Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')

Incomplete Base

Structure: Simple

Description

XQuery Injection occurs when an application uses unvalidated user input to build an XQuery expression for querying an XML database. Without proper neutralization, an attacker can manipulate the query's structure.

Extended Description

This vulnerability allows an attacker to alter the intended logic of database queries. By injecting malicious XQuery code, they can force the database to return unauthorized data, bypass authentication checks, or modify application behavior. Successful exploitation can lead to data theft, logic manipulation, and complete bypass of security controls. Developers must treat all external input as untrusted and use parameterized queries or safe XQuery builders to prevent direct command injection into the XML data layer.

Common Consequences 1

Scope: Confidentiality

Impact: Read Application Data

An attacker might be able to read sensitive information from the XML database.

Potential Mitigations 2

Phase: Implementation

Use parameterized queries. This will help ensure separation between data plane and control plane.

Phase: Implementation

Properly validate user input. Reject data where appropriate, filter where appropriate and escape where appropriate. Make sure input that will be used in XQL queries is safe in that context.

Demonstrative Examples 1

An attacker may pass XQuery expressions embedded in an otherwise standard XML document. The attacker tunnels through the application entry point to target the resource access layer. The string below is an example of an attacker accessing the accounts.xml to request the service provider send all user names back. doc(accounts.xml)//user[name='*'] The attacks that are possible through XQuery are difficult to predict, if the data is not validated prior to executing the XQL.

Likelihood of Exploit

High

Applicable Platforms

Languages:

Not Language-Specific : Undetermined

Modes of Introduction

Implementation

Related Weaknesses

ChildOf:

Improper Neutralization of Special Elements in Data Query Logic (CWE-943)

ChildOf:

XML Injection (aka Blind XPath Injection) (CWE-91)

Taxonomy Mapping

WASC
Software Fault Patterns

Notes

RelationshipThis weakness is similar to other weaknesses that enable injection style attacks, such as SQL injection, command injection and LDAP injection. The main difference is that the target of attack here is the XML database.