AI 中文总结
本文针对 CDN 上的 HTTP/3 协议设计了两种 DoS 攻击变体，通过异构协议部署放大流量，经大规模测量识别出 42330 个潜在易受攻击子域，相关漏洞已获厂商确认并部署缓解措施。
AI 中文摘要
内容分发网络（CDN）具备高可用性，可为主机网站加速内容分发，但也易遭受各类拒绝服务（DoS）攻击。过往研究已针对 HTTP/1.1 或 HTTP/2 连接的多种 DoS 攻击展开分析，其中多数攻击已被修复，使 CDN 对这类攻击具备较强抵御能力。一个尚未被探索的研究领域是，CDN 近期引入 HTTP/3 对 DoS 攻击格局的影响，尤其是当 CDN 与主机网站之间存在 HTTP/3 和 HTTP/1.1 的异构部署时。本文针对部署在 CDN 上的 HTTP/3 协议开展了首次 DoS 攻击研究。核心发现是：当 CDN 采用 HTTP/3 而主机网站使用 HTTP/1.1 时，攻击者可利用这种差异，将少量经 HTTP/3 发送至 CDN 的流量，放大为从 CDN 发往主机网站的大量 HTTP/1.1 流量。更具体而言，我们设计了两种攻击变体：HTTP/3 带宽放大（HBA）和 HTTP/3 连接放大（HCA），分别针对带宽和连接数量。此外，我们针对 Tranco 排名前 100 万的域名列表开展了大规模测量，以量化这些攻击在现实世界中的影响，共识别出 42330 个子域可能易受攻击。最后，我们负责任地向受影响的 CDN 厂商披露了攻击细节，截至目前已有两家厂商确认其存在漏洞并给予赏金，且已部署我们提出的缓解措施。
英文摘要
Content Delivery Networks (CDNs) provide high availability, accelerate content delivery for their host websites, but are also vulnerable to different types of Denial-of-Service (DoS) attacks. Prior works have studied a variety of DoS attacks with HTTP/1.1 or HTTP/2 connections, but most of them are being fixed, making CDNs robust against such attacks. One unexplored research area is how the recent introduction of HTTP/3 at CDNs affects the DoS attack landscape, especially when there are heterogeneous deployments of HTTP/3 and HTTP/1.1 between CDNs and host websites. In this paper, we design the first study of DoS attacks against HTTP/3 protocols deployed at CDNs. Our key insight is that when the CDN adopts HTTP/3 but the host websites use HTTP/1.1, an adversary can utilize the disparity to amplify a small amount of traffic to the CDN using HTTP/3 to a large amount from the CDN to the host website using HTTP/1.1. More specifically, we design two attack variations-HTTP/3 Bandwidth Amplification (HBA) and HTTP/3 Connection Amplification (HCA)-targeting the bandwidth and the number of connections, respectively. Furthermore, we conduct a large-scale measurement upon the Tranco Top 1M domain list to quantify the real-world impact of these attacks, identifying 42,330 subdomains that are potentially vulnerable to our attacks. Finally, we responsibly disclose the details of our attacks to the affected CDN vendors: so far, two vendors have already acknowledged their vulnerabilities with bounties and have deployed our mitigations.
CommentsThis paper has been accepted for publication at the IEEE International Symposium on Reliable Distributed Systems (SRDS) 2026
