Xpath Injection in Axum with Jwt Tokens

XPath Injection is a server-side injection technique that occurs when an application dynamically builds XPath expressions using untrusted data without proper sanitization or parameterization. In the Rust ecosystem, Axum is a popular web framework for building asynchronous APIs. When Axum routes handle authentication via JWT tokens and use token payload fields (such as user identifiers or roles) to construct XPath queries—typically via an XML processing library—the application can become vulnerable to XPath Injection.

Consider an Axum handler that authenticates a user by validating a JWT and then queries an XML document (for example, a legacy configuration or identity store represented as XML). If the JWT contains a username claim and the handler interpolates that value directly into an XPath expression, an attacker can manipulate the token’s payload to alter query logic. For example, a JWT with username: admin' or '1'='1 could transform a lookup intended to match a single user into a condition that always returns true, potentially bypassing authorization checks or retrieving sensitive XML nodes.

In practice, this risk arises when developers use string concatenation or interpolation to build XPath expressions, such as:

let username = claims.get("username")?.as_str().unwrap_or("");
let xpath_expr = format!("/users/user[username='{}' and role='{}']", username, role);
let result = xml_eval(&xpath_expr); // unsafe

An attacker who controls the JWT payload (e.g., via token tampering if signing is weak or algorithm confusion is present) can inject crafted fragments. A malicious token with username: ' or substring(/config/password,1,1)=' could enable data exfiltration through error-based or blind injection depending on the XML parser’s behavior. Because the scan methodology of middleBrick includes input validation checks and checks for unsafe consumption patterns, such constructs would be flagged as high-risk during automated analysis.

middleBrick’s scans test unauthenticated attack surfaces and can surface these classes of issues through its input validation and property authorization checks. Even though Axum applications often rely on JWTs for stateless auth, combining them with unsafe XPath construction exposes an implicit trust boundary: the token payload is treated as authoritative without additional validation before being used in security-sensitive queries.

Remediation focuses on avoiding string interpolation when constructing XPath expressions and treating JWT claims as untrusted input. Use parameterized XPath APIs where available, or—if XML processing requires dynamic queries—strictly validate and sanitize inputs against a defined allowlist. In Axum, this means validating JWT claims before use and avoiding direct concatenation with XML query logic.

Below are concrete Axum code examples demonstrating secure handling of JWT tokens combined with XML processing. The first example shows an unsafe pattern to avoid:

// UNSAFE: direct interpolation into XPath
async fn unsafe_handler(
    Json(payload): Json,
) -> Result {
    let token = payload["token"].as_str().unwrap_or("");
    let claims = decode_jwt(token); // returns claims map
    let username = claims.get("username").unwrap_or(&"unknown");
    let xpath = format!("/data/item[name='{}']", username);
    let res = unsafe_evaluate_xpath(&xpath); // vulnerable
    Ok(res)
}

The safe approach uses explicit validation and avoids building XPath via string formatting. If your XML library supports parameterized queries, use them; otherwise, enforce strict allowlists on claims used in queries:

// SAFE: validate and avoid injection
async fn safe_handler(
    Json(payload): Json,
) -> Result {
    let token = payload["token"].as_str().ok_or_else(|| ...)?;
    let claims = decode_jwt(token)?;
    let username = claims.get("username")
        .and_then(|v| v.as_str())
        .filter(|s| s.chars().all(|c| c.is_alphanumeric() || c == '_' || c == '-'))
        .ok_or_else(|| ...)?; // strict allowlist

    // If your XPath library supports parameters, use them:
    // let result = parameterized_xpath("/data/item[name=$name]", params!{"name" => username});

    // If not, ensure no injection surface by using a compiled expression or safe wrapper:
    let xpath = "/data/item[name='admin' or name=$name]"; // static base
    let res = safe_evaluate_xpath(xpath, username)?;
    Ok(res)
}

Additionally, enforce strong JWT validation (audience, issuer, expiration) and prefer opaque tokens or reference lookups when handling sensitive authorization decisions that involve XML-based stores. middleBrick’s JWT security checks and input validation assessments can help detect weak token handling and unsafe consumption patterns in your API surface.

For teams using the full middleBrick platform, the CLI (middlebrick scan <url>) and GitHub Action can be integrated into CI/CD to flag such patterns automatically. The dashboard provides per-category breakdowns—such as input validation and property authorization—so issues tied to JWT usage and XPath construction are prioritized with remediation guidance.