CWE-112: Missing XML Validation
Base
The product accepts XML from an untrusted source but does not validate the XML against the proper schema.
Most successful attacks begin with a violation of the programmer's assumptions. By accepting an XML document without validating it against a DTD or XML schema, the programmer leaves a door open for attackers to provide unexpected, unreasonable, or malicious input.
Consequences
- Integrity: Unexpected State
How to prevent it
- Architecture and Design: Always validate XML input against a known XML Schema or DTD. It is not possible for an XML parser to validate all aspects of a document's content because a parser cannot understand the complete semantics of the data. However, a parser can do a complete and thorough job of checking the document's structure and therefore guarantee to the code that processes the document that the content is well-formed.
Recent advisories
- GHSA-63v5-26vq-m4vm — Keycloak's missing timestamp validation allows attackers to extend SAML response validity periods
- GHSA-qcfc-hmrc-59x7 — Apache Struts 2 is Missing XML Validation
- GHSA-prc3-7f44-w48j — Missing XML Validation in Apache Tomcat
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor