CAPEC-229
Serialized Data Parameter Blowup
2014-06-23
00h00 +00:00
00h00 +00:00
指定 CAPEC 提醒
随时了解指定 CAPEC 的变更。
CAPEC 描述
This attack exploits certain serialized data parsers (e.g., XML, YAML, etc.) which manage data in an inefficient manner. The attacker crafts an serialized data file with multiple configuration parameters in the same dataset. In a vulnerable parser, this results in a denial of service condition where CPU resources are exhausted because of the parsing algorithm. The weakness being exploited is tied to parser implementation and not language specific.
CAPEC 信息
执行流程
1) Explore
[Survey the target] Using a browser or an automated tool, an attacker records all instances of web services to process requests using serialized data.
技术手段
- Use an automated tool to record all instances of URLs to process requests from serialized data.
- Use a browser to manually explore the website and analyze how the application processes requests using serialized data.
2) Exploit
[Launch a Blowup attack] The attacker crafts malicious messages that contain multiple configuration parameters in the same dataset.
技术手段
- Send the malicious crafted message containing the multiple configuration parameters to the target URL, causing a denial of service.
前提条件
The server accepts input in the form of serialized data and is using a parser with a runtime longer than O(n) for the insertion of a new configuration parameter in the data container.(examples are .NET framework 1.0 and 1.1)缓解措施
This attack may be mitigated completely by using a parser that is not using a vulnerable container.Mitigation may limit the number of configuration parameters per dataset.
相关弱点
| 弱点名称 | |
|---|---|
CWE-770 |
Allocation of Resources Without Limits or Throttling The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
提交记录
| 名称 | 组织 | 日期 | 发布日期 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
修改记录
| 名称 | 组织 | 日期 | 备注 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Activation_Zone, Attack_Phases, Description, Description Summary, Examples-Instances, Injection_Vector, Methods_of_Attack, Payload, Related_Attack_Patterns, Typical_Likelihood_of_Exploit, Typical_Severity | |
| CAPEC Content Team | The MITRE Corporation | Updated @Name, Description, Example_Instances, Execution_Flow, Mitigations, Prerequisites | |
| CAPEC Content Team | The MITRE Corporation | Updated Taxonomy_Mappings | |
| CAPEC Content Team | The MITRE Corporation | Updated Example_Instances |
