CPDoS: Cache-Poisoned Denial of Service
CPDoS (Cache-Poisoned Denial of Service) is a new kind of attack on CDN and proxy caches. Unlike a traditional DoS attack, it doesn't need a large volume of traffic. The attacker sends a request that makes the origin server return an error. The cache stores the error, and from then on every user who requests that resource gets the error page instead of the content. One request is enough to make a page unavailable for everyone behind that cache.
The attack works because the cache and the origin server handle the same request differently. There are three variants.
HTTP Header Oversize (HHO)
The request includes a header that is within the cache's size limit but over the origin server's limit. Apache's default limit is 8,190 bytes. The cache forwards the request, the origin rejects it with an error, and the cache stores that error.
HTTP Meta Character (HMC)
The request includes a header with meta characters. The cache passes it through, the origin treats it as invalid and returns an error, and the error ends up in the cache.
HTTP Method Override (HMO)
Some frameworks let a header override the HTTP method. The attacker sends an ordinary GET with an override to a method the resource doesn't support, such as DELETE. The origin responds with an error, and the cache stores it as the response to the GET.
None of these rely on a bug in the usual sense. Each component does what it was designed to do, and the problem only appears when you put them together. That makes CPDoS hard to catch with signature-based rules.
At Reblaze we've added protection against these attacks to our WAF.