XEE (XML Entity Expansion)
Attack Pattern ID: 197 (Standard Attack Pattern Completeness: Stub)Typical Severity: MediumStatus: Draft
+ Description

Summary

An attacker submits an XML document to a target application where the XML document uses nested entity expansion to produce an excessively large output XML. XML allows the definition of macro-like structures that can be used to simplify the creation of complex structures. However, this capability can be abused to create excessive demands on a processor's CPU and memory. A small number of nested expansions can result in an exponential growth in demands on memory. For example, consider:

<!DOCTYPE member [
<!ENTITY a "&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;">
<!ENTITY b "&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;">
<!ENTITY c "&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;">
...

Each entity increases the number entities by a factor of 10. If the above progression were continued to 'z' and 'z' was a simple 10-byte string, the total memory requirement of 'a' in the resulting document would be 10^26 bytes (one-hundred septillion bytes) - well beyond the capabilities of modern computers. Depending on the robustness of the target machine, this can lead to resource depletion, application crash, or even the execution of arbitrary code through a buffer overflow.

This attack is also sometimes referred to as an XML Entity Explosion attack.

+ Attack Prerequisites

The target must XML input but either fail to provide an upper limit for entity expansion or provide a limit that is so large that it does not preclude significant resource consumption.

+ Resources Required

No special resources are required.

+ Solutions and Mitigations

Design: Use libraries and templates that minimize unfiltered input. Use methods that limit entity expansion and throw exceptions on attempted entity expansion.

Implementation: Normalize, filter and white list and parse with methods and routines that will detect entity expansion from untrusted sources.

+ Related Weaknesses
CWE-IDWeakness NameWeakness Relationship Type
770Allocation of Resources Without Limits or ThrottlingTargeted
+ Related Attack Patterns
NatureTypeIDNameDescriptionView(s) this relationship pertains toView\(s\)
ChildOfAttack PatternAttack Pattern82Violating Implicit Assumptions Regarding XML Content (aka XML Denial of Service (XDoS)) 
Mechanism of Attack (primary)1000
ChildOfCategoryCategory377WASC Threat Classification 2.0 - WASC-44 - XML Entity Expansion 
WASC Threat Classification 2.0333
ParentOfAttack PatternAttack Pattern228Resource Depletion through DTD Injection in a SOAP Message 
Mechanism of Attack1000
+ References

http://devcentral.f5.com/weblogs/macvittie/archive/2006/12/01/2517.aspx

Back to top