CAPEC-231: Oversized Serialized Data Payloads
Description
An adversary injects oversized serialized data payloads into a parser during data processing to produce adverse effects upon the parser such as exhausting system resources and arbitrary code execution.
- Likelihood of attack
- Medium
- Typical severity
- High
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Abuse Existing Functionality
Prerequisites
- An application uses an parser for serialized data to perform transformation on user-controllable data.
- An application does not perform sufficient validation to ensure that user-controllable data is safe for a data parser.
Skills required
- LowDenial of service
- HighArbitrary code execution
Consequences
- Availability
Resource Consumption
- Confidentiality
Read Data
- ConfidentialityIntegrityAvailability
Execute Unauthorized Commands
- ConfidentialityAccess ControlAuthorization
Gain Privileges
Mitigations
- Carefully validate and sanitize all user-controllable serialized data prior to passing it to the parser routine. Ensure that the resultant data is safe to pass to the parser.
- Perform validation on canonical data.
- Pick a robust implementation of the serialized data parser.
- Validate data against a valid schema or DTD prior to parsing.