1633
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 982 SFP Secondary Cluster: Failure to Release Resource 888 2410
MemberOf 1163 SEI CERT C Coding Standard - Guidelines 09. Input
Output (FIO)
1154 2459
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CERT C Secure Coding FIO42-C CWE More
Abstract
Close files when they are no longer
needed
Software Fault Patterns SFP14 Failure to Release Resource
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML
Entity Expansion')
Weakness ID : 776
Structure : Simple
Abstraction : Base
Description
The product uses XML documents and allows their structure to be defined with a Document Type
Definition (DTD), but it does not properly control the number of recursive definitions of entities.
Extended Description
If the DTD contains a large number of nested or recursive entities, this can lead to explosive growth
of data when parsed, causing a denial of service.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 405 Asymmetric Resource Consumption (Amplification) 986
ChildOf 674 Uncontrolled Recursion 1484
CanFollow 827 Improper Control of Document Type Definition 1736
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 674 Uncontrolled Recursion 1484
Relevant to the view "Software Development" (CWE-699)
CWE Version 4.14
CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CWE-776: Improper Restriction of Recursive Entity
References in DTDs ('XML Entity Expansion') 1634
Nature Type ID Name Page
MemberOf 19 Data Processing Errors 2309
Applicable Platforms
Language : XML (Prevalence = Undetermined)
Alternate Terms
XEE : XEE is the acronym commonly used for XML Entity Expansion.
Billion Laughs Attack :
XML Bomb : While the "XML Bomb" term was used in the early years of knowledge of this issue,
the XEE term seems to be more commonly used.
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Availability DoS: Resource Consumption (Other)
If parsed, recursive entity references allow the attacker to
expand data exponentially, quickly consuming all system
resources.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Operation
If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive
DTD entities.
Phase: Implementation
Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not
continue parsing potentially explosive content.
Demonstrative Examples
Example 1:
The DTD and the very brief XML below illustrate what is meant by an XML bomb. The ZERO entity
contains one character, the letter A. The choice of entity name ZERO is being used to indicate
length equivalent to that exponent on two, that is, the length of ZERO is 2^0. Similarly, ONE refers
to ZERO twice, therefore the XML parser will expand ONE to a length of 2, or 2^1. Ultimately,
we reach entity THIRTYTWO, which will expand to 2^32 characters in length, or 4 GB, probably
consuming far more data than expected.
Example Language: XML (Attack)
<?xml version="1.0"?>
<!DOCTYPE MaliciousDTD [
CWE Version 4.14
CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CWE-776: Improper Restriction of Recursive Entity
References in DTDs ('XML Entity Expansion')