XPath & XPath Filter 2.0 Transform Injection

Attack surface: Key resolution, reference resolution

Attack impact: Denial of service

Exploit scenario: Complex XPath expressions can be costly to process. XPath Filters allow Union, Intersection and Subtraction operations on an XML node set using multiple XPath selections. Intended as a performance optimization, large filter sets specifying many complex XPath expressions can quickly consume many system resources.

Mitigation: Do not process KeyInfo, or keys identified by RetrievalMethod. Restrict the total number of transforms. Reject, via out-of-band schema or DTD validation, any Reference or RetrievalMethod specifying XPath or XPath Filter 2.0 transforms unless required. Identifying content by a whole document reference or by ID is preferable.

Applies to XML Encryption? Yes

Extensible Access Control Markup Language

XACML is an XML specification for expressing fine-grained information access
policies in XML documents or any other electronic resource.

At configuration time, XACML expresses and communicates the rules and policies
that an access-control mechanism uses to derive an access decision for a set of
subjects and attributes. By comparison, at run time SAML formulates assertions
about subjects, their attributes, and their access rights. For digital rights
management or workflow processing use cases, an application or medium can
transmit XACML rules together with the content to which access is being regulated.
If necessary, mechanisms outside XACML must but be used to enforce the
integrity of access rules and confidentiality of content.

The XACML specification defines ways to encode rules, bundle rules to policies,
and define selection and combination algorithms in cases where multiple rules and
policies apply.

Access control lists in XACML are 4-tuples—subject, target object, permitted
action, provision. The subject can include user IDs, groups, or role
names. The target object allows granularity down to a single XML document
element. The permitted action primitive can be either read, write, create, or delete.
This represents a major XACML limitation because it does not accommodate
domain-specific permission types. A provision is an action that must execute
upon a rule’s activation (for both deny and grant rules). Such actions may include
initiating log-in, requesting additional credentials, and sending an alert. The
XACML specification defines a language for formulating such provisions.

XML API and Application Support

DB2 introduced a new SQL column type in the database, the XML data type.
Applications can bind various language specific data types for input and output
of XML columns or parameters. These existing language specific data types
only allow the user to work with XML as character or binary types.

In order to use XML efficiently and seamlessly, new language specific XML
types are added to the existing client interfaces. These new language specific
XML types enable the database to be more efficient and enable the database
to supply a richer API for the applications. By making XML explicit in the
application, the database will avoid unnecessary and/or unwanted code
page conversions. XML documents have an internal encoding declaration
which makes all but the XML parser’s transcoding unnecessary. Avoiding
unnecessary code page conversions is often an important performance
benefit. Additionally, transcoding an XML document without carefully
adjusting the XML encoding declaration might make the XML document
invalid.

All the major database interfaces are supporting the XML type natively, i.e.
treating XML data as XML, not as a character type. Below, we will touch
on JDBC, ODBC, .NET, and embedded SQL.