CAPEC-230
Serialized Data with Nested Payloads
2014-06-23
00h00 +00:00
00h00 +00:00
특정 CAPEC 알림
특정 CAPEC의 변경 사항에 대한 정보를 받아보세요.
CAPEC 설명
Applications often need to transform data in and out of a data format (e.g., XML and YAML) by using a parser. It may be possible for an adversary to inject data that may have an adverse effect on the parser when it is being processed. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. By nesting these structures, causing the data to be repeatedly substituted, an adversary can cause the parser to consume more resources while processing, causing excessive memory consumption and CPU utilization.
CAPEC 정보
실행 흐름
1) Explore
An adversary determines the input data stream that is being processed by a data parser that supports using substitution on the victim's side.
2) Exploit
An adversary crafts input data that may have an adverse effect on the operation of the parser when the data is parsed on the victim's system.
사전 조건
An application's user-controllable data is expressed in a language that supports subsitution.An application does not perform sufficient validation to ensure that user-controllable data is not malicious.
완화 방법
Carefully validate and sanitize all user-controllable data prior to passing it to the data parser routine. Ensure that the resultant data is safe to pass to the data parser.Perform validation on canonical data.
Pick a robust implementation of the data parser.
관련 약점
| 약점 이름 | |
|---|---|
CWE-112 |
Missing XML Validation The product accepts XML from an untrusted source but does not validate the XML against the proper schema. |
CWE-20 |
Improper Input Validation The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
CWE-674 |
Uncontrolled Recursion The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. |
CWE-770 |
Allocation of Resources Without Limits or Throttling The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
참고 자료
REF-89
XML Parser Attacks: A summary of ways to attack an XML ParserShlomo, Yona.
http://yeda.cs.technion.ac.il/~yona/talks/xml_parser_attacks/slides/slide2.html
제출
| 이름 | 조직 | 날짜 | 출시일 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
수정 사항
| 이름 | 조직 | 날짜 | 댓글 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Alternate_Terms, Description, Execution_Flow, Indicators, Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Description | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses | |
| CAPEC Content Team | The MITRE Corporation | Updated @Name, Description, Execution_Flow, Extended_Description, Indicators, Mitigations, Prerequisites, Skills_Required |
