What is Uncontrolled Resource Consumption (CWE-400)?

TL;DR: Uncontrolled Resource Consumption (CWE-400) is a critical vulnerability that allows attackers to exhaust system resources, leading to denial-of-service attacks. Fixing it involves implementing robust rate limiting and enforcing strict resource allocation controls.

What is Uncontrolled Resource Consumption?

Uncontrolled Resource Consumption (CWE-400) is a type of vulnerability where an application does not properly control the allocation and maintenance of limited resources. As defined by the MITRE Corporation under CWE-400, this issue can lead to denial-of-service attacks when attackers exhaust system resources.

Quick Summary

Uncontrolled Resource Consumption vulnerabilities occur when applications fail to enforce limits on resource usage, leading to potential DoS attacks. This is critical because it impacts availability and integrity of systems by exhausting CPU, memory, or other resources. Jump to: Overview · How It Works · Business Impact · Attack Scenario · Detection · Fixing · Framework-Specific Fixes · AI Prompt · Best Practices Checklist · FAQ

Jump to: Quick Summary · Uncontrolled Resource Consumption Overview · How Uncontrolled Resource Consumption Works · Business Impact of Uncontrolled Resource Consumption · Uncontrolled Resource Consumption Attack Scenario · How to Detect Uncontrolled Resource Consumption · How to Fix Uncontrolled Resource Consumption · Framework-Specific Fixes for Uncontrolled Resource Consumption · How to Ask AI to Check Your Code for Uncontrolled Resource Consumption · Uncontrolled Resource Consumption Best Practices Checklist · Uncontrolled Resource Consumption FAQ · Vulnerabilities Related to Uncontrolled Resource Consumption · References · Scan Your Own Site

Uncontrolled Resource Consumption Overview

What

Uncontrolled Resource Consumption is a vulnerability where an application fails to enforce limits on resource usage.

Why it matters

It can lead to denial-of-service attacks by exhausting system resources, impacting availability and integrity.

Where it occurs

This issue commonly affects applications that allocate resources based on user input or external factors without proper rate limiting.

Who is affected

Applications running in environments where attackers can influence resource allocation are at risk.

Who is NOT affected

Systems with strict rate-limiting mechanisms in place to control resource usage are generally not vulnerable.

How Uncontrolled Resource Consumption Works

Root Cause

The root cause lies in the lack of proper controls over resource allocation and maintenance, leading to potential exhaustion of system resources.

Attack Flow

1. Attacker identifies a service that allocates resources based on user input.
2. The attacker exploits this by sending excessive requests to exhaust resources.
3. This results in denial-of-service for legitimate users.

Prerequisites to Exploit

• Ability to influence resource allocation through user input or external factors.
• Lack of rate-limiting mechanisms and proper resource management controls.

Vulnerable Code

def allocate_resources(user_input):
    # Allocate database connections based on user input without limits
    num_connections = int(user_input)
    for _ in range(num_connections):
        db.connect()

This code demonstrates a lack of control over the number of database connections allocated, allowing an attacker to exhaust available resources.

Secure Code

def allocate_resources(user_input):
    # Implement rate limiting and enforce maximum resource allocation
    max_connections = 100
    num_connections = min(int(user_input), max_connections)
    for _ in range(num_connections):
        db.connect()

The secure code enforces a maximum limit on the number of database connections, preventing resource exhaustion.

Business Impact of Uncontrolled Resource Consumption

Availability

Denial-of-service attacks can prevent legitimate users from accessing services.

Integrity

Resource exhaustion may cause data corruption or loss if systems crash due to unhandled errors.

Confidentiality

In some cases, resource exhaustion can lead to security mechanisms failing open, exposing sensitive information.

• Financial: Loss of revenue due to service downtime.
• Compliance: Non-compliance with regulations requiring system availability.
• Reputation: Damage to brand reputation from perceived unreliability or security breaches.

