Contents
What can XPath injection attack do?
Similar to SQL Injection, XPath Injections operate on web sites that uses user-supplied information to construct an XPath query for XML data. By sending intentionally malformed information into the web site, an attacker can find out how the XML data is structured, or access data that he may not normally have access to.
Can be vulnerable to XPath injection?
Description: XPath injection XPath injection vulnerabilities arise when user-controllable data is incorporated into XPath queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.
What is XML XPath injection?
The XPath injection is an injection attack very similar to SQL injection were a web application uses user-supplied data to construct a malicious XPath query for XML. The attacker can execute this injection by sending malicious information into the web application.
What is blind XPath injection?
Blind XPath Injection attacks can be used to extract data from an application that embeds user supplied data in an unsafe way. When input is not properly sanitized, an attacker can supply valid XPath code that is executed.
Where is XPath used?
XPath stands for XML Path Language. It uses a non-XML syntax to provide a flexible way of addressing (pointing to) different parts of an XML document. It can also be used to test addressed nodes within a document to determine whether they match a pattern or not.
How does XPath injection attack a web site?
By sending intentionally malformed information into the web site, an attacker can find out how the XML data is structured, or access data that they may not normally have access to. They may even be able to elevate their privileges on the web site if the XML data is being used for authentication (such as an XML based user file).
Why do I need to sanitize my XPath query?
When using XML for a web site it is common to accept some form of input on the query string to identify the content to locate and display on the page. This input must be sanitized to verify that it doesn’t mess up the XPath query and return the wrong data.
How is XPath used in an XML document?
Xpath is a language used to query certain parts of a XML document. It can be compared to the SQL language used to query databases. Refer to [ [1]] for more info on Xpath. In some cases the parameters within the SOAP Body are directly used as input for an xpath query.
How are parameterized XPath queries used in an attack?
Use of parameterized XPath queries – Parameterization causes the input to be restricted to certain domains, such as strings or integers, and any input outside such domains is considered invalid and the query fails. Use of custom error pages – Attackers can glean information about the nature of queries from descriptive error messages.