CWE-405: Asymmetric Resource Consumption (Amplification)
The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."
How it's found
Asymmetric Resource Consumption (Amplification) describes a general pattern rather than a single fixed bug. Testers use a mix of static analysis and manual code review to find where a target's code matches this pattern, then confirm exploitability by hand.
This can lead to poor performance due to "amplification" of resource consumption, typically in a non-linear fashion. This situation is worsened if the product allows malicious users or attackers to consume more resources than their access level permits.
Vulnerable vs. safe
var test_string = "Bad characters: $@#";var bad_pattern = /^(\w+\s?)*$/i;var result = test_string.search(bad_pattern);var test_string = "Bad characters: $@#";var good_pattern = /^((?=(\w+))\2\s?)*$/i;var result = test_string.search(good_pattern);Consequences
- DoS: Amplification, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other): Sometimes this is a factor in "flood" attacks, but other types of amplification exist.
Mitigations
- Architecture and Design: An application must make resources available to a client commensurate with the client's access level.
- Architecture and Design: An application must, at all times, keep track of allocated resources and meter their usage appropriately.
- System Configuration: Consider disabling resource-intensive algorithms on the server side, such as Diffie-Hellman key exchange.
Where this fits in a TurboPentest engagement
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Frequently asked questions
What is CWE-405?
The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."
How do you find Asymmetric Resource Consumption (Amplification)?
Asymmetric Resource Consumption (Amplification) describes a general pattern rather than a single fixed bug. Testers use a mix of static analysis and manual code review to find where a target's code matches this pattern, then confirm exploitability by hand.
What is the impact of CWE-405?
DoS: Amplification, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other): Sometimes this is a factor in "flood" attacks, but other types of amplification exist.
Does TurboPentest test for Asymmetric Resource Consumption (Amplification)?
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Related CWEs
- Class weaknessCWE-400: Uncontrolled Resource Consumption
- Variant weaknessCWE-48: Path Equivalence: 'file name' (Internal Whitespace)
- Base weaknessCWE-170: Improper Null Termination
- Base weaknessCWE-369: Divide By Zero
- Variant weaknessCWE-382: J2EE Bad Practices: Use of System.exit()
- Variant weaknessCWE-401: Missing Release of Memory after Effective Lifetime
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest