CAPEC-528: XML Flood
Description
An adversary may execute a flooding attack using XML messages with the intent to deny legitimate users access to a web service. These attacks are accomplished by sending a large number of XML based requests and letting the service attempt to parse each one. In many cases this type of an attack will result in a XML Denial of Service (XDoS) due to an application becoming unstable, freezing, or crashing.
- Likelihood of attack
- Low
- Typical severity
- Medium
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Abuse Existing Functionality
Prerequisites
- The target must receive and process XML transactions.
- An adverssary must possess the ability to generate a large amount of XML based messages to send to the target service.
Skills required
- LowDenial of service
Consequences
- Availability
Resource Consumption
Mitigations
- Design: Build throttling mechanism into the resource allocation. Provide for a timeout mechanism for allocated resources whose transaction does not complete within a specified interval.
- Implementation: Provide for network flow control and traffic shaping to control access to the resources.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 2 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-ISVAInbound Session Volume Analysis2 shared
- D3-ITFInbound Traffic Filtering2 shared
- D3-APCAApplication Protocol Command Analysis2 shared
- D3-CSPPClient-server Payload Profiling2 shared
- D3-NTCDNetwork Traffic Community Deviation2 shared
- D3-NTFNetwork Traffic Filtering2 shared
- D3-NTSANetwork Traffic Signature Analysis2 shared
- D3-PHDURAPer Host Download-Upload Ratio Analysis2 shared
- D3-PMADProtocol Metadata Anomaly Detection2 shared
- D3-RTSDRemote Terminal Session Detection2 shared
- D3-UGLPAUser Geolocation Logon Pattern Analysis2 shared