CWE-776 covers XML parsers that let a document define entities inside a Document Type Definition (DTD) and do not limit how those entities expand into each other. The best known form is the "billion laughs" attack, also called an XML bomb.
If your service accepts XML from anyone, whether as an API body, an uploaded document, a SOAP message or an SVG image, this applies to you.
How it happens
A DTD can define a named entity as a string, and other entities can refer to it. Nest the references and the output grows exponentially. This sample is for understanding only:
<?xml version="1.0"?>
<!DOCTYPE lolz [
<!ENTITY a "lol">
<!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;">
<!ENTITY c "&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;">
<!ENTITY d "&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;">
]>
<lolz>&d;</lolz>
Each level multiplies the size by ten. Add a few more levels and a tiny file expands to gigabytes once parsed. The parser is doing exactly what the standard says. The weakness is that nothing caps the expansion.
The MITRE record lists several observed cases, including CVE-2008-3281 (an XML parsing library), CVE-2011-3288 (an enterprise communication product) and CVE-2011-1755 (an XMPP server daemon hit by the billion laughs attack).
What an attacker gains
The record names one consequence: denial of service through resource consumption. Recursive entity references let an attacker expand data exponentially and quickly use up system memory, CPU or both.
This is cheap for the attacker. The request is small and the cost lands on you. A single connection can take down a process, and in a shared parser worker it can take down everyone else's requests too.
How to find it
- Look for every place your code parses XML: API handlers, config loaders, document converters, SAML and SOAP stacks, SVG and Office file processing.
- Check the parser settings. If DTD processing is on by default and you never turned it off, you are probably exposed.
- Send a small, safe entity expansion test document to a staging copy and watch memory.
- MITRE notes automated static analysis can detect some instances. Dependency scanning also matters, because the parser is often a third-party library. You can check a manifest with the free in-browser dependency scan, which runs without a login and keeps your file on your machine.
How to fix it
MITRE gives two mitigations: prohibit DTDs if you can, or use a parser that limits expansion of recursive entities. Before parsing, you can also scan for recursive entity declarations and refuse to continue.
In practice:
- Disable DTDs entirely when you do not need them. Most business XML does not.
- Where you cannot, use a parser setting that bounds entity expansion.
- Cap the size of incoming documents before they reach the parser.
- Set time and memory limits on the process that does the parsing.
Python with the defusedxml package:
from defusedxml import ElementTree as ET
tree = ET.fromstring(user_supplied_xml) # rejects entity bombs
Java with the JDK parser:
DocumentBuilderFactory f = DocumentBuilderFactory.newInstance();
f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
f.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
Test the setting with a bomb document in your unit tests so a library upgrade cannot quietly turn DTDs back on.
Try it yourself
A scan of a running web application will show whether endpoints accept hostile payloads. Step through this one.
Click through it at your own pace, or open it full screen.
Quick check
Why is this a denial of service and not data theft?
The entities expand into repeated text that fills memory. The goal is resource exhaustion, so availability is the impact.
What is the simplest fix?
Turn off DTD processing. If you cannot, use a parser that limits entity expansion.
