| Name |
Serialized Data Parameter Blowup |
|
| Likelyhood of attack |
Typical severity |
| High |
High |
|
| Summary |
This attack exploits certain serialized data parsers (e.g., XML, YAML, etc.) which manage data in an inefficient manner. The attacker crafts an serialized data file with multiple configuration parameters in the same dataset. In a vulnerable parser, this results in a denial of service condition where CPU resources are exhausted because of the parsing algorithm. The weakness being exploited is tied to parser implementation and not language specific. |
| Prerequisites |
The server accepts input in the form of serialized data and is using a parser with a runtime longer than O(n) for the insertion of a new configuration parameter in the data container.(examples are .NET framework 1.0 and 1.1) |
| Execution Flow |
| Step |
Phase |
Description |
Techniques |
| 1 |
Explore |
[Survey the target] Using a browser or an automated tool, an attacker records all instances of web services to process requests using serialized data. |
- Use an automated tool to record all instances of URLs to process requests from serialized data.
- Use a browser to manually explore the website and analyze how the application processes requests using serialized data.
|
| 2 |
Exploit |
[Launch a Blowup attack] The attacker crafts malicious messages that contain multiple configuration parameters in the same dataset. |
- Send the malicious crafted message containing the multiple configuration parameters to the target URL, causing a denial of service.
|
|
| Solutions | This attack may be mitigated completely by using a parser that is not using a vulnerable container. Mitigation may limit the number of configuration parameters per dataset. |
| Related Weaknesses |
|
CWE ID
|
Description
|
| CWE-770 |
Allocation of Resources Without Limits or Throttling |
|
| Related CAPECS |
|
CAPEC ID
|
Description
|
| CAPEC-231 |
Applications often need to transform data in and out of serialized data formats, such as XML and YAML, by using a data parser. It may be possible for an adversary to inject data that may have an adverse effect on the parser when it is being processed. By supplying oversized payloads in input vectors that will be processed by the parser, an adversary can cause the parser to consume more resources while processing, causing excessive memory consumption and CPU utilization, and potentially cause execution of arbitrary code. An adversary's goal is to leverage parser failure to their advantage. DoS is most closely associated with web services, SOAP, and Rest, because remote service requesters can post malicious data payloads to the service provider designed to exhaust the service provider's memory, CPU, and/or disk space. This attack exploits the loosely coupled nature of web services, where the service provider has little to no control over the service requester and any messages the service requester sends. |
|
| Taxonomy: WASC |
|
Entry ID
|
Entry Name
|
| 41 |
XML Attribute Blowup |
|