CVE-2024-27983
HIGHNode.js < 18.20.1, 19.x, < 20.12.1, < 21.7.2 - Denial of Service via HTTP/2 Frame Handling Race Condition
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-27983. PoCs published by lirantal.
AI-analyzed exploit summary This repository contains a working proof-of-concept exploit for CVE-2024-27983, demonstrating a continuation flood vulnerability in HTTP/2 servers. The exploit targets Node.js HTTP/2 servers without SSL, causing denial-of-service by overwhelming the server with malformed continuation frames.
Description
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
Exploits (1)
This repository contains a working proof-of-concept exploit for CVE-2024-27983, demonstrating a continuation flood vulnerability in HTTP/2 servers. The exploit targets Node.js HTTP/2 servers without SSL, causing denial-of-service by overwhelming the server with malformed continuation frames.
References (7)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H