XML Attribute Blowup

Project: WASC Threat Classification

Threat Type: Attack

Reference ID: WASC-41

 

XML Attribute Blowup

XML Attribute Blowup is a denial of service attack against XML parsers. The attacker provides a malicious XML document, which vulnerable XML parsers process in a very inefficient manner, leading to excessive CPU load. The essence of the attack is to include many attributes in the same XML node. Vulnerable XML parsers manage the attributes in an inefficient manner (e.g. in a data container for which insertion of a new attribute has O(n) runtime), resulting in a non-linear (in this example, quadratic, i.e. O(n²)) overall runtime, leading to a denial of service condition via CPU exhaustion.