cdf572bb12
## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)
63 lines
3.5 KiB
Plaintext
63 lines
3.5 KiB
Plaintext
XML parsers Denial of Service attacks target XML parsers, which are software components responsible for parsing and interpreting XML documents.
|
|
|
|
== Why is this an issue?
|
|
|
|
XML files are complex data structures. When a malicious user is able to submit an XML file, it triggers complex processing that may overwhelm the parser. Most of the time, those complex processing are enabled by default, and XML parsers do not take preventive measures against Denial of Service attacks.
|
|
|
|
=== What is the potential impact?
|
|
|
|
When an attacker successfully exploits the vulnerability, it can lead to a Denial of Service (DoS) condition.
|
|
|
|
=== System Unavailability
|
|
|
|
Affected system becomes unresponsive or crashes, rendering it unavailable to legitimate users. This can have severe consequences, especially for critical systems that rely on continuous availability, such as web servers, APIs, or network services.
|
|
|
|
=== Amplification Attacks
|
|
|
|
In some cases, XML parsers Denial of Service attacks can be used as a part of larger-scale amplification attacks. By leveraging the vulnerability, attackers can generate a disproportionately large response from the targeted system, amplifying the impact of their attack. This can result in overwhelming network bandwidth and causing widespread disruption.
|
|
|
|
include::how-to-fix-it/java-se.adoc[]
|
|
|
|
include::how-to-fix-it/dom4j.adoc[]
|
|
|
|
include::how-to-fix-it/jdom2.adoc[]
|
|
|
|
== Resources
|
|
|
|
=== Documentation
|
|
|
|
* Java Documentation - https://docs.oracle.com/en/java/javase/21/docs/api/java.xml/javax/xml/parsers/DocumentBuilderFactory.html[DocumentBuilderFactory Class]
|
|
* Java Documentation - https://docs.oracle.com/en/java/javase/21/docs/api/java.xml/javax/xml/parsers/SAXParserFactory.html[SAXParserFactory Class]
|
|
* Java Documentation - https://docs.oracle.com/en/java/javase/21/docs/api/java.xml/javax/xml/validation/SchemaFactory.html[SchemaFactory Class]
|
|
* Java Documentation - https://docs.oracle.com/en/java/javase/21/docs/api/java.xml/javax/xml/transform/TransformerFactory.html[TransformerFactory Class]
|
|
* Java Documentation - https://docs.oracle.com/en/java/javase/21/security/java-api-xml-processing-jaxp-security-guide.html[Java API for XML Processing (JAXP) Security Guide]
|
|
* Dom4j Documentation - https://dom4j.github.io/javadoc/2.1.4/org/dom4j/io/SAXReader.html[SAXReader Class]
|
|
* Jdom2 Documentation - http://www.jdom.org/docs/apidocs/org/jdom2/input/SAXBuilder.html[SAXBuilder class]
|
|
* OWASP - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#java[XXE Prevention Cheat Sheet]
|
|
|
|
=== Standards
|
|
|
|
* OWASP - https://owasp.org/Top10/A05_2021-Security_Misconfiguration/[OWASP Top 10 2021 Category A5 - Security Misconfiguration]
|
|
* OWASP - https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)[OWASP Top 10 2017 Category A4 - XML External Entities (XXE)]
|
|
* CWE - https://cwe.mitre.org/data/definitions/776[CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')]
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
=== Message
|
|
|
|
Enable XML parsing limitations to prevent Denial of Service attacks.
|
|
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
=== on 25 Jan 2022, 10:34:00 Quentin Jaquier wrote:
|
|
Quick fixes (for Java): even if it is technically possible to provide a fix that would result in compliant code, it does not sound wise to set properties blindly, as it can have side effects. Fixing the issue requires a careful and good understanding of the overall context of the code.
|
|
|
|
endif::env-github,rspecator-view[]
|