Uncontrolled Resource Consumption Attack Scenario

1. Attacker identifies a web application that allocates database connections based on user input.
2. The attacker sends numerous requests with high values for the number of connections.
3. This exhausts system resources, causing the server to become unresponsive.
4. Legitimate users are unable to access services until resources are freed up or the issue is mitigated.

How to Detect Uncontrolled Resource Consumption

Manual Testing

• Check if resource allocation limits are enforced based on user input.
• Simulate high load conditions and observe system behavior for signs of resource exhaustion.

Automated Scanners (SAST / DAST)

Static analysis can detect patterns indicative of uncontrolled resource consumption, while dynamic testing can simulate attacks to identify vulnerabilities in runtime environments.

PenScan Detection

PenScan’s scanners such as ZAP, Nuclei, Wapiti, and Nikto can help detect uncontrolled resource consumption by identifying code patterns that lack proper rate limiting or resource management controls.

False Positive Guidance

A false positive may occur if the application has implemented robust rate-limiting mechanisms but still triggers alerts due to high load conditions. Ensure that actual vulnerabilities are present before taking action.

How to Fix Uncontrolled Resource Consumption

• Implement rate limiting and enforce strict limits on resource allocation.
• Monitor system performance and adjust limits as needed based on observed behavior.

Framework-Specific Fixes for Uncontrolled Resource Consumption

Python/Django

def allocate_resources(user_input):
    max_connections = 100
    num_connections = min(int(user_input), max_connections)
    for _ in range(num_connections):
        db.connect()

Java

public void allocateResources(String userInput) {
    int maxConnections = 100;
    int numConnections = Math.min(Integer.parseInt(userInput), maxConnections);
    for (int i = 0; i < numConnections; i++) {
        db.connect();
    }
}

Node.js

function allocateResources(userInput) {
    const maxConnections = 100;
    const numConnections = Math.min(parseInt(userInput), maxConnections);
    for (let i = 0; i < numConnections; i++) {
        db.connect();
    }
}

How to Ask AI to Check Your Code for Uncontrolled Resource Consumption

Uncontrolled Resource Consumption Best Practices Checklist

✅ Implement rate-limiting mechanisms to restrict resource allocation based on user input. ✅ Enforce strict limits on the number of resources that can be allocated at any given time. ✅ Monitor system performance and adjust limits as needed. ✅ Use load testing tools to simulate high traffic scenarios and observe system behavior.

Uncontrolled Resource Consumption FAQ

How does uncontrolled resource consumption occur?

Uncontrolled resource consumption happens when an application fails to limit the allocation of resources such as memory, CPU, or database connections based on user input.

Why is it dangerous for applications to have uncontrolled resource consumption vulnerabilities?

It can lead to denial-of-service (DoS) attacks by exhausting system resources and preventing legitimate users from accessing services.

Can you provide an example of vulnerable code that leads to uncontrolled resource consumption?

A web application might allocate database connections based on user requests without enforcing a maximum limit, allowing attackers to overwhelm the server with excessive connection requests.

What are some common signs of uncontrolled resource consumption in logs or performance metrics?

Look for spikes in CPU usage, high memory utilization, and an unusually large number of active database connections or threads.

How can developers prevent uncontrolled resource consumption during the design phase?

Implement rate limiting mechanisms to restrict how many resources a user can request within a certain timeframe.

What are some best practices for detecting uncontrolled resource consumption in automated testing?

Use load testing tools like JMeter or Gatling to simulate high traffic scenarios and observe if the system crashes or becomes unresponsive.

How does PenScan help identify uncontrolled resource consumption issues during a security audit?

PenScan’s scanners can detect patterns indicative of resource exhaustion vulnerabilities, such as excessive database queries or memory leaks.

Vulnerabilities Related to Uncontrolled Resource Consumption

References

• MITRE
• NVD
• MITRE - CWE-400

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find uncontrolled resource consumption and other risks before an attacker does.