Description
The product uses external input to dynamically construct an XQuery expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.
The net effect is that the attacker will have control over the information selected from the XML database and may use that ability to control application flow, modify logic, retrieve unauthorized data, or bypass important checks (e.g. authentication).
Potential Impact
Confidentiality
Read Application Data
Mitigations & Prevention
Use parameterized queries. This will help ensure separation between data plane and control plane.
Properly validate user input. Reject data where appropriate, filter where appropriate and escape where appropriate. Make sure input that will be used in XQL queries is safe in that context.
Related Weaknesses
Taxonomy Mappings
- WASC: 46 — XQuery Injection
- Software Fault Patterns: SFP24 — Tainted input to command
Frequently Asked Questions
What is CWE-652?
CWE-652 (Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The product uses external input to dynamically construct an XQuery expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows...
How can CWE-652 be exploited?
Attackers can exploit CWE-652 (Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')) to read application data. This weakness is typically introduced during the Implementation phase of software development.
How do I prevent CWE-652?
Key mitigations include: Use parameterized queries. This will help ensure separation between data plane and control plane.
What is the severity of CWE-652?
CWE-652 is classified as a Base-level weakness (Medium abstraction). Its actual severity depends on the specific context and how the weakness manifests in your application.