CWE

Common Weakness Enumeration

A Community-Developed Dictionary of Software Weakness Types

CWE/SANS Top 25 Most Dangerous Software Errors Common Weakness Scoring System
Common Weakness Risk Analysis Framework
Home > CWE List > CWE- Individual Dictionary Definition (2.7)  

Presentation Filter:

CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

 
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Weakness ID: 776 (Weakness Variant)Status: Draft
+ Description

Description Summary

The software uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

Extended Description

If the DTD contains a large number of nested or recursive entities, this can lead to explosive growth of data when parsed, causing a denial of service.

+ Alternate Terms
XEE:

XEE is the acronym commonly used for XML Entity Expansion.

Billion Laughs Attack
XML Bomb:

While the "XML Bomb" term was used in the early years of knowledge of this issue, the XEE term seems to be more commonly used.

+ Time of Introduction
  • Implementation
  • Operation
+ Applicable Platforms

Languages

XML

Architectural Paradigms

Web-based

+ Common Consequences
ScopeEffect

Technical Impact: DoS: resource consumption (other)

If parsed, recursive entity references allow the attacker to expand data exponentially, quickly consuming all system resources.

+ Likelihood of Exploit

Low to Medium

+ Demonstrative Examples

Example 1

The DTD and the very brief XML below illustrate what is meant by an XML bomb. The ZERO entity contains one character, the letter A. The choice of entity name ZERO is being used to indicate length equivalent to that exponent on two, that is, the length of ZERO is 2^0. Similarly, ONE refers to ZERO twice, therefore the XML parser will expand ONE to a length of 2, or 2^1. Ultimately, we reach entity THIRTYTWO, which will expand to 2^32 characters in length, or 4 GB, probably consuming far more data than expected.

(Attack)
Example Language: XML 
<?xml version="1.0"?>
<!DOCTYPE MaliciousDTD [
<!ENTITY ZERO "A">
<!ENTITY ONE "&ZERO;&ZERO;">
<!ENTITY TWO "&ONE;&ONE;">
...
<!ENTITY THIRTYTWO "&THIRTYONE;&THIRTYONE;">
]>
<data>&THIRTYTWO;</data>
+ Observed Examples
ReferenceDescription
XEE in XML-parsing library.
XML bomb / XEE in enterprise communication product.
"Billion laughs" attack in XMPP server daemon.
XML bomb in web server module
Parsing library allows XML bomb
+ Potential Mitigations

Phase: Operation

If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.

Phase: Implementation

Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.

+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness BaseWeakness Base409Improper Handling of Highly Compressed Data (Data Amplification)
Development Concepts699
Research Concepts1000
ChildOfCategoryCategory442Web Problems
Development Concepts699
ChildOfWeakness BaseWeakness Base674Uncontrolled Recursion
Development Concepts (primary)699
Research Concepts (primary)1000
CanFollowWeakness BaseWeakness Base827Improper Control of Document Type Definition
Research Concepts1000
+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
WASC44XML Entity Expansion
+ References
Amit Klein. "Multiple vendors XML parser (and SOAP/WebServices server) Denial of Service attack using DTD". 2002-12-16. <http://www.securityfocus.com/archive/1/303509>.
Didier Stevens. "Dismantling an XML-Bomb". 2008-09-23. <http://blog.didierstevens.com/2008/09/23/dismantling-an-xml-bomb/>.
Robert Auger. "XML Entity Expansion". <http://projects.webappsec.org/XML-Entity-Expansion>.
Elliotte Rusty Harold. "Tip: Configure SAX parsers for secure processing". 2005-05-27. <http://www.ibm.com/developerworks/xml/library/x-tipcfsx.html>.
Bryan Sullivan. "XML Denial of Service Attacks and Defenses". September, 2009. <http://msdn.microsoft.com/en-us/magazine/ee335713.aspx>.
Blaise Doughan. "Preventing Entity Expansion Attacks in JAXB". 2011-03-11. <http://blog.bdoughan.com/2011/03/preventing-entity-expansion-attacks-in.html>.
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
2009-06-30Internal CWE Team
Modifications
Modification DateModifierOrganizationSource
2010-02-16MITREInternal
updated Taxonomy_Mappings
2010-12-13MITREInternal
updated Relationships
2011-06-01MITREInternal
updated Common_Consequences
2012-05-11MITREInternal
updated Demonstrative_Examples
2013-02-21MITREInternal
updated Alternate_Terms, Applicable_Platforms, Description, Name, Observed_Examples, References, Relationships
Previous Entry Names
Change DatePrevious Entry Name
2013-02-21Unrestricted Recursive Entity References in DTDs ('XML Bomb')
Page Last Updated: June 23, 2014