Xpath Injection in Axum

Xpath injection in Axum applications typically occurs when user input is directly incorporated into XPath queries without proper sanitization. This vulnerability allows attackers to manipulate the query structure and potentially access unauthorized data or execute unintended operations.

In Axum, Xpath injection commonly appears in these scenarios:

• XML data retrieval from databases or configuration files
• REST API endpoints that process XML requests
• Middleware that validates or transforms XML payloads
• Configuration-driven routing or feature flags stored in XML

Consider this vulnerable Axum endpoint:

use axum::{routing::get, Json, Router};
use roxmltree::Document;

async fn get_user_by_id(path: String) -> Json<serde_json::Value> {
    let doc = Document::parse(&path).unwrap();
    let xpath_query = format!("//user[id='{}']", path);
    let result = doc.eval_xpath(xpath_query).unwrap();
    
    Json(serde_json::json!({ 
        "result": result.to_string() 
    }))
}

let app = Router::new()
    .route("/user/:id", get(get_user_by_id));

An attacker could request /user/' or '1'='1 and potentially retrieve all users or manipulate the query to return unintended results. The vulnerability exists because the path parameter is directly interpolated into the XPath string without validation or escaping.

Another common pattern in Axum applications involves XML-based authentication or authorization:

async fn authenticate(credentials: Json<Credentials>) -> Json<AuthResponse> {
    let query = format!("//user[username='{}' and password='{}']", 
        credentials.username, credentials.password);
    
    let doc = load_user_data_xml();
    let result = doc.eval_xpath(query).unwrap();
    
    if result.is_empty() {
        return Json(AuthResponse { success: false });
    }
    
    Json(AuthResponse { success: true })
}

This pattern is particularly dangerous as it could allow authentication bypass through crafted input like admin' or '1'='1 in the username field.

Detecting Xpath injection in Axum applications requires a combination of static analysis and dynamic testing. middleBrick's black-box scanning approach is particularly effective for this vulnerability.

For static analysis, look for these patterns in your Axum codebase:

// Patterns to flag
let query = format!("//element[attribute='{}']", user_input);
let query = format!("//element[text()='{}']", user_input);
let query = format!("//element[contains(@attr, '{}')]", user_input);

middleBrick scans your Axum API endpoints by sending specially crafted payloads to test for Xpath injection vulnerabilities. The scanner tests with payloads like:

• ' or 1=1 or '
• ' or 'x'='x
• ' and 1=2 and '
• ' or @attribute='value

The scanner evaluates the response to determine if the injection succeeded by checking for:

• Unexpected data exposure
• Changes in response structure or length
• Error messages containing XPath syntax
• Authentication bypass in protected endpoints

For Axum applications using middleware, ensure your XML processing middleware properly validates and sanitizes input. middleBrick can scan your middleware stack to verify that all XML processing endpoints are protected.

middleBrick's LLM/AI security module also checks for Xpath injection in AI-powered features, as XML is sometimes used for structured data exchange with language models.

Remediating Xpath injection in Axum applications requires a defense-in-depth approach. Here are Axum-specific solutions:

1. Parameterized XPath Queries

use roxmltree::Document;
use xpath_reader::XpathReader;

async fn get_user_by_id(path: String) -> Json<serde_json::Value> {
    let doc = Document::parse(&path).unwrap();
    let reader = XpathReader::new();
    
    // Use parameterized queries instead of string interpolation
    let query = reader.compile("//user[id=$id]").unwrap();
    let params = vec![("$id", path.as_str())];
    
    let result = reader.eval(&doc, &query, &params).unwrap();
    
    Json(serde_json::json!({ 
        "result": result.to_string() 
    }))
}

2. Input Validation and Whitelisting

use axum::{routing::get, Json, Router, http::StatusCode};
use roxmltree::Document;
use regex::Regex;

fn validate_xpath_input(input: &str) -> Result<(), StatusCode> {
    let re = Regex::new(r"^[a-zA-Z0-9_]+$").unwrap();
    if re.is_match(input) {
        Ok(())
    } else {
        Err(StatusCode::BAD_REQUEST)
    }
}

async fn get_user_by_id(ValidatedPath(path): ValidatedPath<String>) -> Json<serde_json::Value> {
    let doc = Document::parse(&path).unwrap();
    let xpath_query = format!("//user[id='{}']", path);
    let result = doc.eval_xpath(xpath_query).unwrap();
    
    Json(serde_json::json!({ 
        "result": result.to_string() 
    }))
}

// Custom extractor for validation
#[derive(FromRef)]
struct ValidatedPath<T>(T);

#[async_trait]
impl<T: Send> FromRequestParts<()> for ValidatedPath<T>
where
    String: FromRequestParts<()>,
{
    type Rejection = StatusCode;
    
    async fn from_request_parts(parts: &mut (), state: &()) -> Result<Self, Self::Rejection> {
        let path = String::from_request_parts(parts, state).await?;
        validate_xpath_input(&path)?;
        Ok(ValidatedPath(path))
    }
}

3. Use Safe XML Libraries

Prefer libraries that provide built-in protection against injection:

use quick_xml::events::Event;
use quick_xml::Reader;

async fn safe_xml_processing(xml: String) -> Result<String, StatusCode> {
    let mut reader = Reader::from_str(&xml);
    reader.trim_text(true);
    
    let mut buf = Vec::new();
    let mut result = String::new();
    
    loop {
        match reader.read_event(&mut buf) {
            Ok(Event::Start(ref e)) => {
                // Process start elements safely
                result.push_str(&format!("<{}>", e.name()));
            }
            Ok(Event::End(ref e)) => {
                result.push_str(&format!("</{}>", e.name()));
            }
            Ok(Event::Text(e)) => {
                result.push_str(&e.unescape_and_decode(&reader).unwrap_or_default());
            }
            Ok(Event::Eof) => break,
            Err(e) => {
                // Handle malformed XML
                return Err(StatusCode::BAD_REQUEST);
            }
            _ => {}
        }
        buf.clear();
    }
    
    Ok(result)
}

4. Implement Rate Limiting

Combine with Axum's rate limiting to prevent automated injection attempts:

use axum_extra::rate_limit::RateLimitLayer;
use tower::retry::RetryLayer;
use std::time::Duration;

let app = Router::new()
    .route("/user/:id", get(get_user_by_id))
    .layer(RateLimitLayer::new(100).per_minute());

middleBrick's continuous monitoring in the Pro plan can verify that your remediation efforts remain effective over time, scanning your Axum APIs on a configurable schedule and alerting you to any regression in Xpath injection protection.