Resource Exhaustion

Description

These attacks often look modest from the outside. A few requests can trigger an expensive search, a badly written regular expression, the generation of a huge report, the writing of enormous log entries, or connections that stay open too long. The server then falls not because somebody buried it in volume but because each request costs too much.

Resource exhaustion sits on the line between security and architecture. If the system has no limits, no priorities, no way of cutting off slow operations and no protection against the abuse of expensive functions, the attacker uses a perfectly regular mechanism to cause a problem.

Examples

• Requests for a complex database search consume all the CPU and slow the application down for every user.
• Manipulated input creates enormous log entries and fills the server's disk.
• A Slowloris-style attack keeps connections open and slowly consumes the web server's capacity.

Notes

• Not every availability question is a question of the network link. An application can fall on the database, on memory, on the thread pool, or on one endpoint that costs too much.
• An expensive operation needs a price, a limit or a queue. If it is free and unlimited, an attacker will use it as leverage.