Xponent logo Xponent Specialists In Large XML Documents Contact

Xponent's Mostly XML Blog


XML Vulnerabilities And Security Risks

There are a number risks associated with XML, ranging from poor design and coding practices to intentional exploits that pose poential security threats. Here are some of the most common XML related vulnerabilities.

XML Bomb

This involves a large number of references to a named entity, which, upon expansion, can result in exhaustion of memory.

example1

If the definition of explode is large and there is also a large number of references to it, memory could be depleted upon expansion of the entity. As recently as this year, the vulnerability of such XML bombs exists in XML parsers from major vendors. Its history, complete with references, is provided in this article: http://soa.sys-con.com/node/1092377

Access To An Externally Referenced File

If the XML contains a Document Type Definition (DTD), a file containing sensitive data, possibly in a remote location, may be referenced in an entity declaration. If the XML document is opened and read by a software program, particularly one that uses an XML parser, the program may attempt to open and read the sensitive file. It is not uncommon for XML files to be received by persons who are unaware that such a file is referenced within the XML document. Or the file may be submitted to an automated process without such awareness.

example1

If the securedata.txt file is located on a remote server, as in "http://company.com/securedata.txt" two additional vulnerabilites may exist. First, the server may be owned by a malicious entity and just accessing it could result in infection by malware, spyware, viruses or trojans. Second, if the file being accessed is very large, many gigabytes for example, that could result in a denial-of-service. See Http Overload on how to block access to such files.

Entity Recursion

This is basically recursive expansion of named entities that can result in consumption of huge amounts of memory, possiblly leading to denial-of-service, as in the following example:

example1

Submitted by Bill Conniff, Founder of Xponent, on February 20, 2010




Privacy Statement

copyright © 2008-2015. Xponent LLC. All rights reserved.