CAPEC-221: Data Serialization External Entities Blowup

Description

This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.

Likelihood of attack: Not rated by MITRE
Typical severity: Not rated by MITRE
Abstraction: DetailedA low-level, detailed pattern, often for a particular technology.

Mechanism of attack: Abuse Existing Functionality

Prerequisites

A server that has an implementation that accepts entities containing URI values.

Consequences

Availability
Resource Consumption
ConfidentialityIntegrityAvailability
Execute Unauthorized Commands
Run Arbitrary Code

Mitigations

This attack may be mitigated by tweaking the XML parser to not resolve external entities. If external entities are needed, then implement a custom XmlResolver that has a request timeout, data retrieval limit, and restrict resources it can retrieve locally.
This attack may be mitigated by tweaking the serialized data parser to not resolve external entities. If external entities are needed, then implement a custom resolver that has a request timeout, data retrieval limit, and restrict resources it can retrieve locally.

Related weaknesses (CWE)

CWE-611Improper Restriction of XML External Entity Reference

Related attack patterns

Parent

Description

Mitigations

This attack may be mitigated by tweaking the XML parser to not resolve external entities. If external entities are needed, then implement a custom XmlResolver that has a request timeout, data retrieval limit, and restrict resources it can retrieve locally.

This attack may be mitigated by tweaking the serialized data parser to not resolve external entities. If external entities are needed, then implement a custom resolver that has a request timeout, data retrieval limit, and restrict resources it can retrieve locally.