Microsoft Patches Three Actively Exploited Flaws
IPA Japan warns that three Microsoft vulnerabilities, including the HTTP/2 Rapid Reset DDoS flaw, are being actively exploited and urges immediate patching.
The Information-technology Promotion Agency (IPA) of Japan issued an alert following Microsoft's October 2023 Patch Tuesday release, highlighting three vulnerabilities that Microsoft has confirmed are being actively exploited in the wild: CVE-2023-41763 (Skype for Business elevation of privilege), CVE-2023-36563 (Microsoft WordPad information disclosure), and CVE-2023-44487 (HTTP/2 Rapid Reset denial-of-service).
Of these, CVE-2023-44487 is the most consequential. The HTTP/2 Rapid Reset technique abuses stream cancellation in the HTTP/2 protocol to generate massive request volumes with minimal client resources, enabling record-breaking distributed denial-of-service attacks against servers and cloud infrastructure that support HTTP/2, including Microsoft's own services. This vulnerability affected a broad swath of internet infrastructure beyond Microsoft products, as it stems from a protocol-level design weakness rather than a single vendor implementation flaw.
IPA advises all users and administrators to apply Microsoft's October security updates immediately via Windows Update, given the confirmed active exploitation and the risk of expanding attacks. No specific threat actor or campaign is named in this advisory.
Mentioned in this report
Detection guidance
Potential HTTP/2 Rapid Reset DoS Activity (CVE-2023-44487)
Detects web/proxy log entries showing HTTP/2 requests immediately followed by client-initiated stream resets (sc-status 400/499) — the hallmark of the HTTP/2 Rapid Reset flood technique; a genuine attack will show this pattern repeated at very high volume (hundreds-to-thousands per second) from one or few source IPs within seconds, which should be confirmed via SIEM-side rate aggregation outside this rule. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Potential HTTP/2 Rapid Reset DoS Pattern
id: 98961324-93cb-50df-8b95-1084e1753fff
status: experimental
description: 'Identifies web server / reverse proxy log entries indicating HTTP/2
connections
where streams are opened and then abruptly reset by the client (sc-status 400 or
499,
or connection aborted) shortly after the request, consistent with the HTTP/2 Rapid
Reset
denial-of-service technique (CVE-2023-44487). A single event is not conclusive;
this
behaviour becomes malicious when observed at high frequency (tens to thousands of
resets per second) from the same client or small set of clients against one host,
which should be validated with rate-based correlation in the SIEM rather than in
this rule.
'
references:
- https://www.ipa.go.jp/
- https://nvd.nist.gov/vuln/detail/CVE-2023-44487
author: Vorant
tags:
- attack.t1499
logsource:
category: webserver
detection:
selection:
cs-version: HTTP/2.0
sc-status:
- 400
- 499
filter_healthcheck:
cs-uri-stem|contains:
- /health
- /status
- /ping
condition: selection and not filter_healthcheck
falsepositives:
- Load balancer or monitoring health checks using HTTP/2 that legitimately close streams
early
- Clients on unstable networks causing frequent HTTP/2 stream aborts
- Misconfigured HTTP/2 clients retried aggressively by legitimate applications
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/1011-ms.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free