XML Injection is a vulnerability that occurs when untrusted user input is incorporated into an XML document without proper handling as data. This can allow an attacker to inject XML markup, modify the structure or values of the resulting document, or alter how the application processes the XML.

XML (Extensible Markup Language) is a markup language used to store, structure, and exchange data.

Unlike programming languages, XML itself does not execute code. The security impact of XML Injection varies based on how the resulting XML document is parsed, validated, transformed, stored, or passed to other components.

How XML Injection Works

1. Incorporating Untrusted Input into XML: An application accepts user-controlled input and directly inserts it into an XML document.
2. Failure to Separate Data from XML Structure: The vulnerability arises when user input is inserted into XML as raw markup instead of being safely encoded or added using an XML API. If the application allows users to control XML markup, an attacker may be able to modify elements, attributes, or other components of the document.
3. Processing the Modified XML Document: The modified XML is then parsed by the application or another component. Depending on how the XML is utilized, the altered structure may change application behavior or lead to unexpected processing.

XML Injection Impact

• Data Manipulation: Attackers may modify XML elements or attributes, potentially altering application data or processing logic.
• Authentication or Authorization Bypass: If XML controls authentication, authorization, or application configuration, manipulating XML values may circumvent security controls.
• Data Integrity Issues: Injected XML may modify, corrupt, or otherwise alter data processed or stored by the application.
• Denial of Service: Malformed or overly complex XML may consume excessive CPU or memory resources, potentially affecting application availability.
• Injection Into Downstream Systems: XML generated by one application may be passed to another component, parser, service, or XML-based system. As a result, injected XML can impact downstream processing if the receiving component does not manage the data securely.
• Additional XML-Based Vulnerabilities: In certain situations, improperly handled XML can expose other vulnerabilities, such as XML External Entity (XXE) attacks. XXE should be considered a separate vulnerability related to unsafe external entity processing.

XML Injection Mitigation

• Treat User Input as Data: Avoid constructing XML by directly concatenating untrusted input into an XML string. Instead, use a trusted XML library or serializer that automatically escapes XML special characters when inserting values. Special characters such as <, >, &, ", and ' must be handled appropriately for their XML context.
• Use XML APIs for XML Construction: Prefer XML libraries that allow applications to create elements, attributes, and text nodes programmatically instead of constructing XML through string concatenation. This ensures that user input remains data rather than becoming part of the XML structure.
• Validate XML Structure: Use an appropriate XML Schema (XSD) or another validation mechanism for applications requiring a specific XML structure. Validation can help ensure that the resulting XML conforms to the expected format, but it should be viewed as an additional security control rather than the primary defense against injection.
• Secure XML Parser Configuration: Configure XML parsers securely, especially when processing untrusted XML. If external entities or DTDs are not necessary, disable unnecessary external entity processing and access to external resources to reduce the risk of XXE and related attacks.
• Restrict External Resource Access: If the XML processing environment allows for external resources, restrict access to local files, network resources, and external entities. Only enable these capabilities when they are explicitly required.
• Apply the Principle of Least Privilege: Run applications and XML-processing components with only the permissions they need. Limit access to sensitive files, directories, network resources, and system functionality.
• Keep XML Libraries Updated: Use supported XML parsers and libraries and regularly apply security updates.
• Perform Security Testing: Conduct code reviews, vulnerability assessments, and penetration testing to determine whether untrusted input can alter XML structure or impact downstream XML processing.

XML Injection Example

Clone this current repo recursively

git clone --recurse-submodules https://github.com/qeeqbox/xml-injection

Run the webapp using Python

python3 xml-injection/vulnerable-web-app/webapp.py

Open the webapp in your browser 127.0.0.1:5142

Use the default credentials (username: admin and password: admin) to login

Go the setting seciton and enter America/Los_Angelestrues/edit>America/Los_Angeles

The webapp returns more access after injecitng the edit tag

Code

When a user updates the timezone using the update_config() function

elif parsed_url.path == "/config":
    if "config-xml" in post_request_data and "config-xsl" in post_request_data:
        self.send_content(200, [('Content-type', 'text/html')], self.validate_config(post_request_data["config-xml"][0],post_request_data["config-xsl"][0]))
        return
    if "config-timezone" in post_request_data:
        self.send_content(200, [('Content-type', 'text/html')], self.update_config(post_request_data["config-timezone"][0]))

The update_config() function replaces the user input with what's between the timezone without sanitization

def update_config(self,timezone):
    ret = b""
    try:
        ret = b""
        with open(CONFIG_FILE, "rb") as f:
            ret = f.read()
        updated_content = resub(b"<timezone>.*?</timezone>", timezone.encode("utf-8"), ret)
        with open(CONFIG_FILE, "wb") as f:
            f.write(updated_content)
    except Exception as e:
        ret = str(e).encode("utf-8")
    return ret