XPath Injection for Bug Bounty: Queries That Leak Nodes

XPath Injection for Bug Bounty: Queries That Leak Nodes

XPath injection is SQLi’s quieter cousin. The app builds an XPath query with your string. You break out of a string literal and change which nodes match.

It thrives in older stacks: XML user stores, SAML attribute queries, document search over XML payloads, SOAP endpoints that filter with XPath.

What a vulnerable pattern looks like

Pseudo-code:

// user input: username, password
query = "//users/user[name/text()='" + username + "' and pass/text()='" + password + "']"

Supplying ' or '1'='1 style payloads can make the predicate always true — classic auth bypass. Boolean and error-based techniques can also extract node text bit by bit when blind.

Detection tips

1. Find parameters that filter lists or authenticate against XML-ish backends.
2. Inject a single quote and watch for XPath errors in bodies or logs you are allowed to see.
3. Try boolean pairs: a condition that should be true vs false, comparing result sets.
4. Time-based or out-of-band tricks are rarer than with SQL; boolean extraction is the workhorse.

OWASP’s community page and PortSwigger labs (where available) give payload families — adapt them; raw cheat-sheet dumping looks unserious in reports.

Impact stories that land

• Login bypass against an XML credential store
• Extracting other users’ attributes from a directory XML document
• Reading hidden nodes (internal roles, API keys embedded in config XML — yes, that still happens)

If you only cause a verbose error with no data leak and no bypass, severity drops. Show a second user’s attribute or a successful auth under a modified predicate.

Safer testing habits

Prefer read-only extraction proofs. Do not delete nodes. Keep payloads short. On production, extract one non-sensitive field to prove control, then stop.

Fix angle (for the “remediation” section)

Parameterized XPath APIs, strict allowlists, and not storing auth data in traversable XML beat escaping whack-a-mole.

XPath injection feels niche until you hit a legacy SSO broker or a document platform that still queries XML on every search. When the error screams XPath, slow down — boolean logic against nodes can be as lucrative as a clean SQLi on a modern ORM app.