|
|
Failure to Sanitize Data within XPath Expressions (aka 'XPath injection') Status: Incomplete Weakness ID: 643 (Weakness Base)Description Summary The software uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not sufficiently sanitize that input. This allows an attacker to control the structure of the query. Extended Description The net effect is that the attacker will have control over the information selected from the XML database and may use that ability to control application flow, modify logic, retrieve unauthorized data, or bypass important checks (e.g. authentication). Likelihood of Exploit High Common Consequences Controlling application flow (e.g. bypassing authentication) Information disclosure Escalation of privilege Enabling Factors for Exploitation XPath queries are constructed dynamically using user supplied input The application does not perform sufficient validation or sanitization of user supplied input Potential Mitigations Use parameterized XPath queries (e.g. using XQuery). This will help ensure separation between data plane and control plane. Properly validate user input. Reject data where appropriate, filter where appropriate and escape where appropriate. Make sure input that will be used in XPath queries is safe in that context. Demonstrative Examples Consider the following simple XML document that stores authentication information and a snippet of Java code that uses XPath query to retrieve authentication information: Java Example: <users> <user> <login>john</login> <password>abracadabra</password> <home_dir>/home/john</home_dir> </user> <user> <login>cbc</login> <password>1mgr8</password> <home_dir>/home/cbc</home_dir> </user> </users>
The Java code used to retrieve the home directory based on the provided credentials is: XPath xpath = XPathFactory.newInstance().newXPath(); XPathExpression xlogin =
xpath.compile("//users/user[login/text()='" + login.getUserName() +
"' and password/text() = '" + login.getPassword() +
"']/home_dir/text()"); Document d =
DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(new
File("db.xml")); String homedir = xlogin.evaluate(d);
Assume that user "john" wishes to leverage XPath Injection and login without a valid password. By providing a username "john" and password "' or ''='" the XPath expression now becomes //users/user[login/text()='john' or ''='' and password/text() = ''
or ''='']/home_dir/text()
which, of course, lets user "john" login without a valid password, thus bypassing authentication. References Web Application Security Consortium. "XPath Injection". <http:/ Relationships
Relationship Notes This weakness is similar to other weaknesses that enable injection style attacks, such as SQL injection, command injection and LDAP injection. The main difference is that the target of attack here is the XML database. Applicable Platforms Languages All Time of Introduction  ImplementationContent History Modifications CWE Content Team. MITRE. 2008-09-08. (Internal) updated Common_Consequences, Relationships CWE Content Team. MITRE. 2008-10-14. (Internal) updated Description, Name, References, Relationship_Notes Previous Entry Names Unsafe Treatment of XPath Input (changed 2008-10-14) |
|
|
|||
