漏洞标题
h2o 容易被 TLS 会话暂停的 misdirection 攻击所 vulnerability
漏洞描述信息
h2o是一个支持HTTP/1.x、HTTP/2和HTTP/3的HTTP服务器。在2.3.0-beta2版本之前，当h2o被配置为监听多个地址或端口，这些地址或端口分别由多个实体管理的不同后端服务器时，一个恶意的后端实体也可能有机会观察或注入客户端和h2o之间的 packets，并错误地将HTTPS请求指向其他后端，并观察发送的HTTPS请求的内容。
攻击涉及一个受害者客户端试图恢复TLS连接，而攻击者将 packets redirect 到客户端 unintended 地址或端口。攻击者必须已经被h2o的管理员配置为充当客户端监听的h2o实例的后端。Session IDs和 tickets 由h2o生成的ID和条目不依赖于服务器地址、端口或X.509证书 specific 的信息，因此攻击者有可能迫使受害者连接错误地恢复对相同的h2o实例监听的不同服务器地址或端口。
一旦TLS连接错误地错误地导航到被配置为使用攻击者控制的服务器作为后端的服务器地址或端口，根据配置，来自受害者客户端的HTTPS请求可能会被转发到攻击者的服务器。
只有当h2o实例被配置为使用主机级别上的 listen 指令监听不同的地址或端口，并配置为连接由多个实体管理的后端服务器时，该实例才容易被此攻击所攻击。
一个h2o实例只有在使用全局级别上的 listen 指令停止使用，转而使用主机级别上的 listen 指令时，才容易被此攻击所攻击。
作为 workaround，您可以停止使用主机级别上的 listen 指令，转而使用全局级别上的 listen 指令。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
漏洞类别
信息暴露
漏洞标题
h2o vulnerable to TLS session resumption misdirection
漏洞描述信息
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. In version 2.3.0-beta2 and prior, when h2o is configured to listen to multiple addresses or ports with each of them using different backend servers managed by multiple entities, a malicious backend entity that also has the opportunity to observe or inject packets exchanged between the client and h2o may misdirect HTTPS requests going to other backends and observe the contents of that HTTPS request being sent.
The attack involves a victim client trying to resume a TLS connection and an attacker redirecting the packets to a different address or port than that intended by the client. The attacker must already have been configured by the administrator of h2o to act as a backend to one of the addresses or ports that the h2o instance listens to. Session IDs and tickets generated by h2o are not bound to information specific to the server address, port, or the X.509 certificate, and therefore it is possible for an attacker to force the victim connection to wrongfully resume against a different server address or port on which the same h2o instance is listening.
Once a TLS session is misdirected to resume to a server address / port that is configured to use an attacker-controlled server as the backend, depending on the configuration, HTTPS requests from the victim client may be forwarded to the attacker's server.
An H2O instance is vulnerable to this attack only if the instance is configured to listen to different addresses or ports using the listen directive at the host level and the instance is configured to connect to backend servers managed by multiple entities.
A patch is available at commit 35760540337a47e5150da0f4a66a609fad2ef0ab. As a workaround, one may stop using using host-level listen directives in favor of global-level ones.
CVSS信息
CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
漏洞类别
密码学签名的验证不恰当
漏洞标题
h2o 数据伪造问题漏洞
漏洞描述信息
h2o是新一代的 HTTP 服务器。与老一代的 HTTP 服务器相比，它不仅速度非常快，而且还为最终用户提供了更快的响应。 h2o 2.3.0-beta2及之前版本存在数据伪造问题漏洞，该漏洞源于恶意后端实体有机会观察或注入客户端和h2o之间交换的数据包，可能会将HTTPS请求误导到其他后端。
CVSS信息
N/A
漏洞类别
授权问题