How does the billion laughs XML DoS attack work?

by

The Billion Laughs attack is a denial-of-service attack that targets XML parsers. The Billion Laughs attack is also known as an XML bomb, or more esoterically, the exponential entity expansion attack. A Billion Laughs attack can occur even when using well-formed XML and can also pass XML schema validation.

The vanilla Billion Laughs attack is illustrated in the XML file represented below.

<?xml version="1.0"?>
<!DOCTYPE lolz [
<!ENTITY lol "lol">
<!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
<!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
<!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
<!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
<!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
<!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
<!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
<!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
]>
<lolz>&lol9;</lolz>

In this example, there are 10 different XML entities, lol – lol9. The first entity, lol is defined to be the string “lol”. However, each of the other entities are defined to be 10 of another entity. The document content section of this XML file contains a reference to only one instance of the entity lol9. However, when this is being parsed by a DOM or SAX parser, when lol9 is encountered, it is expanded into 10 lol8s, each of which is expanded into 10 lol7s, and so on and so forth. By the time everything is expanded to the text lol, there are 100,000,000 instances of the string "lol". If there was one more entity, or lol was defined as 10 strings of “lol”, there would be a Billion “lol”s, hence the name of the attack. Needless to say, this many expansions consumes an exponential amount of resources and time, causing the DOS.

A more extensive explanation exists on my blog.

More Related Contents:

  1. What characters do I need to escape in XML documents?
  2. Declaring a custom android UI element using XML
  3. How to parse XML using vba
  4. How to generate sample XML documents from their DTD or XSD?
  5. XPath query to get nth instance of an element
  6. Getting attribute using XPath
  7. What are XML namespaces for?
  8. Xml Namespace breaking my xpath!
  9. Opening JSF Facelets page shows “This XML file does not appear to have any style information associated with it.”
  10. SVG rounded corner
  11. XSD – how to allow elements in any order any number of times?
  12. XPath to select multiple tags
  13. XSLT: How to convert XML Node to String
  14. Represent space and tab in XML tag?
  15. In XML, is order important?
  16. How to ignore namespace when selecting XML nodes with XPath
  17. Finding the difference between two dateTimes in XSLT
  18. How to configure Spring Data JPA using XML
  19. XSLT Replace function not found
  20. How do you identify duplicate values in a numerical sequence using XPath 2.0?
  21. How to transform XML data into a data.frame?
  22. The difference between and in XSD?
  23. Why PowerShell workflow is significantly slower than non-workflow script for XML file analysis
  24. Eclipse: Referencing log4j.dtd in log4j.xml
  25. How to webscrape secured pages in R (https links) (using readHTMLTable from XML package)?
  26. Solr – Query over all fields best practice
  27. WiX Installer: using xslt with heat.exe to update attributes
  28. What is the difference between name() and local-name()?
  29. How to create xml from R objects, e.g., is there a ‘listToXml’ function?
  30. Powershell script to update XML file content

Leave a Comment