目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1336 CNY

100%
コーヒーを一杯おごる

CWE-643 XPath表达式中数据转义处理不恰当(XPath注入) 类漏洞列表 14

CWE-643 XPath表达式中数据转义处理不恰当(XPath注入) 类弱点 14 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-643 指 XPath 注入漏洞，属于数据注入类安全缺陷。当应用程序使用未经验证或转义的外部输入动态构建 XPath 查询时，攻击者可注入恶意代码以篡改查询逻辑，从而绕过身份验证或非法读取敏感数据。开发者应严格对用户输入进行白名单校验，避免直接拼接字符串，并优先使用参数化查询或预编译语句来隔离数据与指令，确保查询结构的完整性。

MITRE CWE 官方描述
CWE：CWE-643 XPath 表达式中数据的不当中和（'XPath Injection'） 该产品使用外部输入来动态构建用于从 XML 数据库检索数据的 XPath 表达式，但未对该输入进行中和或中和不当。这使得攻击者能够控制查询的结构。 其净效果是，攻击者将能够控制从 XML 数据库中选取的信息，并可能利用这种能力来控制应用程序流程、修改逻辑、检索未经授权的数据或绕过重要检查（例如身份验证）。
常见影响 (2)
Access ControlBypass Protection Mechanism
Controlling application flow (e.g. bypassing authentication).
ConfidentialityRead Application Data
The attacker could read restricted XML content.
缓解措施 (2)
ImplementationUse parameterized XPath queries (e.g. using XQuery). This will help ensure separation between data plane and control plane.
ImplementationProperly validate user input. Reject data where appropriate, filter where appropriate and escape where appropriate. Make sure input that will be used in XPath queries is safe in that context.
代码示例 (1)
Consider the following simple XML document that stores authentication information and a snippet of Java code that uses XPath query to retrieve authentication information:
<users> <user> <login>john</login> <password>abracadabra</password> <home_dir>/home/john</home_dir> </user> <user> <login>cbc</login> <password>1mgr8</password> <home_dir>/home/cbc</home_dir> </user> </users>
Informative · XML
XPath xpath = XPathFactory.newInstance().newXPath(); XPathExpression xlogin = xpath.compile("//users/user[login/text()='" + login.getUserName() + "' and password/text() = '" + login.getPassword() + "']/home_dir/text()"); Document d = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(new File("db.xml")); String homedir = xlogin.evaluate(d);
Bad · Java
CVE IDタイトルCVSS深刻度公開日
CVE-2026-9390 XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup — XML::Sig--2026-08-03
CVE-2026-44962 Plesk 安全漏洞 — Plesk 9.9 Critical2026-05-29
CVE-2026-40699 BIG-IP Configuration utility vulnerability — BIG-IP 6.5 Medium2026-05-13
CVE-2026-24343 Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions — Apache HertzBeat 9.4AICriticalAI2026-02-10
CVE-2025-11844 XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function — huggingface/smolagents 9.1AICriticalAI2025-10-22
CVE-2025-20218 Cisco Secure Firepower Management Center Software XPATH Injection Vulnerability — Cisco Firepower Management Center 4.9 Medium2025-08-14
CVE-2022-43840 IBM Aspera Console XPath injection — Aspera Console 4.3 Medium2025-04-14
CVE-2024-39565 Junos OS: J-Web: An unauthenticated, network-based attacker can perform XPATH injection attack against a device. — Junos OS 8.8 High2024-07-10
CVE-2024-2648 Netentsec NS-ASG Application Security Gateway naccheck.php xpath injection — NS-ASG Application Security Gateway 4.3 Medium2024-03-19
CVE-2024-2645 Netentsec NS-ASG Application Security Gateway resetpwd.php xpath injection — NS-ASG Application Security Gateway 4.3 Medium2024-03-19
CVE-2023-36429 Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability — Microsoft Dynamics 365 (on-premises) version 9.0 6.5 Medium2023-10-10
CVE-2023-36433 Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability — Microsoft Dynamics 365 (on-premises) version 9.0 6.5 Medium2023-10-10
CVE-2023-24922 Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability — Microsoft Dynamics 365 (on-premises) version 9.0 6.5 Medium2023-03-14
CVE-2020-25162 B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus — SpaceCom 7.5 High2022-04-14

CWE-643（XPath表达式中数据转义处理不恰当(XPath注入)） 是常见的弱点类别，本平台收录该类弱点关联的 14 条 CVE 漏洞。