Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Opis

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

If the DTD contains a large number of nested or recursive entities, this can lead to explosive growth of data when parsed, causing a denial of service.

Inne nazwy

XEE

XEE is the acronym commonly used for XML Entity Expansion.

Billion Laughs Attack

XML Bomb

While the "XML Bomb" term was used in the early years of knowledge of this issue, the XEE term seems to be more commonly used.

Skutki

• Availability

  DoS: Resource Consumption (Other)

  If parsed, recursive entity references allow the attacker to expand data exponentially, quickly consuming all system resources.

Zapobieganie

• Operation

  If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.

• Implementation

  Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.

Przykłady podatności

• CVE-2008-3281 XEE in XML-parsing library.
• CVE-2011-3288 XML bomb / XEE in enterprise communication product.
• CVE-2011-1755 "Billion laughs" attack in XMPP server daemon.
• CVE-2009-1955 XML bomb in web server module
• CVE-2003-1564 Parsing library allows XML bomb

Słabość nadrzędna

• CWE-674 Uncontrolled Recursion
• CWE-405 Asymmetric Resource Consumption (Amplification)

Kiedy powstaje

• Implementation
• Operation

Dotyczy

Not Language-Specific, XML, Not Technology-Specific

Źródła

1. Multiple vendors XML parser (and SOAP/WebServices server) Denial of Service attack using DTD — Amit Klein, 2002
2. XML security: Preventing XML bombs — Rami Jaamour, 2006
3. Dismantling an XML-Bomb — Didier Stevens, 2008
4. XML Entity Expansion — Robert Auger
5. Tip: Configure SAX parsers for secure processing — Elliotte Rusty Harold, 2005
6. XML Denial of Service Attacks and Defenses — Bryan Sullivan, 2009
7. Preventing Entity Expansion Attacks in JAXB — Blaise Doughan, 2011