SUR-407 – Denial of Service using XML Signatures over large XML files

[relaxnow]

Vulnerability ID: SUR-407
Vulnerability Type: Denial-of-Service
Threat Level: Low

An attacker can perform a Denial of Service attack by constructing large XML messages and then forcing the server to verify a signature over these messages. With our most performant attacks, we were able to force the server to use 100% CPU for 30 seconds, with one 400kB signed SAML message. The countermeasure is to validate sizes of incoming XML messages, before they are processed.