My third installment of interesting research papers that I have read over the past few weeks and would like to share with my community.
This attack is notable not least because it obviates the need for an attacker to send an RST_STREAM frame, thereby completely bypassing Rapid Reset mitigations, and also achieves the same impact as the latter.
In an advisory, the CERT Coordination Center (CERT/CC) said MadeYouReset exploits a mismatch caused by stream resets between HTTP/2 specifications and the internal architectures of many real-world web servers, resulting in resource exhaustion — something an attacker can exploit to induce a DoS attack.
Discover how to create AI experiences with Copilot Studio and build low-code solutions using Microsoft Power Platform. Join the Microsoft Power Up Program today and get ready for the future of work.