Xpath Injection in Aspnet with Bearer Tokens

XPath Injection occurs when an attacker can influence an XPath expression constructed in server-side code, leading to unauthorized data access or authentication bypass. In ASP.NET applications that rely on XML or in-memory structures queried via XPath, unsanitized user input can change the semantics of the expression. When Bearer Tokens are involved—typically passed via the Authorization header and then used in XPath-based logic, such as selecting nodes or validating permissions—the risk is compounded because the token becomes part of the attacker-controlled query path.

Consider a scenario where an ASP.NET service receives a Bearer Token and uses it to locate a corresponding user record in an XML document or dataset via an XPath expression. If the token value is concatenated directly into the query, an attacker-supplied token can inject additional predicates or alter node selection. For example, a token like abc123 might be used in an expression such as //User[Token='abc123']. If the attacker provides ' or 1=1 or 'x, the resulting expression becomes //User[Token='' or 1=1 or 'x'], which can return multiple nodes or the first node regardless of validity, bypassing intended access controls.

In addition to data exposure, XPath Injection can lead to privilege escalation when token-based authorization logic is manipulated. If roles or permissions are encoded as attributes in XML and selected via XPath, an attacker may craft a token that causes the query to return elevated privileges. Because the token is often treated as an opaque string, developers may assume it is safe to embed directly in queries, especially when the token format appears structured (e.g., JWT-like strings). This assumption is dangerous because XPath does not enforce strict type separation the way parameterized SQL APIs do, making concatenation unsafe without strict validation or escaping.

The combination of ASP.NET’s flexible XML handling and Bearer Token usage in query logic creates a clear attack surface. MiddleBrick’s LLM/AI Security checks include Active Prompt Injection Testing and System Prompt Leakage Detection, which, while focused on language models, highlight the broader class of injection risks that also apply to API endpoints using tokens in query logic. By scanning unauthenticated attack surfaces and analyzing OpenAPI specs alongside runtime behavior, such tools can identify endpoints where user-influenced data reaches query layers without proper sanitization or parameterization.

Real-world examples include endpoints that parse SAML assertions or custom XML tokens using XPath, where the token value is extracted from the Authorization header and used in node selection without encoding. Even when the token is base64-encoded or cryptographically signed, treating it as a trusted identifier and embedding it directly in XPath expressions exposes the application to injection. Defenses require strict input validation, use of parameterized XPath APIs, and minimizing the role of bearer tokens in query construction within ASP.NET applications.

To remediate XPath Injection risks when using Bearer Tokens in ASP.NET, avoid constructing XPath expressions through string concatenation. Instead, use parameterized XPath APIs or transform the logic to avoid XPath entirely. Below are concrete code examples demonstrating secure handling of Bearer Tokens in ASP.NET.

1. Avoiding XPath with Dictionary-Based Lookup

Instead of using XPath to locate a user by token, deserialize the XML into objects or use a dictionary for O(1) lookups. This removes injection risk entirely.

using System;
using System.Collections.Generic;
using System.Xml.Linq;

public class User
{
    public string Token { get; set; }
    public string Role { get; set; }
}

public class UserRepository
{
    private readonly Dictionary<string, User> _usersByToken = new Dictionary<string, User>();

    public UserRepository(string xmlContent)
    {
        var doc = XDocument.Parse(xmlContent);
        foreach (var element in doc.Descendants("User"))
        {
            var user = new User
            {
                Token = element.Element("Token")?.Value,
                Role = element.Element("Role")?.Value
            };
            if (user.Token != null)
            {
                _usersByToken[user.Token] = user;
            }
        }
    }

    public User ValidateToken(string bearerToken)
    {
        // Bearer token extracted from Authorization header
        if (bearerToken != null && bearerToken.StartsWith("Bearer "))
        {
            bearerToken = bearerToken.Substring(7);
        }

        _usersByToken.TryGetValue(bearerToken, out var user);
        return user;
    }
}

2. Parameterized XPath (if XPath is required)

If you must use XPath, use the XPathNavigator with IXPathNavigable and parameters to avoid injection. This approach ensures that user input is treated strictly as data.

using System;
using System.Xml.XPath;
using System.Xml.Linq;

public class SecureXPathLookup
{
    public string GetRoleForToken(string xmlContent, string bearerToken)
    {
        var doc = XDocument.Parse(xmlContent);
        var navigator = doc.CreateNavigator();

        // Use a parameter to safely inject the token value
        var expr = navigator.Compile("//User[Token=$token]/Role");
        expr.SetContext(new XPathVariable("token", bearerToken));

        var roleNode = navigator.SelectSingleNode(expr);
        return roleNode?.Value;
    }
}

// Helper class for XPath variables (simplified)
public class XPathVariable
{
    public string Name { get; }
    public string Value { get; }

    public XPathVariable(string name, string value)
    {
        Name = name;
        Value = value;
    }
}

3. MiddleBrick Integration

Using the CLI, you can scan an ASP.NET endpoint to detect XPath Injection and other risks: middlebrick scan https://api.example.com/users. The CLI outputs JSON or text findings, including severity, remediation steps, and mappings to frameworks like OWASP API Top 10. For continuous monitoring, the Pro plan provides scheduled scans and GitHub Action integration to fail builds if risk thresholds are exceeded. The Dashboard allows tracking security scores over time, while the MCP Server enables scanning directly from AI coding assistants in your IDE.

4. Authorization Header Handling Example

Always validate and sanitize the token before any use. Do not pass raw headers into query logic.

using Microsoft.AspNetCore.Http;

public class TokenValidator
{
    public bool TryExtractToken(HttpRequest request, out string token)
    {
        token = null;
        if (request.Headers.TryGetValue("Authorization", out var authHeader))
        {
            var value = authHeader.ToString();
            if (value.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase))
            {
                token = value.Substring(7).Trim();
                // Optional: validate token format before use
                if (!string.IsNullOrEmpty(token))
                {
                    return true;
                }
            }
        }
        return false;
    }
}