alphaspirit - Fotolia
While the syntax of an XPath expression is similar in many ways to an SQL query, XPath injection is more dangerous than SQL injection. When Web applications construct XPath queries without first validating user-supplied data, XPath injections can exploit these applications. An attacker can inject data into a query, thereby changing its semantics. By inserting a series of Boolean queries – crafted expressions that produce a value of "true" or "false" – the attacker can iterate through all the nodes of the document. Using such techniques, even an attacker who has no prior knowledge of the XPath query can retrieve a complete XML database document.
Most databases provide some level of access and privilege controls, restricting users to certain tables, fields or queries. This restriction generally limits an attacker to the application's database account. XPath provides no access control for the database document, so an attacker can query all XML objects within it. Also, since XPath is a standard language, an attacker can create an automated attack to fit any XPath-based application. Because of SQL's many variants, SQL injection attacks must be customized for the particular version of SQL being targeted.
Measures taken to defend against SQL injection do in fact help protect against XPath injection. To review, here are a few preventative steps to take. First, your application must validate and sanitize all user input. Second, assume all data is from an un-trusted source; before it's used by your scripts, data access routines and XPath queries, validate the data for type, length, format and range. It's also worth noting that this validation must be performed on the server-side, not the client-side, since client-side validation is easily bypassed. Unfortunately, there isn't a native XPath equivalent to parameterized queries, and for that reason, XPath queries have to be constructed using string-building techniques. This makes validating user-supplied input all the more important. Testing whether your application is vulnerable to XPath injection is easy. Just add a single quotation mark within the data sent to your server, and see if an error occurs. If it does, then it's likely that an XPath injection is possible. The XPath 2.0 specification, which is in the final stages of the World Wide Web Consortium (W3C)'s approval process, offers a greatly expanded set of functions and capabilities, but sadly no increased security.
- Use this XML Security Learning Guide to improve your Web services.
- Prevent blind SQL injection attacks.
Dig Deeper on Web application and API security best practices
Related Q&A from Michael Cobb
Sending sensitive information in attachments is inherently unsafe, and the main way to secure them -- encryption -- can be implemented inconsistently... Continue Reading
Spyware can steal mundane information, track a user's every move and everything in between. Read up on the types of spyware and how to best fix ... Continue Reading
Explore the differences between symmetric vs. asymmetric encryption algorithms, including common uses and examples of both, as well as their pros and... Continue Reading