[REVS] Blind XPath Injection

From: SecuriTeam (support_at_securiteam.com)
Date: 05/20/04

  • Next message: SecuriTeam: "[EXPL] CVS Remote Entry Line Heap Overflow Root Exploit" 
    To: list@securiteam.com
Date: 20 May 2004 17:59:21 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Blind XPath Injection
    ------------------------------------------------------------------------

    SUMMARY

    The linked paper at the bottom describes a Blind XPath Injection attack
    that enables an attacker to extract a complete XML document used for XPath
    querying, without prior knowledge of the XPath query.

    DETAILS

    Abstract:
    This paper describes a Blind XPath Injection attack that enables an
    attacker to extract a complete XML document used for XPath querying -
    without prior knowledge of the XPath query. The attack is "complete" since
    all possible data is exposed. The attack makes use of two techniques -
    XPath crawling, and Booleanization of XPath queries.

    Using this attack, it is possible to get hold of the XML "database" used
    in the XPath query. This can be most powerful against sites that use XPath
    queries (and XML "databases") for authentication, searching, and other
    uses.

    Compared to the SQL injection attacks, XPath Injection has the following
    upsides:

    (*) Since XPath is a standard (yet rich) language, it is possible to carry
    the attack 'as-is' for any XPath implementation. This is in contrast to
    SQL injection where different implementations have different SQL dialects
    (there is common SQL language, but it is often too weak).

    (*) The XPath language can reference practically all parts of the XML
    document without access control restrictions, whereas with SQL, a "user"
    (which is a term undefined in the XPath/XML context) may be restricted to
    certain tables, columns or queries. So the outcome of the Blind XPath
    Injection attack is guaranteed to consist of the complete XML document,
    i.e. the complete database.

    These results enable an automated attack to fit any XPath based
    application provided that it possesses the basic security hole. Indeed,
    such proof of concept script was written and demonstrated on various XPath
    implementations.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:amit.klein@sanctuminc.com>
    Amit Klein.
    The original article can be found at:
    <http://www.sanctuminc.com/pdfc/WhitePaper_Blind_XPath_Injection_20040518.pdf> http://www.sanctuminc.com/pdfc/WhitePaper_Blind_XPath_Injection_20040518.pdf

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] CVS Remote Entry Line Heap Overflow Root Exploit"

    Relevant Pages

    • Using XPath to copy nodes
      ... private Element getAnswers(Element root, String queID) throws ... XPath xpath = factory.newXPath; ... //Design the query to search through the XML Document ...
      (comp.lang.java.programmer)
    • Using XPath to copy nodes
      ... private Element getAnswers(Element root, String queID) throws ... XPath xpath = factory.newXPath; ... //Design the query to search through the XML Document ...
      (comp.lang.java.programmer)
    • Re: Using XPath Against A Node
      ... top parent? ... Or is the entire xml document sent with it. ... In terms of the XPath implementation with SelectSingleNode and SelectNodes if the node is not inserted in the owning document then it looks like the XPath / evaluates to the node itself. ...
      (microsoft.public.dotnet.languages.vb)
    • implementation of xpath in ruby?
      ... I have used token types to parse xml ... returns the tag end of an xml document. ... now i need to implement xpath in my parser class. ...
      (comp.lang.ruby)
    • Re: SelectSingleNode in C#
      ... you need an Xml Document which contains your XML string: ... XmlDocument oXmlDoc = new XmlDocument; ... Then you can get a specific, single node, by specifying a valid XPath ...
      (microsoft.public.dotnet.framework.windowsforms)