Skip to content

Test 13) Weak XML Schema: Unbounded Occurrences

Jump to bottom
Yalçın YOLALAN edited this page Mar 28, 2018 · 2 revisions

Weak XML Schema: Unbounded Occurrences Test

Vulnerability Type Static

Test Web Service URI http://[yourhostName]/WeakXMLTest.asmx?WSDL

Vulnerable Code Block The following lines set maxOccurs attribute value to unbounded. This can lead to resource exhaustion and ultimately a denial of service.

<s:element minOccurs="0" maxOccurs="unbounded" name="CompType" nillable="true" type="tns:CompType" xmlns:s="http://www.w3.org/2001/XMLSchema" />
    <s:element minOccurs="0" maxOccurs="unbounded" name="int" type="s:int" xmlns:s="http://www.w3.org/2001/XMLSchema" />
    <s:element minOccurs="0" maxOccurs="unbounded" name="string" nillable="true" type="s:string" xmlns:s="http://www.w3.org/2001/XMLSchema" />
    <s:element minOccurs="0" maxOccurs="unbounded" name="Book" xmlns:s="http://www.w3.org/2001/XMLSchema">
        <s:complexType>
            <s:sequence>
                <s:element minOccurs="0" maxOccurs="1" name="Title" type="s:string" />
                <s:element minOccurs="0" maxOccurs="1" name="Author" type="s:string" />
                <s:element minOccurs="0" maxOccurs="1" name="PublishDate" type="s:string" />
            </s:sequence>
        </s:complexType>
    </s:element>

Indications of Vulnerability

Static analysis reveals that the wsdl file contains maxOccurs=”unbounded” elements.
Clone this wiki locally