Microsoft informed users on Wednesday that Windows servers running Internet Information Services (IIS) are vulnerable to denial-of-service (DoS) attacks that rely on malicious HTTP/2 requests.
According to the tech giant, sending specially crafted HTTP/2 requests can cause the machine’s CPU to temporarily spike to 100% until IIS kills the malicious connections.
“The HTTP/2 specification allows clients to specify any number of SETTINGS frames with any number of SETTINGS parameters. In some situations, excessive settings can cause services to become unstable and may result in a temporary CPU usage spike until the connection timeout is reached and the connection is closed,” Microsoft said in its advisory.
The vulnerability impacts Windows 10, Windows Server and Windows Server 2016. The February non-security updates released by Microsoft this week should address the issue by allowing IIS administrators to define thresholds on the number of HTTP/2 SETTINGS included in a request.
However, Microsoft noted that the updates it has released do not define any values by default and IIS administrators must do it themselves. The knowledge base article that should provide information on how to do this could not be accessed at the time of writing.
Microsoft has credited Gal Goldshtein of F5 Networks for reporting the vulnerability. It’s worth noting that a similar flaw, tracked as CVE-2018-16844, was discovered recently by Goldshtein in the nginx open source web server software.
“The flaw in Microsoft IIS could cause serious problems for organizations using IIS for their corporate website or applications. While Microsoft has developed a patch to fix this issue, it is still up to the IT team to properly configure IIS so the problem can’t be created. Microsoft specifically stated that they do not provide presets and as such fixing the problem is more than just applying the patch,” said Justin Jett, Director of Audit and Compliance at Plixer.
“IT teams should use network traffic analytics to look at connections going to their IIS servers to determine if they have connections going to their web servers that could be creating these problems. Often these connections are long-lived or the source connection continuously repeats to trigger a problem on the server. By looking at these metrics, IT teams can identify the source of the DDoS. These types of problems can be resolved with proper configuration. Network traffic analytics can help you understand where there may be configuration issues so the system can be updated before there are major problems like DDoS attacks,” Jett added.
Related: Windows Kernel Vulnerability Exploited in Attacks
Related: Microsoft Patches Actively Exploited Windows Vulnerability
