Bot Detection in CrowdSec 1.8.0: Two Critical DoS Fixes

Post Views: 5

CrowdSec 1.8.0 introduces bot detection capabilities alongside critical DoS vulnerability patches.

Bot Detection Capabilities

The update addresses two denial of service flaws in the HTTP and Kubernetes audit log intake components, while enhancing the platform’s ability to identify malicious traffic through its Web Application Firewall (WAF). The release includes a new bot detection module within the WAF, which analyzes HTTP traffic to distinguish between automated and human activity.

Multi-Step Verification Process

This feature employs a multi-step verification process, requiring clients to complete a challenge that tests for specific hardware capabilities such as SSE4.1 instruction set support and writable-executable memory.

User Access Considerations

Users with disabled cookies receive a clear error message if they fail to meet these criteria, ensuring transparency about access restrictions. However, legitimate users may be inadvertently blocked if their systems lack the required features, necessitating careful testing before deployment.

Critical DoS Vulnerability Patches

The update also resolves two vulnerabilities in the log intake pipeline. The HTTP datasource previously allowed unbounded decompression of request bodies, creating a risk of resource exhaustion through malicious payloads. Similarly, the Kubernetes audit webhook lacked limits on incoming request sizes, exposing the system to denial of service attacks.

Implementation of Size Constraints

These issues were addressed by implementing strict size constraints and validating content-length headers.

Kubernetes Datasource Improvements

A dedicated Kubernetes datasource was introduced to streamline log collection by directly accessing the API server, eliminating an intermediate step for cluster administrators.

Additional Enhancements

Enhanced HTTP parsing capabilities through new expression language functions, enabling real-time queries to external services during traffic analysis.

Performance Optimizations

Performance optimizations to the local API’s decisions stream endpoint benefit environments with multiple remediation components, reducing latency in threat response.