CWE-405: Asymmetric Resource Consumption (Amplification)
The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."
How it's found
Asymmetric Resource Consumption (Amplification) describes a general pattern rather than a single fixed bug. Testers use a mix of static analysis and manual code review to find where a target's code matches this pattern, then confirm exploitability by hand.
This can lead to poor performance due to "amplification" of resource consumption, typically in a non-linear fashion. This situation is worsened if the product allows malicious users or attackers to consume more resources than their access level permits.
Vulnerable vs. safe
var test_string = "Bad characters: $@#";var bad_pattern = /^(\w+\s?)*$/i;var result = test_string.search(bad_pattern);var test_string = "Bad characters: $@#";var good_pattern = /^((?=(\w+))\2\s?)*$/i;var result = test_string.search(good_pattern);Consequences
- DoS: Amplification, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other): Sometimes this is a factor in "flood" attacks, but other types of amplification exist.
Mitigations
- Architecture and Design: An application must make resources available to a client commensurate with the client's access level.
- Architecture and Design: An application must, at all times, keep track of allocated resources and meter their usage appropriately.
- System Configuration: Consider disabling resource-intensive algorithms on the server side, such as Diffie-Hellman key exchange.
Where this fits in a TurboPentest engagement
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Frequently asked questions
What is CWE-405?
The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."
How do you find Asymmetric Resource Consumption (Amplification)?
Asymmetric Resource Consumption (Amplification) describes a general pattern rather than a single fixed bug. Testers use a mix of static analysis and manual code review to find where a target's code matches this pattern, then confirm exploitability by hand.
What is the impact of CWE-405?
DoS: Amplification, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other): Sometimes this is a factor in "flood" attacks, but other types of amplification exist.
Does TurboPentest test for Asymmetric Resource Consumption (Amplification)?
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Related CWEs
- Class weaknessCWE-400: Uncontrolled Resource Consumption
- Variant weaknessCWE-48: Path Equivalence: 'file name' (Internal Whitespace)
- Base weaknessCWE-170: Improper Null Termination
- Base weaknessCWE-369: Divide By Zero
- Variant weaknessCWE-382: J2EE Bad Practices: Use of System.exit()
- Variant weaknessCWE-401: Missing Release of Memory after Effective Lifetime
About this reference
These security references are maintained by IntegSec, an offensive-security firm whose team holds CISSP, OSCP, and OSCE certifications and has run thousands of penetration tests. Content is kept current as tools, standards, and attack techniques evolve.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest