Weak XML Schema: Unbounded Occurrences

ABSTRACT

將 maxOccurs 值設為 unbounded，會導致資源耗盡，并最終發生 denial of service。

EXPLANATION

處理 XML 文檔的成本會非常高。攻擊者可以利用允許無限制元素的架構，為應用程序提供數值特別大的元素，導致應用程序耗盡系統資源。

下面是一個架構示例，它允許存在無限制的 bar 元素。

<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" >
<xs:element name="foo" >
<xs:complexType>
<xs:sequence>
	<xs:element name="bar" maxOccurs="unbounded" />
</xs:sequence>
</xs:complexType>
</xs:element>
</xs:schema>

REFERENCES

[1] Standards Mapping - OWASP Top 10 2004 - (OWASP 2004) A9 Application Denial of Service

[2] Standards Mapping - Security Technical Implementation Guide Version 3 - (STIG 3) APP6080 CAT II

[3] Standards Mapping - Security Technical Implementation Guide Version 3.4 - (STIG 3.4) APP6080 CAT II

[4] Roger L. Costello Constrain the Number of Occurrences of Elements in your XML Schema

[5] Standards Mapping - Common Weakness Enumeration - (CWE) CWE ID 400, CWE ID 770

[6] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 - (PCI 1.1) Requirement 6.5.9

[7] Standards Mapping - SANS Top 25 2010 - (SANS 2010) Risky Resource Management - CWE ID 770

[8] XML Schema Part 1:Structures Second Edition W3C

97av