Microsoft Patches Three Actively Exploited Flaws
IPA Japan warns that three Microsoft vulnerabilities, including the HTTP/2 Rapid Reset DDoS flaw, are being actively exploited and urges immediate patching.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2023-36563, CVE-2023-41763, and CVE-2023-44487 as exploited in the wild.
The Information-technology Promotion Agency (IPA) of Japan issued an alert following Microsoft's October 2023 Patch Tuesday release, highlighting three vulnerabilities that Microsoft has confirmed are being actively exploited in the wild: CVE-2023-41763 (Skype for Business elevation of privilege), CVE-2023-36563 (Microsoft WordPad information disclosure), and CVE-2023-44487 (HTTP/2 Rapid Reset denial-of-service).
Of these, CVE-2023-44487 is the most consequential. The HTTP/2 Rapid Reset technique abuses stream cancellation in the HTTP/2 protocol to generate massive request volumes with minimal client resources, enabling record-breaking distributed denial-of-service attacks against servers and cloud infrastructure that support HTTP/2, including Microsoft's own services. This vulnerability affected a broad swath of internet infrastructure beyond Microsoft products, as it stems from a protocol-level design weakness rather than a single vendor implementation flaw.
IPA advises all users and administrators to apply Microsoft's October security updates immediately via Windows Update, given the confirmed active exploitation and the risk of expanding attacks. No specific threat actor or campaign is named in this advisory.
Mentioned in this report
Detection guidance
Potential HTTP/2 Rapid Reset DoS Activity (CVE-2023-44487)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects web/proxy log entries showing HTTP/2 requests immediately followed by client-initiated stream resets (sc-status 400/499) — the hallmark of the HTTP/2 Rapid Reset flood technique; a genuine attack will show this pattern repeated at very high volume (hundreds-to-thousands per second) from one or few source IPs within seconds, which should be confirmed via SIEM-side rate aggregation outside this rule. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Potential HTTP/2 Rapid Reset DoS Pattern
id: 98961324-93cb-50df-8b95-1084e1753fff
status: experimental
description: 'Identifies web server / reverse proxy log entries indicating HTTP/2
connections
where streams are opened and then abruptly reset by the client (sc-status 400 or
499,
or connection aborted) shortly after the request, consistent with the HTTP/2 Rapid
Reset
denial-of-service technique (CVE-2023-44487). A single event is not conclusive;
this
behaviour becomes malicious when observed at high frequency (tens to thousands of
resets per second) from the same client or small set of clients against one host,
which should be validated with rate-based correlation in the SIEM rather than in
this rule.
'
references:
- https://www.ipa.go.jp/
- https://nvd.nist.gov/vuln/detail/CVE-2023-44487
author: Vorant
tags:
- attack.t1499
logsource:
category: webserver
detection:
selection:
cs-version: HTTP/2.0
sc-status:
- 400
- 499
filter_healthcheck:
cs-uri-stem|contains:
- /health
- /status
- /ping
condition: selection and not filter_healthcheck
falsepositives:
- Load balancer or monitoring health checks using HTTP/2 that legitimately close streams
early
- Clients on unstable networks causing frequent HTTP/2 stream aborts
- Misconfigured HTTP/2 clients retried aggressively by legitimate applications
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/1011-ms.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs