| Home > CAPEC List > CAPEC-197: Exponential Data Expansion (Version 3.9) |
|
Term: Billion Laughs Attack
Term: XML Bomb
Term: XML Entity Expansion (XEE)
High
Medium
| Nature | Type | ID | Name |
|---|---|---|---|
| ChildOf | Standard Attack PatternStandard Attack Pattern - A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an attack. It is often seen as a singular piece of a fully executed attack. A standard attack pattern is meant to provide sufficient details to understand the specific technique and how it attempts to accomplish a desired goal. A standard level attack pattern is a specific type of a more abstract meta level attack pattern. | 230 | Serialized Data with Nested Payloads |
| CanFollow | Detailed Attack PatternDetailed Attack Pattern - A detailed level attack pattern in CAPEC provides a low level of detail, typically leveraging a specific technique and targeting a specific technology, and expresses a complete execution flow. Detailed attack patterns are more specific than meta attack patterns and standard attack patterns and often require a specific protection mechanism to mitigate actual attacks. A detailed level attack pattern often will leverage a number of different standard level attack patterns chained together to accomplish a goal. | 228 | DTD Injection |
| View Name | Top Level Categories |
|---|---|
| Domains of Attack | Software |
| Mechanisms of Attack | Abuse Existing Functionality |
Survey the target: An adversary determines the input data stream that is being processed by a data parser that supports using subsitituion on the victim's side.
| Techniques |
|---|
| Use an automated tool to record all instances of URLs to process requests. |
| Use a browser to manually explore the website and analyze how the application processes requests. |
Craft malicious payload: The adversary crafts a malicious message containing nested exponential expansion that completely uses up available server resources. See the "Example Instances" section for details on how to craft this malicious payload.
Send the message: Send the malicious crafted message to the target URL.
| Scope | Impact | Likelihood |
|---|---|---|
Availability | Unreliable Execution Resource Consumption |
The most common example of this type of attack is the "many laughs" attack (sometimes called the 'billion laughs' attack). For example:
This is well formed and valid XML according to the DTD. Each entity increases the number entities by a factor of 10. The line of XML containing lol9; expands out exponentially to a message with 10^9 entities. A small message of a few KBs in size can easily be expanded into a few GB of memory in the parser. By including 3 more entities similar to the lol9 entity in the above code to the DTD, the program could expand out over a TB as there will now be 10^12 entities. Depending on the robustness of the target machine, this can lead to resource depletion, application crash, or even the execution of arbitrary code through a buffer overflow.
This example is similar, but uses YAML. This was used to attack Kubernetes [REF-686]
| CWE-ID | Weakness Name |
|---|---|
| 770 | Allocation of Resources Without Limits or Throttling |
| 776 | Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') |
| Entry ID | Entry Name |
|---|---|
| 44 | XML Entity Expansion |
| Submissions | |||
|---|---|---|---|
| Submission Date | Submitter | Organization | |
| 2014年06月23日 (Version 2.6) | CAPEC Content Team | The MITRE Corporation | |
| Modifications | |||
| Modification Date | Modifier | Organization | |
| 2017年08月04日 (Version 2.11) | CAPEC Content Team | The MITRE Corporation | |
| Updated Resources_Required | |||
| 2018年07月31日 (Version 2.12) | CAPEC Content Team | The MITRE Corporation | |
| Updated References | |||
| 2020年07月30日 (Version 3.3) | CAPEC Content Team | The MITRE Corporation | |
| Updated Mitigations | |||
| 2020年12月17日 (Version 3.4) | CAPEC Content Team | The MITRE Corporation | |
| Updated Related_Attack_Patterns, Taxonomy_Mappings | |||
| 2021年10月21日 (Version 3.6) | CAPEC Content Team | The MITRE Corporation | |
| Updated @Name, Alternate_Terms, Description, Example_Instances, Execution_Flow, Mitigations, Prerequisites, Related_Weaknesses, Skills_Required | |||
| 2022年02月22日 (Version 3.7) | CAPEC Content Team | The MITRE Corporation | |
| Updated Execution_Flow | |||
| 2022年09月29日 (Version 3.8) | CAPEC Content Team | The MITRE Corporation | |
| Updated Example_Instances | |||
| Previous Entry Names | |||
| Change Date | Previous Entry Name | ||
| 2021年10月21日 (Version 3.6) | XML Entity Expansion | ||
|
Use of the Common Attack Pattern Enumeration and Classification (CAPEC), and the associated references from this website are subject to the Terms of Use. Copyright © 2007–2025, The MITRE Corporation. CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. |
||