CWE-405: Asymmetric Resource Consumption (Amplification)
Description
The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is asymmetric.
This can lead to poor performance due to amplification of resource consumption, typically in a non-linear fashion. This situation is worsened if the product allows malicious users or attackers to consume more resources than their access level permits.
- Abstraction
- ClassAn abstract weakness, independent of any specific language or technology.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Incomplete
Common consequences
- Availability
DoS: Amplification; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
Sometimes this is a factor in flood attacks, but other types of amplification exist.
Potential mitigations
- Architecture and Design
An application must make resources available to a client commensurate with the client's access level.
- Architecture and Design
An application must, at all times, keep track of allocated resources and meter their usage appropriately.
- System ConfigurationEffectiveness: High
Consider disabling resource-intensive algorithms on the server side, such as Diffie-Hellman key exchange.
Related weaknesses
Parent weaknesses
Child weaknesses
- CWE-406Insufficient Control of Network Message Volume (Network Amplification)
- CWE-407Inefficient Algorithmic Complexity
- CWE-408Incorrect Behavior Order: Early Amplification
- CWE-409Improper Handling of Highly Compressed Data (Data Amplification)
- CWE-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
- CWE-1050Excessive Platform Resource Consumption within a Loop
- CWE-1072Data Resource Access without Use of Connection Pooling
- CWE-1073Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses
- CWE-1084Invokable Control Element with Excessive File or Data Access Operations
- CWE-1089Large Data Table with Excessive Number of Indices
- CWE-1094Excessive Index Range Scan for a Data Resource
- CWE-1176Inefficient CPU Computation
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.