CVE-2023-44487 - HTTP/2 Rapid Reset Attack and the Halo Hosted Platform

The Vulnerability#

The official statement from NIST is available HERE

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

How this affects Halo#

This vulnerability exists in the HTTP/2 protocol and is not specific to Halo, its components, or service providers.

The Halo Hosted Platform#

Halo is hosted primarily in AWS utilising AWS Elastic Load Balancing and AWS WAF on all public resources. These are provided as a service by AWS are protected from DDOS by AWS.

Their statement is available HERE

Halo On-Prem#

The Halo application should be hosted behind Web Application Firewalls as best practice, as should all applications. Other restrictions will also mitigate attacks such as IP restriction, private access etc.

This should be managed by the client following industry best practices as this is a protocol level attack at the server rather than the application.