CAPEC-231

Standard Abstraction Level
Meta — Very abstract, high-level category
Standard — Specific enough to understand
Detailed — Tied to specific technique Draft MITRE CAPEC Status
Stable — Fully reviewed and complete
Draft — Under development
Incomplete — Partially defined
Deprecated — No longer recommended
Obsolete — Replaced by another CAPEC Likelihood: Medium Severity: High
Oversized Serialized Data Payloads

Description

An adversary injects oversized serialized data payloads into a parser during data processing to produce adverse effects upon the parser such as exhausting system resources and arbitrary code execution.

Prerequisites

An application uses an parser for serialized data to perform transformation on user-controllable data.

An application does not perform sufficient validation to ensure that user-controllable data is safe for a data parser.

Mitigations

Carefully validate and sanitize all user-controllable serialized data prior to passing it to the parser routine. Ensure that the resultant data is safe to pass to the parser.

Perform validation on canonical data.

Pick a robust implementation of the serialized data parser.

Validate data against a valid schema or DTD prior to parsing.

Skills Required

[Low] Denial of service

[High] Arbitrary code execution