XML Injection: Open XML

Writing unvalidated data into an Open XML document can allow an attacker to change the structure and contents of the underlying XML.

XML Injection: Open XML occurs when:

1. Data enters a program from an untrusted source.


2. The data is written to an Open XML document.

Open XML documents are typically used to store information to present to others, and often contains sensitive information.

The semantics of Open XML documents can be altered if an attacker has the ability to write raw XML. In the most benign case, an attacker can insert extraneous tags and cause an Open XML parser to throw an exception. In more nefarious cases of XML injection, an attacker can modify, add, or remove XML elements that specify important information. In some cases, XML injection can even lead to cross-site scripting or dynamic code evaluation.

Example 1:

Assume an attacker can control the a:t tag from the following Open XML document.

<a:t>YoY results: up 10%</a:t>

Now suppose this XML is included in a Powerpoint presentation that a company is providing for their stockholders. In this case, the company has a service to upload documents to their customer-facing site, which has an XML injection vulnerability within it. Suppose the attacker modifies the document to say "YoY results: down 10%". This significant update could result in a large swing in stock prices for the company. Even without modification, a user with access to this confidential information prior to it becoming public knowledge might enable them to leverage this information on the stock market similar to insider trading.