CVE-2023-44487

CVE-2023-44487 is a high-severity vulnerability discovered in web servers supporting HTTP/2, which allows threat actors to exploit the 'stream multiplexing' feature. This flaw enables attackers to send repeated requests and cancel them immediately, leading to a 'Rapid Reset' attack causing Denial of Service (DoS). The vulnerability was made public in October 2023, and it has been linked to a surge in hyper-volumetric attacks due to a sophisticated and persistent DDoS attack campaign that exploited this vulnerability. This vulnerability was one of three zero-day vulnerabilities addressed by Microsoft in their October update cycle. The other two were an elevation-of-privilege flaw in Skype for Business (CVE-2023-41763) and an information disclosure bug in WordPad (CVE-2023-36563). However, CVE-2023-44487 stood out as it enabled a new Distributed Denial-of-Service (DDoS) attack technique named "HTTP/2 Rapid Reset". In response, Microsoft released updates to the Visual Studio development platform excluding the Mitre Rapid Reset issue. Reports indicated that a remote attacker could send specially crafted requests to exploit the vulnerability in an attempt to carry out distributed denial-of-service (DDoS) attacks known as "Rapid Reset". These attacks exploited the HTTP/2 Rapid Reset vulnerability, contributing significantly to the rise in hyper-volumetric attacks. To mitigate this threat, Check Point IPS provides protection against this specific type of DDoS attack.