CWE-776 Improper Restriction of Recursive Entity References in DTDs

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

• Availability: DoS: Resource Consumption (Other) — If the DTD contains a large number of nested or recursive entities, this allows the attacker to expand data exponentially when the DTD is parsed, quickly consuming all system resources.

• [Operation] If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities. • [Implementation] Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

• CVE-2008-3281: XEE in XML-parsing library. • CVE-2011-3288: XML bomb / XEE in enterprise communication product. • CVE-2011-1755: "Billion laughs" attack in XMPP server daemon. • CVE-2009-1955: XML bomb in web server module • CVE-2003-1564: Parsing library allows XML bomb