Executive Summary

The vulnerability is an origin validation error in the gun HTTP/2 library's gun_http2 module. It occurs because the :authority pseudo-header from an incoming HTTP/2 PUSH_PROMISE frame is stored without verifying that it matches the connection's origin.

This lack of validation violates HTTP/2 protocol specifications (RFC 7540 and RFC 9113), which require rejecting push promises for resources the server is not authoritative for.

As a result, a malicious or compromised HTTP/2 server can inject cookies scoped to arbitrary third-party domains into the client's cookie store. This enables session fixation attacks and may lead to account takeover if the injected cookie overrides a legitimate session token.

No user interaction beyond making a normal HTTP/2 request to the attacker-controlled server is required to exploit this vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing a malicious or compromised HTTP/2 server to plant cookies for arbitrary third-party domains in your browser's shared cookie store.

Such cookie injection can enable session fixation attacks, where an attacker forces a user to use a known session identifier, potentially allowing the attacker to hijack the user's session.

If the injected cookie overrides a legitimate session token, it may result in account takeover without any user interaction beyond visiting a malicious HTTP/2 server.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the HTTP/2 PUSH_PROMISE frames containing an :authority pseudo-header that does not match the connection's origin, allowing cross-origin cookie injection.

To detect this vulnerability on your network or system, you should monitor HTTP/2 traffic for PUSH_PROMISE frames where the :authority header differs from the original request's authority.

Commands or tools that can help include using network protocol analyzers like Wireshark or tshark to filter and inspect HTTP/2 PUSH_PROMISE frames.

• Use tshark to capture HTTP/2 PUSH_PROMISE frames: tshark -Y 'http2.type == 5' -T fields -e http2.push_promise.headers
• Inspect the :authority pseudo-header in the PUSH_PROMISE frames and compare it to the original request's :authority header.
• Look for discrepancies indicating that the pushed resource's authority does not match the connection's origin.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability was fixed in gun version 2.4.0 by enforcing strict validation of the :authority pseudo-header in HTTP/2 PUSH_PROMISE frames.

Immediate mitigation steps include:

• Upgrade the gun library to version 2.4.0 or later, which includes the fix that rejects push promises with mismatched authorities.
• If upgrading is not immediately possible, consider disabling HTTP/2 server push functionality in your environment to prevent exploitation.
• Monitor and audit HTTP/2 traffic for suspicious PUSH_PROMISE frames with unexpected :authority headers.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability violates RFC 7540 §10.6 and RFC 9113 §8.4 by allowing cross-origin cookie injection without proper origin validation. This can lead to session fixation and potential account takeover by planting cookies scoped to arbitrary third-party domains.

Such unauthorized cookie injection and potential account takeover can compromise user data confidentiality and integrity, which may negatively impact compliance with data protection regulations like GDPR and HIPAA that require safeguarding personal and sensitive information.

Therefore, this vulnerability poses a risk to compliance with standards and regulations that mandate strict controls on user session management and data protection.

Useful 0 Not Useful 0