TypeScript : XPath injection
Classification
OWASP Top 10 2013 A1-Injection OWASP Top 10 2017 A1-Injection OWASP Top 10 2021 A3-Injection OWASP ASVS Validation, Sanitization and Encoding Validation, Sanitization and Encoding PCI DSS 4.0 6.2.4 HIPAA §164.312 (a)(1) §164.312 (d) CWE CWE-643 CWE-1027Overview
The application executes XPath query built on the basis of data from an untrusted source. An attacker can change the meaning of the executed expression or execute arbitrary query.
A possible attack scenario:
- The application receives input data from an untrusted source.
- This data is used to dynamically create XPath query.
- An attacker get an opportunity to influence the semantics of the query or execute his/her own queries.
References
