Skip to main content

​
Overview

XML Entity Expansion, often called an “XML Bomb” or “Billion Laughs Attack,” is a Denial of Service (DoS) vulnerability. It occurs when an XML parser attempts to resolve nested or recursive entity references defined within a Document Type Definition (DTD). An attacker can craft a small XML document with internal entities that refer to each other exponentially. When the parser tries to expand these entities, it consumes a massive amount of memory and CPU resources, potentially crashing the parser, the application, or even the entire server. 💣💥

​
Business Impact

Successful XML Entity Expansion attacks lead to Denial of Service:
  • Application Unavailability: The application becomes unresponsive or crashes as the XML parser exhausts server memory and CPU.
  • System Instability: In severe cases, the entire server can become unstable or unresponsive.
  • Resource Consumption: Even if the server doesn’t crash, the attack consumes significant resources, degrading performance for legitimate users.

Reference Details

CWE ID: CWE-776 Related CWEs: CWE-611 (XXE), CWE-400 (Resource Exhaustion) OWASP Top 10 (2021): A05:2021 - Security Misconfiguration (Insecure parser defaults) Severity: High (for DoS impact)

​
Framework-Specific Analysis and Remediation

Like XXE (CWE-611), this vulnerability lies in the XML parser library configuration. Parsers that process DTDs and expand internal entities are potentially vulnerable. Key Remediation Principles:
  1. Disable DTD Processing: This is the most effective defense, as it prevents the parser from processing the entity definitions in the first place. This also prevents most XXE attacks.
  2. Limit Entity Expansion: If DTDs must be processed, configure the parser to limit the total size or number of entity expansions. Many modern parsers have built-in limits or flags for this.
  3. Use Secure Parser Defaults: Keep XML parsing libraries updated, as newer versions often have safer defaults.
  4. Resource Limits: Implement general resource limits (memory, CPU) at the application or server level as a defense-in-depth measure.
  • Python
  • Java
  • .NET(C#)
  • PHP
  • Node.js
  • Ruby

​
Framework Context

Using built-in xml.etree.ElementTree, xml.dom.minidom, or lxml. lxml provides specific options against entity expansion bombs.

​
Vulnerable Scenario 1: ElementTree with DTD Processing

While ElementTree is generally safer against external entities by default, its handling of internal entity expansion can vary. Explicitly disabling DTDs is best.
# parser/xml_parser.py
import xml.etree.ElementTree as ET

def process_xml(xml_data):
    try:
        # DANGEROUS: Default parser might still expand internal entities
        # if a DTD is present, potentially leading to DoS.
        # Explicitly disabling DTDs/entities is safer.
        root = ET.fromstring(xml_data)
        # ... process ...
    except ET.ParseError as e:
        print(f"XML Parse Error: {e}")
    # Billion Laughs Attack Payload:
    # <?xml version="1.0"?>
    # <!DOCTYPE lolz [
    #  <!ENTITY lol "lol">
    #  <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
    #  <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
    #  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
    #  <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
    #  <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
    #  <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
    #  <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
    #  <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
    #  <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
    # ]>
    # <lolz>&lol9;</lolz>

​
Vulnerable Scenario 2: lxml without huge_tree=True protection (less common)

While lxml has protections, extremely large expansions or specific configurations might still pose a risk if limits aren’t hit. Disabling DTDs is still preferred.

​
Mitigation and Best Practices

  • ElementTree / minidom: Explicitly disable entity resolution using XMLParser(resolve_entities=False). This generally prevents DTD-based entity expansion.
  • lxml: Rely on defaults which are generally safe. For extra safety, use etree.XMLParser(resolve_entities=False). lxml also has built-in protection against quadratic expansion and limits total entity size, often preventing the classic “Billion Laughs”.

​
Secure Code Example

# parser/xml_parser.py (Secure ElementTree)
import xml.etree.ElementTree as ET

def process_xml_secure(xml_data):
    try:
        # SECURE: Explicitly disable entity resolution, prevents DTD processing needed for the attack.
        parser = ET.XMLParser(resolve_entities=False)
        root = ET.fromstring(xml_data, parser=parser)
        # ... process XML safely ...
    except ET.ParseError as e:
        print(f"XML Parse Error: {e}") # Error should occur safely if Billion Laughs DTD is present
    except Exception as e:
         print(f"Error: {e}")

# parser/lxml_parser.py (Secure lxml)
from lxml import etree

def process_lxml_secure(xml_data):
    try:
        # SECURE: Use default lxml parser or explicitly disable entity resolution.
        # lxml has internal protections against entity bombs too.
        parser = etree.XMLParser(resolve_entities=False)
        root = etree.fromstring(xml_data, parser=parser)
        # ... process ...
    except etree.XMLSyntaxError as e:
        # lxml might raise an error like "Detected an entity expansion attack"
        print(f"lxml Parse Error: {e}")
    except Exception as e:
         print(f"Error: {e}")

​
Testing Strategy

Submit the “Billion Laughs” XML payload (or variations with fewer nested entities if the full one is blocked by infrastructure) to all XML parsing endpoints. Observe the application’s response time and server resource usage (CPU, memory). A vulnerable application will likely hang, crash, or become unresponsive. Secure parsers should reject the input quickly with an error related to DTDs, entities, or resource limits.