New to CAPEC? Start Here
Home > CAPEC List > CAPEC-229: Serialized Data Parameter Blowup (Version 3.6)  

CAPEC-229: Serialized Data Parameter Blowup

Attack Pattern ID: 229
Abstraction: Detailed
Status: Draft
Presentation Filter:
+ Description
This attack exploits certain serialized data parsers (e.g., XML, YAML, etc.) which manage data in an inefficient manner. The attacker crafts an serialized data file with multiple configuration parameters in the same dataset. In a vulnerable parser, this results in a denial of service condition where CPU resources are exhausted because of the parsing algorithm. The weakness being exploited is tied to parser implementation and not language specific.
+ Likelihood Of Attack

High

+ Typical Severity

High

+ Relationships
Section HelpThis table shows the other attack patterns and high level categories that are related to this attack pattern. These relationships are defined as ChildOf and ParentOf, and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as CanFollow, PeerOf, and CanAlsoBe are defined to show similar attack patterns that the user may want to explore.
NatureTypeIDName
ChildOfStandard Attack PatternStandard Attack Pattern - A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an attack. It is often seen as a singular piece of a fully executed attack. A standard attack pattern is meant to provide sufficient details to understand the specific technique and how it attempts to accomplish a desired goal. A standard level attack pattern is a specific type of a more abstract meta level attack pattern.231Oversized Serialized Data Payloads
Section HelpThis table shows the views that this attack pattern belongs to and top level categories within that view.
+ Execution Flow
Explore
  1. Survey the target: Using a browser or an automated tool, an attacker records all instances of web services to process requests using serialized data.

    Techniques
    Use an automated tool to record all instances of URLs to process requests from serialized data.
    Use a browser to manually explore the website and analyze how the application processes requests using serialized data.
Exploit
  1. Launch a Blowup attack: The attacker crafts malicious messages that contain multiple configuration parameters in the same dataset.

    Techniques
    Send the malicious crafted message containing the multiple configuration parameters to the target URL, causing a denial of service.
+ Prerequisites
The server accepts input in the form of serialized data and is using a parser with a runtime longer than O(n) for the insertion of a new configuration parameter in the data container.(examples are .NET framework 1.0 and 1.1)
+ Mitigations
This attack may be mitigated completely by using a parser that is not using a vulnerable container.
Mitigation may limit the number of configuration parameters per dataset.
+ Example Instances

In this example, assume that the victim is running a vulnerable parser such as .NET framework 1.0. This results in a quadratic runtime of O(n^2).

<?xml version="1.0"?>
<foo
aaa=""
ZZZ=""
...
999=""
/>

A document with n attributes results in (n^2)/2 operations to be performed. If an operation takes 100 nanoseconds then a document with 100,000 operations would take 500s to process. In this fashion a small message of less than 1MB causes a denial of service condition on the CPU resources.

A YAML bomb leverages references within a YAML file to create exponential growth in memory requirements. By creating a chain of keys whose values are a list of multiple references to the next key in the chain, the amount of memory and processing required to handle the data grows exponentially. This may lead to denial of service or instability resulting from excessive resource consumption.

+ Taxonomy Mappings
Relevant to the WASC taxonomy mapping
Entry IDEntry Name
41XML Attribute Blowup
+ Content History
Submissions
Submission DateSubmitterOrganization
2014-06-23CAPEC Content TeamThe MITRE Corporation
Modifications
Modification DateModifierOrganization
2017-08-04CAPEC Content TeamThe MITRE Corporation
Updated Activation_Zone, Attack_Phases, Description, Description Summary, Examples-Instances, Injection_Vector, Methods_of_Attack, Payload, Related_Attack_Patterns, Typical_Likelihood_of_Exploit, Typical_Severity
2020-07-30CAPEC Content TeamThe MITRE Corporation
Updated @Name, Description, Example_Instances, Execution_Flow, Mitigations, Prerequisites
2020-12-17CAPEC Content TeamThe MITRE Corporation
Updated Taxonomy_Mappings
Previous Entry Names
Change DatePrevious Entry Name
2020-07-30XML Attribute Blowup
More information is available — Please select a different filter.
Page Last Updated or Reviewed: October 21, 2021