XML Injection (aka Blind XPath Injection)

Description

XML Injection is a vulnerability that occurs when software constructs all or part of an XML document or XPath query using externally-influenced input from an upstream component, but does not neutralize or incorrectly neutralizes special elements that could modify the intended XML structure or query logic. Attackers exploit this by injecting XML metacharacters such as angle brackets (<, >), ampersands (&), quotes (", '), and XPath operators to manipulate XML documents or bypass XPath-based authentication and access controls. This can lead to information disclosure, authentication bypass, data manipulation, and in severe cases, server-side request forgery or denial of service through XML entity expansion attacks.

Risk

XML injection vulnerabilities can have severe consequences depending on how the application processes XML data. XPath injection in authentication systems can enable complete authentication bypass. XML document injection can corrupt data structures, inject malicious content, or alter application behavior. When combined with XML External Entity (XXE) vulnerabilities, attackers may achieve server-side request forgery, read local files, or cause denial of service. Applications using XML for configuration, data exchange, or SOAP web services are particularly at risk. The complexity of XML parsing and the various injection points make comprehensive protection challenging.

Solution

Use parameterized XPath queries when available through XML processing libraries. Sanitize all user input by escaping XML special characters: < to <, > to >, & to &, " to ", and ' to '. Implement strict input validation using allowlists for expected data formats. Disable external entity processing in XML parsers to prevent XXE attacks. Use modern, secure XML libraries with safe default configurations. For XPath queries, consider using pre-compiled queries with variable binding where supported. Avoid constructing XML documents through string concatenation; use DOM manipulation or XML builders instead.

Common Consequences

Impact	Details
Confidentiality	Scope: Confidentiality XPath injection can extract data from XML documents including authentication credentials, personal information, and confidential business data.
Access Control	Scope: Access Control Authentication bypass through XPath injection allows unauthorized access to protected functionality without valid credentials.
Integrity	Scope: Integrity XML injection can modify document structure, alter stored data, or inject malicious content that affects application behavior.

Example Code + Solution Code

Vulnerable Code

<?php
// VULNERABLE: XPath injection in authentication
function authenticate($username, $password) {
    $xml = simplexml_load_file('users.xml');

    // Attack: username=' or '1'='1' or 'a'='a   password=anything
    // Becomes: //user[username='' or '1'='1' or 'a'='a' and password='anything']
    $query = "//user[username='" . $username . "' and password='" . $password . "']";

    $result = $xml->xpath($query);
    return count($result) > 0;
}

// VULNERABLE: XML document construction
function addComment($author, $content) {
    $xml = file_get_contents('comments.xml');
    // Attack: content=</comment><comment><author>hacker</author><content>malicious
    $newComment = "<comment><author>$author</author><content>$content</content></comment>";
    // Insert before closing tag
    $xml = str_replace('</comments>', $newComment . '</comments>', $xml);
    file_put_contents('comments.xml', $xml);
}
?>

Fixed Code

<?php
// SAFE: Escaped XPath queries
function authenticate($username, $password) {
    $xml = simplexml_load_file('users.xml');

    // Escape XPath special characters
    $safeUsername = escapeXPath($username);
    $safePassword = escapeXPath($password);

    $query = "//user[username='" . $safeUsername . "' and password='" . $safePassword . "']";

    $result = $xml->xpath($query);
    return count($result) > 0;
}

function escapeXPath($input) {
    // XPath 1.0 doesn't have proper escaping for quotes
    // Best approach: use concat() for strings containing both quote types
    if (strpos($input, "'") === false) {
        return $input;
    }
    if (strpos($input, '"') === false) {
        return $input;
    }
    // Contains both - use concat
    $parts = explode("'", $input);
    return "concat('" . implode("',\"'\",'", $parts) . "')";
}

// SAFE: DOM-based XML construction
function addComment($author, $content) {
    $dom = new DOMDocument();
    $dom->load('comments.xml');

    // Validate input
    if (strlen($author) > 100 || strlen($content) > 1000) {
        throw new InvalidArgumentException("Input too long");
    }

    // Create elements using DOM - automatically handles escaping
    $comment = $dom->createElement('comment');
    $authorElem = $dom->createElement('author');
    $authorElem->appendChild($dom->createTextNode($author));
    $contentElem = $dom->createElement('content');
    $contentElem->appendChild($dom->createTextNode($content));

    $comment->appendChild($authorElem);
    $comment->appendChild($contentElem);

    $dom->documentElement->appendChild($comment);
    $dom->save('comments.xml');
}
?>

---

Exploited in the Wild

SOAP Web Service Attacks (Enterprise Applications, Ongoing)

XML injection attacks against SOAP-based web services have been used to bypass authentication, extract sensitive data, and manipulate transactions in enterprise applications including financial services and healthcare systems.

• https://owasp.org/www-community/attacks/XPATH_Injection

---

Tools to test/exploit

• Burp Suite — web security testing platform with XML/XPath injection testing capabilities.

• XPath Injection Payloads — collection of XPath injection payloads for various attack scenarios.

---

CVE Examples

• CVE-2023-28708 — Apache Tomcat session fixation combined with XPath injection.

• CVE-2021-42013 — Apache HTTP Server path traversal enabling XML configuration manipulation.

---

References

1. MITRE. "CWE-91: XML Injection (aka Blind XPath Injection)." https://cwe.mitre.org/data/definitions/91.html

2. OWASP. "XPath Injection." https://owasp.org/www-community/attacks/XPATH_Injection