Falhas do tipo CWE-776

45 resultados

Expansão de Entidades XML (Ataque Bilhete de Loteria XML)

Ocorre quando um parser XML processa entidades definidas pelo usuário sem limitar a profundidade ou tamanho de expansão. Um atacante injeta entidades aninhadas ou recursivas que, ao serem expandidas, consumem memória ou CPU de forma excessiva, causando negação de serviço. O perigo está em que um arquivo XML pequeno pode explodir em gigabytes na memória durante o parse.

Exemplo

Um serviço que aceita upload de notas fiscais em XML. O atacante envia um arquivo com entidades aninhadas tipo <!ENTITY lol "&lol;&lol;&lol;...">, que quando expandidas multiplicam exponencialmente. O servidor trava ao tentar desserializar, indisponibilizando a aplicação.

Como mitigar

Desabilite a resolução de entidades externas e a expansão de entidades em geral no parser XML (usar XMLConstants.ACCESS_EXTERNAL_DTD = "" em Java, ou LIBXML_NOENT = false em PHP). Implemente limites de tamanho e profundidade no parse; considere usar parsers mais restritivos ou validar o XML com schema antes do processamento.

CVE-2019-5427—c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursiEPSS 4.9%CVE-2022-0217—It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsEPSS 4.7%CVE-2020-5227MEDIUMFeedgen Vulnerable to XML Denial of Service AttacksEPSS 2.2%CVE-2026-33116HIGH.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityEPSS 2.1%CVE-2024-28757HIGHlibexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityPEPSS 2.0%CVE-2026-26171HIGH.NET Denial of Service VulnerabilityEPSS 1.8%CVE-2023-38490MEDIUMKirby XML External Entity (XXE) vulnerability in the XML data handlerEPSS 1.7%CVE-2019-5442—XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amountsEPSS 1.4%CVE-2021-32623HIGHOpencast vulnerable to billion laughs attack (XML bomb)EPSS 1.3%CVE-2024-43398MEDIUMREXML denial of service vulnerabilityEPSS 1.2%CVE-2024-27141MEDIUMPre-authenticated Time-Based Blind XXE injectionEPSS 1.1%CVE-2023-3569MEDIUMPHOENIX CONTACT: Denial-of-Service due to malicious XML files in TC ROUTER, TC CLOUD CLIENT and CLOUD CLIENTEPSS 1.0%CVE-2021-1267MEDIUMCisco Firepower Management Center XML Entity Expansion VulnerabilityEPSS 1.0%CVE-2023-28118HIGHkaml has potential denial of service while parsing input with anchors and aliases EPSS 1.0%CVE-2022-44641MEDIUMIn Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that causEPSS 1.0%CVE-2024-27142MEDIUMPre-authenticated XXE injectionEPSS 0.9%CVE-2026-26278HIGHfast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)EPSS 0.8%CVE-2026-45304HIGHSymfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")EPSS 0.8%CVE-2024-1455MEDIUMBillion Laughs Attack leading to DoS in langchain-ai/langchainEPSS 0.8%CVE-2026-45133HIGHSymfony: [Yaml] Harden the parser when handling untrusted inputEPSS 0.7%