Skip to content
ATO Pathways
Log In
Overview
Search
Catalogs
SCAP
OSCAL
Catalogs
Profiles
Documents
References
Knowledge Base
Platform Documentation
Compliance Dictionary
Platform Changelog
About
Catalogs
XCCDF
Application Security and Development Security Technical Implementation Guide
SRG-APP-000435
XML-based applications must mitigate DoS attacks by using XML filters, parser options, or gateways.
XML-based applications must mitigate DoS attacks by using XML filters, parser options, or gateways.
An XCCDF Rule
Details
Profiles
Prose
XML-based applications must mitigate DoS attacks by using XML filters, parser options, or gateways.
Medium Severity
<VulnDiscussion>DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. XML-based applications are susceptible to DoS attacks due to the nature of XML parsing being processor intensive and complicated. Best practice for parsing XML to avoid DoS include: - Using a proven XML parser - Using an XML gateway that provides DoS protection - Using parser options that provide limits on recursive payloads, oversized payloads, and entity expansion. This requirement addresses the configuration of applications to mitigate the impact of DoS attacks that have occurred or are ongoing on application availability. For each application, known and potential DoS attacks must be identified and solutions for each type implemented. A variety of technologies exist to limit or, in some cases, eliminate the effects of DoS attacks (e.g., limiting processes or restricting the number of sessions the application opens at one time). Employing increased capacity and bandwidth, combined with service redundancy, may reduce the susceptibility to some DoS attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>