XML injection via user-controlled input

ID

vbnet.inject.xml_injection

Severity

high

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Inject

Language

VB.NET

Description

User-controlled input flows into an XML document without neutralization (XmlDocument.LoadXml / InnerXml or XmlWriter.WriteRaw of concatenated input). An attacker who injects XML metacharacters can add, overwrite or restructure elements (XML injection). Build the document through the DOM/writer APIs (CreateElement / WriteElementString, which encode text) or XML-encode the value; never concatenate untrusted input into raw XML markup.

Rationale

User-controlled input flows into an XML document without neutralization (XmlDocument.LoadXml / InnerXml or XmlWriter.WriteRaw of concatenated input). An attacker who injects XML metacharacters can add, overwrite or restructure elements (XML injection). Build the document through the DOM/writer APIs (CreateElement / WriteElementString, which encode text) or XML-encode the value; never concatenate untrusted input into raw XML markup.

The following code illustrates a vulnerable pattern detected by this rule:

Public Sub WriteRawFromRequest(ByVal Request As HttpRequest)
    Dim name As String = Request.QueryString("name")
    Dim xml As String = "<user><name>" & name & "</name></user>"
    Dim writer As New XmlTextWriter("users.xml", Encoding.UTF8)
    ' VULNERABLE: XML injection via user-controlled input
    writer.WriteRaw(xml)
End Sub

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References