CAPEC-229 Metadata
Likelihood of Attack
High
Typical Severity
High
Overview
Summary
This attack exploits certain serialized data parsers (e.g., XML, YAML, etc.) which manage data in an inefficient manner. The attacker crafts an serialized data file with multiple configuration parameters in the same dataset. In a vulnerable parser, this results in a denial of service condition where CPU resources are exhausted because of the parsing algorithm. The weakness being exploited is tied to parser implementation and not language specific.
Prerequisites
The server accepts input in the form of serialized data and is using a parser with a runtime longer than O(n) for the insertion of a new configuration parameter in the data container.(examples are .NET framework 1.0 and 1.1)
Execution Flow
| Step | Phase | Description | Techniques |
|---|---|---|---|
| 1 | Explore | [Survey the target] Using a browser or an automated tool, an attacker records all instances of web services to process requests using serialized data. |
|
| 2 | Exploit | [Launch a Blowup attack] The attacker crafts malicious messages that contain multiple configuration parameters in the same dataset. |
|
Potential Solutions / Mitigations
This attack may be mitigated completely by using a parser that is not using a vulnerable container. Mitigation may limit the number of configuration parameters per dataset.
Related Weaknesses (CWE)
| CWE ID | Description |
|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling |
Related CAPECs
| CAPEC ID | Description |
|---|---|
| CAPEC-231 | An adversary injects oversized serialized data payloads into a parser during data processing to produce adverse effects upon the parser such as exhausting system resources and arbitrary code execution. |
Taxonomy Mappings
Taxonomy: WASC
| Entry ID | Entry Name |
|---|---|
| 41 | XML Attribute Blowup |
Stay Ahead of Attack Patterns
Understanding CAPEC patterns helps security professionals anticipate and thwart potential attacks. Leverage these insights to enhance threat modeling, strengthen your software development lifecycle, and train your security teams effectively.