h2o HTTP Server IP Address Spoofing Vulnerability Bypassing Access Control

A vulnerability in h2o, an HTTP server supporting HTTP/1.x, HTTP/2, and HTTP/3, allows for bypassing IP address-based access control. This issue arises when HTTP requests using TLS 1.3 early data over TCP Fast Open or QUIC 0-RTT packets are received. The access control fails to detect and block requests from spoofed source addresses, enabling attackers to send HTTP requests from rejected addresses. The vulnerability affects h2o versions prior to the patch in commit 15ed15a.

Impact

Exploitation allows for sending HTTP requests from IP addresses that would normally be blocked by the server's access control, potentially leading to unauthorized actions or access.

Reproduction

The vulnerability can be reproduced by sending an HTTP request that includes TLS 1.3 early data, using either TCP Fast Open or QUIC 0-RTT, from a spoofed IP address. The server must be configured to use IP address-based access control, which will fail to block the spoofed request.

Remediation

Users can upgrade to h2o commit 15ed15a or later. Alternatively, the use of TCP Fast Open and QUIC can be disabled to mitigate the issue.