT_STREAMS: 32
易受攻击的服务器：高流限制（128+）
安全的服务器：限制为 32
6. 模拟快速重置压力（安全，仅本地）
这会在一个连接上快速发送 50 个请求 —— 不是真正的攻击，
但可以在日志中显示服务器的 RST 处理行为。
# h2load is part of nghttp2-client
h2load -n 1000 -c 1 -m 50 https://localhost:8441 # vuln
h2load -n 1000 -c 1 -m 50 https://localhost:8442 # secure
示例预期日志：
$ h2load -n 1000 -c 1 -m 1000 https://localhost:8441
starting benchmark...
spawning thread #0: 1 total client(s). 1000 total requests
TLS Protocol: TLSv1.3
Cipher: TLS_AES_256_GCM_SHA384
Server Temp Key: X25519 253 bits
Application protocol: h2
progress: 10% done
progress: 20% done
progress: 30% done
progress: 40% done
progress: 50% done
progress: 60% done
progress: 70% done
progress: 80% done
progress: 90% done
progress: 100% done
finished in 22.51ms, 44428.65 req/s, 5.38MB/s
requests: 1000 total, 1000 started, 1000 done, 1000 succeeded, 0 failed, 0 errored, 0 timeout
status codes: 1000 2xx, 0 3xx, 0 4xx, 0 5xx
traffic: 124.07KB (127049) total, 83.01KB (85000) headers (space savings 38.85%), 23.44KB (24000) data
min max mean sd +/- sd
time for request: 260us 2.98ms 2.25ms 384us 87.70%
time for connect: 2.51ms 2.51ms 2.51ms 0us 100.00%
time to 1st byte: 3.24ms 3.24ms 3.24ms 0us 100.00%
req/s : 45059.11 45059.11 45059.11 0.00 100.00%
$ h2load -n 1000 -c 1 -m 1000 https://localhost:8442
starting benchmark...
spawning thread #0: 1 total client(s). 1000 total requests
TLS Protocol: TLSv1.3
Cipher: TLS_AES_256_GCM_SHA384
Server Temp Key: X25519 253 bits
Application protocol: h2
progress: 10% done
finished in 5.38ms, 18583.91 req/s, 2.33MB/s
requests: 1000 total, 1000 started, 167 done, 100 succeeded, 900 failed, 900 errored, 0 timeout
status codes: 100 2xx, 0 3xx, 0 4xx, 0 5xx
traffic: 12.83KB (13134) total, 8.30KB (8500) headers (space savings 38.85%), 2.25KB (2300) data
min max mean sd +/- sd
time for request: 83us 1.04ms 533us 256us 63.00%
time for connect: 2.96ms 2.96ms 2.96ms 0us 100.00%
time to 1st byte: 3.55ms 3.55ms 3.55ms 0us 100.00%
req/s : 19316.22 19316.22 19316.22 0.00 100.00%
安全的容器在达到流限制时会显示连接重置或拒绝；
易受攻击的容器则会毫无抱怨地接受全部 50 个请求。
7. 比较服务器响应头
# Vulnerable servers expose version info
curl -k -I https://localhost:8441 2>/dev/null | grep -i server
curl -k -I https://localhost:8443 2>/dev/null | grep -i server
# Secure servers hide or minimize version info
curl -k -I https://localhost:8442 2>/dev/null | grep -i server
curl -k -I https://localhost:8444 2>/dev/null | grep -i server
8. 清理
配置更改内容（总结）
nginx
Apache
| 设置 | 易受攻击 (2.4.57) | 安全 (2.4.58+) |
|---|
H2MaxSessionStreams | 1000 | 32 |
ServerTokens | Full | Prod |
| 重置保护补丁 |
参考
