CWE-776 — Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Base |
| Status | Draft |
| Likelihood of exploit | Medium |
Description
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
If the DTD contains a large number of nested or recursive entities, this can lead to explosive growth of data when parsed, causing a denial of service.
Common consequences
- Availability: DoS: Resource Consumption (Other)
Mitigations
Operation — If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.
Implementation — Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.
References
- CWE page: https://cwe.mitre.org/data/definitions/776.html
- CWE list: https://cwe.mitre.org/data/index.html