1850
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1019 Validate Inputs 2433
Applicable Platforms
CWE Version 4.14
CWE-652: Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
CWE-652: Improper Neutralization of Data
within XQuery Expressions ('XQuery Injection') 1436
Language : Not Language-Specific (Prevalence = Undetermined)
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
An attacker might be able to read sensitive information
from the XML database.
Potential Mitigations
Phase: Implementation
Use parameterized queries. This will help ensure separation between data plane and control
plane.
Phase: Implementation
Properly validate user input. Reject data where appropriate, filter where appropriate and escape
where appropriate. Make sure input that will be used in XQL queries is safe in that context.
Demonstrative Examples
Example 1:
An attacker may pass XQuery expressions embedded in an otherwise standard XML document.
The attacker tunnels through the application entry point to target the resource access layer. The
string below is an example of an attacker accessing the accounts.xml to request the service
provider send all user names back. doc(accounts.xml)//user[name='*'] The attacks that are possible
through XQuery are difficult to predict, if the data is not validated prior to executing the XQL.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 929 OWASP Top Ten 2013 Category A1 - Injection 928 2389
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1308 CISQ Quality Measures - Security 1305 2485
MemberOf 1340 CISQ Data Protection Measures 1340 2590
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
Notes
Relationship
This weakness is similar to other weaknesses that enable injection style attacks, such as SQL
injection, command injection and LDAP injection. The main difference is that the target of attack
here is the XML database.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
WASC 46 XQuery Injection
Software Fault Patterns SFP24 Tainted input to command
CWE Version 4.14
CWE-653: Improper Isolation or Compartmentalization
CWE-653: Improper Isolation or Compartmentalization