CWE-776: Unrestricted Recursive Entity References in DTDs ('XML Bomb')
Unrestricted Recursive Entity References in DTDs ('XML Bomb')
Weakness ID: 776 (Weakness Variant)
Status: Draft
Description
Description Summary
The software requires the use of XML documents and allows their structure to be defined with a Document Type Definition (DTD). The software allows the DTD to recursively define entities which can lead to explosive growth of data when parsed.
If parsed, recursive entity references allow the attacker to expand
data exponentially, quickly consuming all system resources.
Likelihood of Exploit
Low to Medium
Demonstrative Examples
Example 1
The DTD and the very brief XML below illustrate what is meant by an
XML bomb. The ZERO entity contains one character, the letter A. The choice
of entity name ZERO is being used to indicate length equivalent to that
exponent on two, that is, the length of ZERO is 2^0. Similarly, ONE refers
to ZERO twice, therefore the XML parser will expand ONE to a length of 2, or
2^1. Ultimately, we reach entity THIRTYTWO, which will expand to 2^32
characters in length, or 4 GB, probably consuming far more data than
expected.
Description
