CAPEC-229: Serialized Data Parameter Blowup
This attack exploits certain serialized data parsers (e.g., XML, YAML, etc.) which manage data in an inefficient manner. The attacker crafts an serialized data file with multiple configuration parameters in the same dataset. In a vulnerable parser, this results in a denial of service condition where CPU resources are exhausted because of the parsing algorithm. The weakness being exploited is tied to parser implementation and not language specific.
Last updated
Overview
CAPEC-229 (Serialized Data Parameter Blowup) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.
How the attack works
The phases an attacker typically follows to carry out this attack.
- Step 1Explore
[Survey the target] Using a browser or an automated tool, an attacker records all instances of web services to process requests using serialized data.
- Use an automated tool to record all instances of URLs to process requests from serialized data.
- Use a browser to manually explore the website and analyze how the application processes requests using serialized data.
- Step 2Exploit
[Launch a Blowup attack] The attacker crafts malicious messages that contain multiple configuration parameters in the same dataset.
- Send the malicious crafted message containing the multiple configuration parameters to the target URL, causing a denial of service.
What the attacker needs
Prerequisites
- The server accepts input in the form of serialized data and is using a parser with a runtime longer than O(n) for the insertion of a new configuration parameter in the data container.(examples are .NET framework 1.0 and 1.1)
How to mitigate it
Defenses that reduce the risk of CAPEC-229.
- This attack may be mitigated completely by using a parser that is not using a vulnerable container.
- Mitigation may limit the number of configuration parameters per dataset.
Examples
In this example, assume that the victim is running a vulnerable parser such as .NET framework 1.0. This results in a quadratic runtime of O(n^2). A document with n attributes results in (n^2)/2 operations to be performed. If an operation takes 100 nanoseconds then a document with 100,000 operations would take 500s to process. In this fashion a small message of less than 1MB causes a denial of service condition on the CPU resources.
A YAML bomb leverages references within a YAML file to create exponential growth in memory requirements. By creating a chain of keys whose values are a list of multiple references to the next key in the chain, the amount of memory and processing required to handle the data grows exponentially. This may lead to denial of service or instability resulting from excessive resource consumption.
Terminology & mappings
Mapped taxonomies
- WASC: XML Attribute Blowup (41)
Frequently asked questions
Common questions about CAPEC-229.
- What is CAPEC-229?
- This attack exploits certain serialized data parsers (e.g., XML, YAML, etc.) which manage data in an inefficient manner. The attacker crafts an serialized data file with multiple configuration parameters in the same dataset. In a vulnerable parser, this results in a denial of service condition where CPU resources are exhausted because of the parsing algorithm. The weakness being exploited is tied to parser implementation and not language specific.
- How does a Serialized Data Parameter Blowup attack work?
- It typically unfolds over 2 phases. It begins with: [Survey the target] Using a browser or an automated tool, an attacker records all instances of web services to process requests using serialized data.
- How do you prevent CAPEC-229?
- This attack may be mitigated completely by using a parser that is not using a vulnerable container.
- What weaknesses does CAPEC-229 target?
- CAPEC-229 exploits 1 CWE weakness, including CWE-770 (Allocation of Resources Without Limits or Throttling).
- How severe is CAPEC-229?
- MITRE rates CAPEC-229 as High severity with high likelihood of attack.
References
Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.
Defend against CAPEC-229
Track the CVEs and weaknesses attackers exploit with this technique, with AI-written analysis and remediation guidance.