A web application becomes vulnerable to code injection attacks when it does not sanitize user-supplied data properly and uses it unsafely to access other data from the server. The XPath injection attack is one such attack. Many web applications become vulnerable to XPath injection when the servers use user-supplied data unsafely to construct an XPath query for XML data. Let’s try to understand the attack in more detail.

What is XPath?

Many web applications use XML or EXtensible Markup Language to store and transport data in a format that is both human-readable and machine-readable. XML is often used to separate data from presentation. For example, a web server may store data in separate XML files and write a small JavaScript code to read the XML files and update the contents of HTML pages. XSLT, or EXtensible Stylesheet Language Transformations, is a recommended stylesheet language for XML. It is used to transform an XML document into HTML. XPath is a major element in XSLT. It is used in XSLT to navigate through an XML document to find the required information.

Let’s understand this with an example first. Let’s consider this XML document :

<?xml version="1.0" encoding="UTF-8"?>
<bookstore>
<book category="PROGRAMMING">
<title lang="en">Learn Programming</title>
<author>Adam Smith</author>
<year>2050</year>
<price>50.00</price>
</book>
</bookstore>

In a modern browser, you can load the XML document using:

var xmlhttprequest=new XMLHttpRequest()

The following XPath query will select the title of the book from the XML document:

xpath="/bookstore/book/title";
xmlDoc.evaluate(xpath, xmlDoc, null, XPathResult.ANY_TYPE, null);

What is the XPath injection attack, and how does it work?

Let’s understand the XPath injection attack with an example. Suppose we have an authentication system on a webpage that takes username and password as inputs …