Skip to main content

XAML injection

Description

The application does not properly validate user input, allowing XamlReader instances to be manipulated to generate malicious elements that can interact with other system actors

Impact

Create malicious elements that can produce more severe vulnerabilities

Recommendation

Define length and content validations in all the system imputs

Threat

Authenticated attacker from the Internet

Expected Remediation Time

⌚ 20 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: N
  • Attack complexity: H
  • Privileges required: L
  • User interaction: N
  • Scope: U
  • Confidentiality: N
  • Integrity: L
  • Availability: N

Temporal

  • Exploit code madurity: P
  • Remediation level: U
  • Report confidence: C

Result

  • Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:U/RC:C
  • Score:
    • Base: 3.1
    • Temporal: 3.0
  • Severity:
    • Base: Low
    • Temporal: Low

Code Examples

Compliant code

The application perform server side validation of all system inputs

using System;
using System.IO;

public partial class WebForm : System.Web.UI.Page {
protected void Page_Load(object sender, EventArgs e) {
string input = Request.Form["in"];
string cleanInput = clearRawUserInput(input);
byte[] bytes = Convert.FromBase64String(cleaninput);
MemoryStream ms = new MemoryStream(bytes);
System.Windows.Markup.XamlReader.Load(ms);
}
}

Non compliant code

The application does not perform any server side validation for user inputs

using System;
using System.IO;

public partial class WebForm : System.Web.UI.Page {
protected void Page_Load(object sender, EventArgs e) {
string input = Request.Form["in"];
byte[] bytes = Convert.FromBase64String(input);
MemoryStream ms = new MemoryStream(bytes);
System.Windows.Markup.XamlReader.Load(ms);
}
}

Requirements