New research has revealed a pair of denial-of-service (DoS) attack techniques, collectively termed "CDN Tsunami," that leverage the protocol translation mechanisms within major content delivery networks. These methods exploit the process by which CDNs convert HTTP/3 requests into HTTP/1.1 for communication with origin servers, enabling attackers to amplify relatively small requests into substantial loads directed at those origins. Amplification factors as high as 350 times have been observed in testing against certain CDN configurations.
The core of the CDN Tsunami attacks lies in how CDNs handle the translation of HTTP/3 requests, particularly those with malformed or oversized headers, when forwarding them to origin servers that typically communicate via HTTP/1.1. An attacker can craft a low-bandwidth HTTP/3 request that, when processed and translated by the CDN, results in a significantly larger HTTP/1.1 request or a series of requests being sent to the origin. This amplification can overwhelm the origin server's resources, leading to service disruption.
One reported method involves sending HTTP/3 requests with numerous or excessively large headers. While HTTP/3 is designed to handle header compression efficiently, the translation process to HTTP/1.1, which lacks such native compression, can cause the CDN to generate a much larger HTTP/1.1 request. This expansion of data volume between the CDN and the origin server is the key to the amplification effect.
The second reported method exploits how CDNs might handle certain HTTP/3 stream management or error conditions during translation. By manipulating these aspects, an attacker can induce the CDN to generate multiple HTTP/1.1 requests or resource-intensive operations against the origin in response to a single, small HTTP/3 input. This can lead to a significant increase in processing load on the origin server.
The identified vulnerabilities reportedly affect a range of prominent CDN services, including those offered by Alibaba, Baidu, Cloudflare, Amazon CloudFront, Fastly, and Tencent. This widespread impact underscores the systemic nature of the issue, touching upon a common architectural pattern in modern web infrastructure. Mitigation strategies are reportedly under development and in the process of being deployed by some of the affected vendors.
For organizations utilizing these CDN services, typical mitigation guidance for this class of issue often involves ensuring that origin servers are configured with robust rate limiting and request validation mechanisms. While CDNs are expected to filter malicious traffic, a layered defense approach is always recommended. Additionally, monitoring origin server load and traffic patterns for anomalies can help detect and respond to such attacks.
The CDN Tsunami attacks highlight an evolving threat landscape where attackers increasingly target the complex interplay between different web protocols and infrastructure components. As the internet transitions to newer protocols like HTTP/3, the potential for novel amplification techniques emerges, requiring continuous vigilance and adaptation from both CDN providers and their customers to secure the underlying web infrastructure.
