XML - XML Entity Expansion Attacks (Billion Laughs)

XML Entity Expansion Attacks are a class of security vulnerabilities that exploit the way XML parsers process entities. These attacks can cause excessive consumption of system resources such as memory and CPU, leading to denial-of-service (DoS) conditions. One of the most well-known examples of this type of attack is the "Billion Laughs Attack."

Understanding XML Entities

In XML, entities are placeholders that represent specific values or pieces of text. They help avoid repetition and make XML documents easier to manage. Entities are declared in the Document Type Definition (DTD) section and can be referenced throughout the XML document.

Example:

<?xml version="1.0"?>
<!DOCTYPE data [
  <!ENTITY company "OpenAI">
]>
<data>
  <name>&company;</name>
</data>

When the XML parser processes the document, it replaces &company; with the text "OpenAI."

What Is an Entity Expansion Attack?

An entity expansion attack occurs when attackers define entities that reference other entities repeatedly. During parsing, the XML processor expands these references recursively, creating enormous amounts of text from a relatively small XML file.

The parser attempts to resolve every entity before processing the document. This can rapidly consume available memory and processing power.

The Billion Laughs Attack

The Billion Laughs Attack is a classic XML entity expansion attack. It uses nested entities that expand exponentially.

Example:

<?xml version="1.0"?>
<!DOCTYPE lolz [
 <!ENTITY lol "lol">
 <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
 <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
 <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
]>
<lolz>&lol3;</lolz>

How It Works

  1. The parser reads the entity named lol.

  2. lol1 expands into ten copies of lol.

  3. lol2 expands into ten copies of lol1.

  4. lol3 expands into ten copies of lol2.

  5. The expansion continues recursively.

Although the original XML document is small, the final expanded content becomes extremely large. In larger attack versions, the resulting text can reach hundreds of megabytes or even gigabytes in memory.

Why It Is Called "Billion Laughs"

The name comes from the fact that repeated expansions can generate billions of occurrences of the word "lol." The parser tries to store all expanded text in memory, causing resource exhaustion.

Impact of the Attack

Memory Exhaustion

The parser allocates memory for each expanded entity. As expansion grows exponentially, memory usage increases dramatically.

CPU Overload

The parser spends significant processing time resolving entity references, causing high CPU utilization.

Application Crash

Insufficient memory may lead to application failure, unexpected termination, or server crashes.

Service Disruption

Legitimate users may be unable to access the service while the server is processing malicious XML data.

Network Resource Consumption

In distributed systems, resource exhaustion can spread across multiple services, affecting overall system performance.

Real-World Scenarios

Web Services

Applications receiving XML requests through SOAP or REST APIs may be vulnerable if entity expansion is enabled.

Data Exchange Systems

Organizations that exchange XML files with partners may unknowingly process malicious XML documents.

Enterprise Applications

Many enterprise systems use XML for configuration files, messaging, and integration processes. Vulnerable parsers can expose these systems to attacks.

Cloud Services

Cloud-based applications processing XML uploads can experience increased infrastructure costs and reduced service availability.

Difference Between Entity Expansion Attack and XXE

Entity Expansion Attacks and XML External Entity (XXE) attacks both involve XML entities but have different objectives.

Entity Expansion Attack

  • Focuses on exhausting system resources.

  • Causes denial of service.

  • Uses recursive entity definitions.

  • Targets memory and CPU.

XXE Attack

  • Accesses external files or resources.

  • Can expose sensitive data.

  • May enable server-side request forgery.

  • Uses external entity references.

An XML parser can be vulnerable to one or both attack types.

Example of Resource Consumption

Consider a small XML file of only a few kilobytes. Through nested entity expansion, the parser may generate:

Expansion Level Approximate Size
Level 1 30 bytes
Level 2 300 bytes
Level 3 3 KB
Level 4 30 KB
Level 5 300 KB
Level 6 3 MB
Level 7 30 MB
Level 8 300 MB

This exponential growth demonstrates how a tiny file can overwhelm a system.

Detection Techniques

XML Security Scanning

Security scanners can identify recursive entity definitions and excessive expansion patterns.

Static Code Analysis

Code analysis tools examine XML processing code and identify insecure parser configurations.

Penetration Testing

Security professionals test applications using specially crafted XML documents to determine vulnerability.

Log Monitoring

Unusual spikes in CPU usage, memory consumption, or XML processing times may indicate an attack attempt.

Prevention Methods

Disable DTD Processing

If DTD functionality is not required, disable it completely.

Example:

factory.setFeature(
"http://apache.org/xml/features/disallow-doctype-decl",
true);

This prevents entity declarations from being processed.

Disable Entity Expansion

Many XML parsers provide settings to disable entity expansion.

factory.setExpandEntityReferences(false);

Limit Entity Expansion Depth

Modern XML parsers often allow administrators to define maximum nesting levels and expansion limits.

Use Secure Parser Configurations

Always enable secure processing features.

factory.setFeature(
XMLConstants.FEATURE_SECURE_PROCESSING,
true);

Validate Input Sources

Accept XML data only from trusted sources whenever possible.

Apply Resource Limits

Implement restrictions on:

  • Maximum XML file size

  • Processing time

  • Memory allocation

  • Number of entities

Keep XML Libraries Updated

Security patches often address vulnerabilities related to entity processing.

Best Practices

  1. Disable DTD processing unless absolutely necessary.

  2. Enable secure parser settings by default.

  3. Restrict entity expansion limits.

  4. Validate and sanitize XML input.

  5. Monitor server resource usage.

  6. Regularly update XML processing libraries.

  7. Conduct security testing against XML-related vulnerabilities.

  8. Follow secure coding standards when handling XML data.

Conclusion

XML Entity Expansion Attacks, particularly the Billion Laughs Attack, exploit recursive entity definitions to generate massive amounts of data during XML parsing. These attacks can consume memory, overload CPUs, crash applications, and disrupt services. Because XML remains widely used in web services, enterprise integrations, and data exchange systems, developers and administrators must implement secure parser configurations, disable unnecessary entity processing, and enforce strict resource limits to protect applications from these potentially damaging attacks.