Blind XPath Injection (differential analysis)


XML Path Language (XPath) queries are used by web applications for selecting nodes from XML documents. Once selected, the value of these nodes can then be used by the application. A simple example for the use of XML documents is to store user information. As part of the authentication process, the application will perform an XPath query to confirm the login credentials and retrieve that user's information to use in the following request. XPath injection occurs where untrusted data is used to build XPath queries. Cyber-criminals may abuse this injection vulnerability to bypass authentication, query other user's information, or, if the XML document contains privileged user credentials, allow the cyber-criminal to escalate their privileges. Scanner injected special XPath query characters into the page and based on the responses from the server, has determined that the page is vulnerable to XPath injection. This injection was detected as scanner was able to inject specific XPath queries, that if vulnerable, result in the responses for each injection being different. This is known as a blind XPath injection vulnerability.

Products, Sensors, and Dependencies

ProductDependenciesData sourceAccess requiredProtocolData CollectedNotes
Tenable Web App ScanningWeb ApplicationsAuthenticated ScanHTTP/HTTPSXPath InjectionPlugin ID: 113310


Blind XPath Injection (differential analysis)

Attack Path Technique Details

Framework: OWASP

Family: Injection

Technique: XPath Injection

Platform: Web Application

Products Required: Tenable Web App Scanning

Tenable Release Date: 2022 Q2