FRAMESHIFTER: Security Implications of HTTP/2-to-HTTP/1 Conversion Anomalies

HTTP/2 adoption is rapidly climbing. However, in practice, Internet communications still rarely happen over end-to-end HTTP/2 channels. This is due to Content Delivery Networks and other reverse proxies, ubiquitous and necessary components of the Internet ecosystem, which only support HTTP/2 on the client's end, but not the forward connection to the origin server. Instead, proxy technologies predominantly rely on HTTP/2-to-HTTP/1 protocol conversion between the two legs of the connection. We present the first systematic exploration of HTTP/2-to-HTTP/1 protocol conversion anomalies and their security implications. We develop a novel grammar-based fuzzer for HTTP/2, experiment with 12 popular reverse proxy technologies & CDNs through HTTP/2 frame sequence and content manipulation, and discover a plethora of novel web application attack vectors that lead to Request Blackholing, Denialof-Service, Query-of-Death, and Request Smuggling attacks. DATA: Carries a request or a response body. HEADERS: Carries header fields of a request or a response. PRIORITY: Specifies the priority of a stream and its dependency on another stream. RST_STREAM: Terminates the stream. SETTINGS: Conveys information about preferences and constraints of the sender. PUSH_PROMISE: Notifies the peer endpoint about streams it intends to initiate in the future. PING: Measures round-trip time and checks if an idle connection is still functional. GOAWAY: Shuts down a connection. WINDOW_UPDATE: Implements flow control. CONTINUATION: Continues a sequence of header fields. HTTP/2-to-HTTP/1 Conversion HTTP/2 is the most widely used HTTP version by clients today. A 7M-site measurement using the Chrome browser, done by the HTTP Archive in 2020, showed that 64% of requests use HTTP/2 [10].