What is Asymmetric Resource Consumption (CWE-405)?

TL;DR: Asymmetric Resource Consumption (Amplification) is a critical vulnerability that allows attackers to cause disproportionate resource usage, leading to DoS attacks. Fixing this involves implementing strict input validation and rate limiting.

What is Asymmetric Resource Consumption (Amplification)?

Asymmetric Resource Consumption (Amplification) (CWE-405) is a type of vulnerability where an adversary can cause disproportionate resource usage without significant effort. This occurs when the application does not properly control situations that allow attackers to consume or produce excessive resources.

As defined by the MITRE Corporation under CWE-405, and classified by the OWASP Foundation as Not directly mapped…

Quick Summary

Asymmetric Resource Consumption (Amplification) is a critical vulnerability where an attacker can cause disproportionate resource usage without significant effort. This leads to denial of service attacks and resource exhaustion, impacting system availability and performance.

Jump to: Quick Summary · Asymmetric Resource Consumption (Amplification) Overview · How Asymmetric Resource Consumption (Amplification) Works · Business Impact of Asymmetric Resource Consumption (Amplification) · Asymmetric Resource Consumption (Amplification) Attack Scenario · How to Detect Asymmetric Resource Consumption (Amplification) · How to Fix Asymmetric Resource Consumption (Amplification) · Framework-Specific Fixes for Asymmetric Resource Consumption (Amplification) · How to Ask AI to Check Your Code for Asymmetric Resource Consumption (Amplification) · Asymmetric Resource Consumption (Amplification) Best Practices Checklist · Asymmetric Resource Consumption (Amplification) FAQ · Vulnerabilities Related to Asymmetric Resource Consumption (Amplification) · References · Scan Your Own Site

Asymmetric Resource Consumption (Amplification) Overview

What: Asymmetric Resource Consumption (Amplification) is a vulnerability where an attacker can cause disproportionate resource usage without significant effort.

Why it matters: This leads to denial of service attacks and resource exhaustion, impacting system availability and performance.

Where it occurs: In web applications, cloud services, and microservices.

Who is affected: Any application that does not properly control excessive resource consumption.

Who is NOT affected: Applications with strict input validation and rate limiting mechanisms in place.

How Asymmetric Resource Consumption (Amplification) Works

Root Cause

The root cause of asymmetric resource consumption is the lack of proper controls to prevent disproportionate resource usage by an adversary.

Attack Flow

1. The attacker sends a request that triggers excessive resource consumption.
2. The application responds with significant resource usage, amplifying the attack impact.

Prerequisites to Exploit

• An input or action that can trigger excessive resource consumption.
• Lack of proper validation and rate limiting mechanisms.

Vulnerable Code

def process_request(request):
    # Process request without proper validation or limits
    response = generate_large_response()
    return response

This code does not validate the input or enforce any rate limiting, allowing an attacker to trigger excessive resource consumption.

Secure Code

def process_request(request):
    if validate_input(request):
        response = generate_small_response()
    else:
        raise ValueError("Invalid request")
    return response

The secure version includes proper validation and limits the size of the generated response, preventing disproportionate resource usage.

Business Impact of Asymmetric Resource Consumption (Amplification)

Availability: Denial of service attacks leading to system downtime.

• Financial losses due to service unavailability.
• Compliance violations for failing to meet uptime SLAs.
• Damage to reputation from perceived poor reliability and security practices.

Asymmetric Resource Consumption (Amplification) Attack Scenario

1. An attacker sends a request that triggers excessive resource consumption.
2. The application responds with significant resource usage, amplifying the attack impact.
3. The system becomes unresponsive due to high load.

How to Detect Asymmetric Resource Consumption (Amplification)

Manual Testing

• Monitor for unusual patterns of resource usage.
• Validate that client requests are properly validated and rate-limited.
• Check if resource consumption is proportional to the request’s legitimacy and authorization level.

Automated Scanners (SAST / DAST)

Static analysis can identify code patterns that may lead to excessive resource consumption, while dynamic testing can simulate attacks to verify actual vulnerabilities.

PenScan Detection

PenScan uses scanners such as ZAP, Nuclei, Wapiti, Nikto, SSLyze, and Dalfox to detect asymmetric resource consumption issues.

False Positive Guidance

False positives often occur when the pattern looks risky but is actually safe due to context a scanner cannot see. Verify that the detected patterns are indeed exploitable in your application’s specific environment.

How to Fix Asymmetric Resource Consumption (Amplification)

• An application must make resources available to a client commensurate with the client’s access level.
• An application must, at all times, keep track of allocated resources and meter their usage appropriately.
• Consider disabling resource-intensive algorithms on the server side, such as Diffie-Hellman key exchange.

Framework-Specific Fixes for Asymmetric Resource Consumption (Amplification)

Python/Django

def process_request(request):
    if validate_input(request):
        response = generate_small_response()
    else:
        raise ValueError("Invalid request")
    return response

This secure code ensures proper validation and limits resource consumption, preventing disproportionate usage.

How to Ask AI to Check Your Code for Asymmetric Resource Consumption (Amplification)

Asymmetric Resource Consumption (Amplification) Best Practices Checklist

• ✅ Make resources available to a client commensurate with the client’s access level.
• ✅ Keep track of allocated resources and meter their usage appropriately.
• ✅ Disable resource-intensive algorithms on the server side when possible.

Asymmetric Resource Consumption (Amplification) FAQ

How does asymmetric resource consumption amplify attacks?

Asymmetric resource consumption amplifies attacks by allowing an adversary to cause disproportionate resource usage, leading to denial of service or resource exhaustion.

Can you provide a real-world example of asymmetric resource consumption?

A common example is when a server responds to every request with a large amount of data, causing the attacker’s network bandwidth to be overwhelmed while consuming minimal resources on the server side.

What are the typical consequences of asymmetric resource consumption?

Asymmetric resource consumption can lead to denial of service (DoS) attacks and resource exhaustion, impacting system availability and performance.

How do I detect asymmetric resource consumption in my application?

Detecting asymmetric resource consumption involves monitoring resource usage patterns and identifying requests that cause disproportionate resource consumption compared to their input size or complexity.

What are the best practices for preventing asymmetric resource consumption?

meter: Applications must track allocated resources and limit them based on client access levels to prevent excessive resource consumption.

How can I mitigate asymmetric resource consumption in my code?

Implement rate limiting, enforce strict input validation, and ensure that resource usage is proportional to the request’s legitimacy and authorization level.

What are some common mistakes when addressing asymmetric resource consumption?

Common mistakes include not properly metering resource usage, failing to validate client requests adequately, and neglecting to monitor for unusual patterns of resource consumption.

Vulnerabilities Related to Asymmetric Resource Consumption (Amplification)

References

• MITRE
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Asymmetric Resource Consumption (Amplification) and other risks before an attacker does.