COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-84

XQuery Injection

This attack utilizes XQuery to probe and attack server systems; in a similar manner that SQL Injection allows an attacker to exploit SQL calls to RDBMS, XQuery Injection uses improperly validated data that is passed to XQuery commands to traverse and execute commands that the XQuery routines have access to. XQuery injection can be used to enumerate elements on the victim's environment, inject commands to the local host, or execute queries to remote files and data sources.

Soyutlama

Detailed

Tipik ciddiyet

Very High

Saldırı ihtimali

High

Saldırıyı anla

Bu saldırı kalıbı nedir?

This attack utilizes XQuery to probe and attack server systems; in a similar manner that SQL Injection allows an attacker to exploit SQL calls to RDBMS, XQuery Injection uses improperly validated data that is passed to XQuery commands to traverse and execute commands that the XQuery routines have access to. XQuery injection can be used to enumerate elements on the victim's environment, inject commands to the local host, or execute queries to remote files and data sources.

Uygulama akışı

Saldırı adım adım nasıl ilerler?

1

Explore

Survey the application for user-controllable inputs

Using a browser or an automated tool, an attacker follows all public links and actions on a web site. They record all the links, the forms, the resources accessed and all other potential entry-points for the web application.

Kullanılan teknikler

  • Use a spidering tool to follow and record all links and analyze the web pages to find entry points. Make special note of any links that include parameters in the URL.
  • Use a proxy tool to record all user input entry points visited during a manual traversal of the web application.
  • Use a browser to manually explore the website and analyze how it is constructed. Many browsers' plugins are available to facilitate the analysis or automate the discovery.
2

Experiment

Determine user-controllable input susceptible to injection

Determine the user-controllable input susceptible to injection. For each user-controllable input that the attacker suspects is vulnerable to XQL injection, attempt to inject characters that have special meaning in XQL. The goal is to create an XQL query with an invalid syntax.

Kullanılan teknikler

  • Use web browser to inject input through text fields or through HTTP GET parameters.
  • Use a web application debugging tool such as Tamper Data, TamperIE, WebScarab,etc. to modify HTTP POST parameters, hidden fields, non-freeform fields, etc.
  • Use XML files to inject input.
  • Use network-level packet injection tools such as netcat to inject input
  • Use modified client (modified by reverse engineering) to inject input.
3

Exploit

Information Disclosure

The attacker crafts and injects an XQuery payload which is acted on by an XQL query leading to inappropriate disclosure of information.

Kullanılan teknikler

  • Leveraging one of the vulnerable inputs identified during the Experiment phase, inject malicious XQuery payload. The payload aims to get information on the structure of the underlying XML database and/or the content in it.

Manipulate the data in the XML database

The attacker crafts and injects an XQuery payload which is acted on by an XQL query leading to modification of application data.

Kullanılan teknikler

  • Leveraging one of the vulnerable inputs identified during the Experiment phase, inject malicious XQuery payload.. The payload tries to insert or replace data in the XML database.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • The XQL must execute unvalidated data

Gerekli beceri

  • Low: Basic understanding of XQuery

Gerekli kaynak

MITRE kaydında belirtilmemiş.

Etki

Başarılı saldırı neye yol açar?

Modify Data

Etkilenen alanlar: Integrity

Read Data

Etkilenen alanlar: Confidentiality

Gain Privileges

Etkilenen alanlar: Confidentiality, Access Control, Authorization

Execute Unauthorized Commands

Etkilenen alanlar: Confidentiality, Integrity, Availability

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Design: Perform input allowlist validation on all XML input
2
Implementation: Run xml parsing and query infrastructure with minimal privileges so that an attacker is limited in their ability to probe other system resources from XQL.

Gerçek dünya

MITRE örnek olayları

Örnek olay 1Detay
An attacker can pass XQuery expressions embedded in otherwise standard XML documents. Like SQL injection attacks, the attacker tunnels through the application entry point to target the resource access layer. The string below is an example of an attacker accessing the accounts.xml to request the service provider send all user names back. doc(accounts.xml)//user[Name='*'] The attacks that are possible through XQuery are difficult to predict, if the data is not validated prior to executing the XQL.
CAPEC-84: XQuery Injection — DayBreach Saldırı Sözlüğü · DayBreach