What is Improper Restriction of Recursive Entity (CWE-776)?

TL;DR: Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’) (CWE-776) is a vulnerability that allows attackers to exploit recursive entity references for resource exhaustion, impacting system availability. Fix it by disabling DTDs or limiting entity expansion.

What is Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’)?

Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’) (CWE-776) is a type of security vulnerability that occurs when XML parsers allow excessive data expansion through recursive entity references within Document Type Definitions (DTDs). As defined by the MITRE Corporation under CWE-776, and classified by the OWASP Foundation under A02:2025 - Security Misconfiguration…

Quick Summary

Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’) is a critical security issue that can lead to resource exhaustion attacks. It matters because it allows attackers to consume system resources, leading to denial-of-service conditions and impacting the availability of web services.

Jump to: Quick Summary · Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’) Overview · How Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’) Works · Business Impact of Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’) · Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’) Attack Scenario · How to Detect Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’) · How to Fix Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’) · Framework-Specific Fixes for Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’) · How to Ask AI to Check Your Code for Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’) · Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’) Best Practices Checklist · Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’) FAQ · Vulnerabilities Related to Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’) · References · Scan Your Own Site

Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’) Overview

What: This vulnerability occurs when XML parsers allow excessive data expansion through recursive entity references within Document Type Definitions (DTDs).

Why it matters: It can lead to resource exhaustion attacks, causing denial-of-service conditions and impacting system availability.

Where it occurs: In applications that parse XML documents with associated DTDs without proper restrictions on entity expansion.

Who is affected: Applications that process untrusted or user-provided XML data are at risk.

Who is NOT affected: Systems that disable DTD processing or enforce strict limits on recursive entity references.

How Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’) Works

Root Cause

The root cause lies in the lack of proper restrictions on recursive entity references within XML parsers. When a parser encounters a DTD with recursive entity declarations, it can expand data exponentially, leading to resource exhaustion.

Attack Flow

1. The attacker crafts an XML document containing recursive entity references.
2. The victim application parses this document using an XML parser that allows excessive expansion of entities.
3. The exponential growth in data size causes the system resources (memory/CPU) to be exhausted.
4. This leads to a denial-of-service condition, rendering the service unavailable.

Prerequisites to Exploit

• An attacker must have access to upload or inject malicious XML content.
• The application must parse this content without proper restrictions on entity expansion.

Vulnerable Code

<!DOCTYPE foo [
  <!ENTITY e1 "a">
  <!ENTITY e2 "&e1;&e1;">
  <!ENTITY e3 "&e2;&e2;">
]>

This DTD allows for exponential data growth through recursive entity references, leading to potential resource exhaustion.

Secure Code

<!DOCTYPE foo [
  <!ENTITY e1 "a">
  <!ENTITY e2 "b">
]>

By limiting the number of entity expansions and avoiding recursion, this code prevents excessive data expansion and resource consumption.

Business Impact of Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’)

Availability:

• Excessive memory/CPU usage can lead to service unavailability.
• Application crashes due to resource exhaustion.

Business Consequences:

• Financial losses from downtime.
• Compliance penalties for failing security audits.
• Reputational damage from service disruptions.

Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’) Attack Scenario

1. An attacker uploads an XML document with a crafted DTD containing recursive entity references to the target application.
2. The application parses this document, leading to exponential data expansion and resource exhaustion.
3. As resources are consumed, the application becomes unresponsive or crashes.
4. Users experience service disruptions, impacting business operations.

How to Detect Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’)

Manual Testing

• Check for recursive entity declarations within XML documents.
• Ensure parsers enforce strict limits on entity expansion.

Automated Scanners (SAST / DAST)

Static analysis can detect the presence of recursive entity references, while dynamic testing verifies the actual impact on resource consumption.

PenScan Detection

PenScan uses ZAP and Nuclei to identify potential instances of this vulnerability in XML documents.

False Positive Guidance

False positives may occur if benign XML structures are incorrectly flagged. Ensure that only malicious patterns with recursive expansion are reported.

How to Fix Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’)

• Prohibit the use of DTDs or limit entity expansion.
• Implement strict validation rules for XML documents.
• Disable entity resolution when parsing untrusted data.

Framework-Specific Fixes for Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’)

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

This Java configuration disables DTD processing, preventing recursive entity expansion.

How to Ask AI to Check Your Code for Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’)

Review the following [language] code block for potential CWE-776 Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’) vulnerabilities and rewrite it using strict validation rules: [paste code here]

Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’) Best Practices Checklist

✅ Prohibit the use of DTDs or limit entity expansion. ✅ Implement strict validation rules for XML documents. ✅ Disable entity resolution when parsing untrusted data. ✅ Regularly audit and update parser configurations. ✅ Test your application against resource exhaustion scenarios.

Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’) FAQ

How does XML Entity Expansion occur?

It happens when an attacker exploits recursive entity references within a Document Type Definition (DTD) to cause exponential data expansion, leading to resource exhaustion.

Why is it important to prevent XML Entity Expansion?

Preventing this vulnerability ensures system availability and prevents denial of service attacks that can cripple your application’s performance.

Can you provide an example of vulnerable code?

A DTD with recursive entity references allows attackers to exploit the system by expanding data exponentially, consuming all available resources.

How do I detect XML Entity Expansion in my codebase?

Use static analysis tools and manual testing techniques to scan for recursive entity declarations before parsing XML files.

What is a recommended fix for this vulnerability?

Prohibit the use of DTDs or limit the expansion of recursive entities in your XML parser configuration.

How can I prevent XML Entity Expansion attacks on my web service?

Implement strict validation rules and disable entity resolution when parsing XML documents to mitigate potential attacks.

What are common mistakes developers make while fixing this issue?

Developers often fail to completely remove DTDs or incorrectly configure parsers, leaving the system vulnerable.

Vulnerabilities Related to Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’)

References

• MITRE - CWE-776
• OWASP Top 10 A02:2025 - Security Misconfiguration
• CAPEC-197
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’) and other risks before an attacker does.