Dark Mode
Capec-491 Detail
Quadratic Data Expansion
Detailed Software
Parents: 230
Threats: T61 T64 T74 T77 T269 T289
An adversary exploits macro-like substitution to cause a denial of service situation due to excessive memory being allocated to fully expand the data. The result of this denial of service could cause the application to freeze or crash. This involves defining a very large entity and using it multiple times in a single entity substitution. CAPEC-197 is a similar attack pattern, but it is easier to discover and defend against. This attack pattern does not perform multi-level substitution and therefore does not obviously appear to consume extensive resources.
Not present
| External ID | Source | Link | Description |
|---|---|---|---|
| CAPEC-491 | capec | https://capec.mitre.org/data/definitions/491.html | |
| CWE-770 | cwe | http://cwe.mitre.org/data/definitions/770.html |
Explore
-
Survey the target: An adversary determines the input data stream that is being processed by a data parser that supports using substituion on the victim's side.
| Techniques |
|---|
| Use an automated tool to record all instances of URLs to process requests. |
| Use a browser to manually explore the website and analyze how the application processes requests. |
Exploit
-
Craft malicious payload: The adversary crafts malicious message containing nested quadratic expansion that completely uses up available server resource.
-
Send the message: Send the malicious crafted message to the target URL.
- This type of attack requires a server that accepts serialization data which supports substitution and parses the data.
Not present
Not present
| Availability |
|---|
| Unreliable Execution (Denial of Service) |
| Resource Consumption (Denial of Service) |
- In this example the attacker defines one large entity and refers to it many times. ... [100K of them] ...AAAA">]>&x; &x;... [100K of them]...&x;&x; This results in a relatively small message of 100KBs that will expand to a message in the GB range.