Scribd
Upload
62 views3 pages

Cwe-776: Improper Restriction of Recursive Entity References in Dtds ('XML Entity Expansion')

The document discusses XML Entity Expansion (XEE), where a malicious XML document defines recursive entity references that cause exponential data expansion when parsed. This can consume significant resources and lead to denial of service. The document provides an example XML bomb using recursive entity definitions that expands to 4GB of data. It also lists some mitigations like limiting DTD use or entity expansion in XML parsers.

Uploaded by

maria diana
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
62 views3 pages

Cwe-776: Improper Restriction of Recursive Entity References in Dtds ('XML Entity Expansion')

The document discusses XML Entity Expansion (XEE), where a malicious XML document defines recursive entity references that cause exponential data expansion when parsed. This can consume significant resources and lead to denial of service. The document provides an example XML bomb using recursive entity definitions that expands to 4GB of data. It also lists some mitigations like limiting DTD use or entity expansion in XML parsers.

Uploaded by

maria diana
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 3

Common Weakness Enumeration

AA Community-Developed
Community-Developed List
List of
of Software
Software &
& Hardware
Hardware Weakness
Weakness Types
Types

Home
About
CWE List
Scoring
Mapping Guidance
Community
News
Search

CWE-776: Improper Restriction of Recursive Entity References in


DTDs ('XML Entity Expansion')
Weakness ID: 776
Abstraction: Base
Structure: Simple

Presentation Filter: Complete

Description
The software uses XML documents and allows their structure to be defined with a Document Type Definition
(DTD), but it does not properly control the number of recursive definitions of entities.
Extended Description
If the DTD contains a large number of nested or recursive entities, this can lead to explosive growth of data when
parsed, causing a denial of service.
Alternate Terms
XEE: XEE is the acronym commonly used for XML Entity Expansion.
Billion Laughs Attack
XML Bomb: While the "XML Bomb" term was used in the early years of knowledge of this issue,
the XEE term seems to be more commonly used.
Relationships
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name
ChildOf 409 Improper Handling of Highly Compressed Data (Data Amplification)
ChildOf 674 Uncontrolled Recursion
CanFollow 827 Improper Control of Document Type Definition

Relevant to the view "Software Development" (CWE-699)


Nature Type ID Name
MemberOf 19 Data Processing Errors

Relevant to the view "Weaknesses for Simplified Mapping of Published Vulnerabilities" (CWE-
1003)
Modes Of Introduction

Phase Note
Implementation
Operation

Applicable Platforms
Languages
XML (Undetermined Prevalence)
Common Consequences

Scope Impact Likelihood


Technical Impact: DoS: Resource Consumption (Other)
Availability
If parsed, recursive entity references allow the attacker to expand data exponentially,
quickly consuming all system resources.
Likelihood Of Exploit
Medium
Demonstrative Examples
Example 1
The DTD and the very brief XML below illustrate what is meant by an XML bomb. The ZERO entity contains one
character, the letter A. The choice of entity name ZERO is being used to indicate length equivalent to that
exponent on two, that is, the length of ZERO is 2^0. Similarly, ONE refers to ZERO twice, therefore the XML
parser will expand ONE to a length of 2, or 2^1. Ultimately, we reach entity THIRTYTWO, which will expand to
2^32 characters in length, or 4 GB, probably consuming far more data than expected.

Example Language: XML  (attack code)

<?xml version="1.0"?>
<!DOCTYPE MaliciousDTD [
<!ENTITY ZERO "A">
<!ENTITY ONE "&ZERO;&ZERO;">
<!ENTITY TWO "&ONE;&ONE;">
...
<!ENTITY THIRTYTWO "&THIRTYONE;&THIRTYONE;">
]>
<data>&THIRTYTWO;</data>

Observed Examples
Reference Description
CVE-2008-3281 XEE in XML-parsing library.
CVE-2011-3288 XML bomb / XEE in enterprise communication product.
CVE-2011-1755 "Billion laughs" attack in XMPP server daemon.
CVE-2009-1955 XML bomb in web server module
CVE-2003-1564 Parsing library allows XML bomb

Potential Mitigations

Phase: Operation
If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.

Phase: Implementation
Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue
parsing potentially explosive content.
Memberships

Nature Type ID Name


MemberOf 1030 OWASP Top Ten 2017 Category A4 - XML External Entities (XXE)
MemberOf 1349 OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration

Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
WASC 44 XML Entity Expansion
Related Attack Patterns
CAPEC-ID Attack Pattern Name
CAPEC-197 Exponential Data Expansion

References
[REF-676] Amit Klein. "Multiple vendors XML parser (and SOAP/WebServices server) Denial of Service attack
using DTD". 2002-12-16. <http://www.securityfocus.com/archive/1/303509>.
[REF-677] Rami Jaamour. "XML security: Preventing XML bombs". 2006-02-22.
<http://searchsoftwarequality.techtarget.com/expert/KnowledgebaseAnswer/0,289625,sid92_gci1168442,00.
html?asrc=SS_CLA_302%20%20558&psrc=CLT_92#>.
[REF-678] Didier Stevens. "Dismantling an XML-Bomb". 2008-09-23.
<http://blog.didierstevens.com/2008/09/23/dismantling-an-xml-bomb/>.
[REF-679] Robert Auger. "XML Entity Expansion". <http://projects.webappsec.org/XML-Entity-Expansion>.
[REF-680] Elliotte Rusty Harold. "Tip: Configure SAX parsers for secure processing". 2005-05-27.
<http://www.ibm.com/developerworks/xml/library/x-tipcfsx.html>.
[REF-500] Bryan Sullivan. "XML Denial of Service Attacks and Defenses". 2009-09.
<http://msdn.microsoft.com/en-us/magazine/ee335713.aspx>.
[REF-682] Blaise Doughan. "Preventing Entity Expansion Attacks in JAXB". 2011-03-11.
<http://blog.bdoughan.com/2011/03/preventing-entity-expansion-attacks-in.html>.
Content History

Submissions
Submission Date Submitter Organization
2009-06-30 CWE Content Team MITRE
Modifications
Previous Entry Names

You might also like