cve.bz

CAPEC-228

DTD Injection

Medium severityDetailed pattern

An attacker injects malicious content into an application's DTD in an attempt to produce a negative technical impact. DTDs are used to describe how XML documents are processed. Certain malformed DTDs (for example, those with excessive entity expansion as described in CAPEC 197) can cause the XML parsers that process the DTDs to consume excessive resources resulting in resource depletion.

On this page

Ask an AI about this attack pattern

ChatGPTClaudeGoogle AI Mode

Show the promptExplain the attack pattern CAPEC-228: DTD Injection: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/228.html and https://cve.bz/cve/capec/228?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

How the attack unfolds

  1. Explore

    The attacker looks for a way in.

    1. [Survey the target] Using a browser or an automated tool, an attacker records all instances of web services to process XML requests.

      2 techniques
      • Use an automated tool to record all instances of URLs to process XML requests.
      • Use a browser to manually explore the website and analyze how the application processes XML requests.

    2. [Determine use of XML with DTDs] Examine application input to identify XML input that leverage the use of one or more DTDs.

      2 techniques
      • Examine any available documentation for the application that discusses expected XML input.
      • Exercise the application using XML input with and without a DTD specified. Failure without DTD likely indicates use of DTD.

  2. Exploit

    They carry out the attack.

    1. [Craft and inject XML containg malicious DTD payload]

      2 techniques
      • Inject XML expansion attack that creates a Denial of Service impact on the targeted server using its DTD.
      • Inject XML External Entity (XEE) attack that can cause the disclosure of confidential information, execute abitrary code, create a Denial of Service of the targeted server, or several other malicious impacts.

Prerequisites

  • The target must be running an XML based application that leverages DTDs.

Mitigations

  • Design: Sanitize incoming DTDs to prevent excessive expansion or other actions that could result in impacts like resource depletion.

  • Implementation: Disallow the inclusion of DTDs as part of incoming messages.

  • Implementation: Use XML parsing tools that protect against DTD attacks.

Weaknesses it exploits

  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere

Recent CVEs with these weaknesses

  1. 4.4CVE-2026-123858

    In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects

  2. 5.5CVE-2026-123854

    In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module

  3. 7.8CVE-2026-123853

    In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process

  4. 7.0CVE-2026-123849

    In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers

  5. 3.3CVE-2026-123843

    In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration

  6. 7.8CVE-2026-123838

    In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file

  7. 3.6CVE-2026-123833

    In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects

  8. 9.6CVE-2026-123832

    In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database

The newest records naming one of them. Each weakness's page lists them all.

Part of
Can lead to

MITRE's words, unchanged: CAPEC-228 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.