CWE-776—Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

名称

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

描述

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

If the DTD contains a large number of nested or recursive entities, this can lead to explosive growth of data when parsed, causing a denial of service.

常见后果

范围：

Availability

影响：

DoS: Resource Consumption (Other)

注释：

If parsed, recursive entity references allow the attacker to expand data exponentially, quickly consuming all system resources.

相关 CWE

• CWE-405Asymmetric Resource Consumption (Amplification)
• CWE-674Uncontrolled Recursion

相关警报

• Exponential Entity Expansion (Billion Laughs Attack)Medium