CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Weakness ID: 776 (Weakness Variant)
Status: Draft
Description
Description Summary
The software uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
Extended Description
If the DTD contains a large number of nested or recursive entities, this can lead to explosive growth of data when parsed, causing a denial of service.
Alternate Terms
XEE:
XEE is the acronym commonly used for XML Entity Expansion.
Billion Laughs Attack
XML Bomb:
While the "XML Bomb" term was used in the early years of knowledge of
this issue, the XEE term seems to be more commonly used.
If parsed, recursive entity references allow the attacker to expand
data exponentially, quickly consuming all system resources.
Likelihood of Exploit
Low to Medium
Demonstrative Examples
Example 1
The DTD and the very brief XML below illustrate what is meant by an
XML bomb. The ZERO entity contains one character, the letter A. The choice
of entity name ZERO is being used to indicate length equivalent to that
exponent on two, that is, the length of ZERO is 2^0. Similarly, ONE refers
to ZERO twice, therefore the XML parser will expand ONE to a length of 2, or
2^1. Ultimately, we reach entity THIRTYTWO, which will expand to 2^32
characters in length, or 4 GB, probably consuming far more data than
expected.
Description
