Xpath Injection in Axum with Dynamodb

XPath Injection occurs when untrusted input is concatenated into an XPath expression without proper escaping or parameterization. In an Axum application that uses the AWS SDK for Rust to interact with DynamoDB, this typically arises if a developer builds filter expressions, condition expressions, or KeyConditionExpressions using string concatenation or formatting. For example, a handler that accepts a query parameter and directly interpolates it into an expression becomes vulnerable.

Consider a scenario where a user-supplied value is used to construct a KeyConditionExpression for a DynamoDB query in Axum. If the input is not validated or escaped, an attacker can alter the logical structure of the expression to bypass authorization checks or extract unintended items. DynamoDB’s conditional and filtering logic can be manipulated to always evaluate to true or to expose additional data through crafted attribute values.

Although DynamoDB does not use a traditional XML-based XPath engine, the term XPath Injection here reflects injection into expression logic that determines access to items. The Axum service may pass user-controlled input into DynamoDB via the AWS SDK, where expressions are built dynamically. If input validation is weak, an attacker can inject values that change filter behavior, leading to Insecure Direct Object References (IDOR) or unauthorized data exposure. This maps to the BOLA/IDOR and Input Validation checks in middleBrick’s 12 parallel security checks.

In a black-box scan, middleBrick tests such endpoints by submitting payloads designed to modify expression semantics. For instance, a payload like ' OR '1'='1 appended to a query parameter might change a KeyConditionExpression to return all matching partitions, bypassing intended access controls. Because the scan is unauthenticated and runs in 5–15 seconds, it can surface these logic flaws without credentials, providing a severity-rated finding and remediation guidance in the report.

To prevent injection into DynamoDB expressions in Axum, avoid string concatenation for building expressions. Instead, use the AWS SDK’s built-in expression builders and parameterization features. For KeyConditionExpressions and FilterExpressions, supply attribute values separately so the SDK handles escaping and type safety.

Below is a safe Axum handler using the AWS SDK for DynamoDB. It uses KeyConditionExpression with placeholder values and binds user input via ExpressionAttributeValues, ensuring no direct interpolation of untrusted data into the expression string.

use axum::{routing::get, Router};
use aws_sdk_dynamodb::types::AttributeValue;
use aws_sdk_dynamodb::Client;
use std::sync::Arc;

async fn query_items(
    client: Arc,
    user_id: String,
) -> Result {
    // Safe: using expression attribute values to avoid injection
    let key_condition = "user_id = :uid";
    let expression_attr_values = std::collections::HashMap::from([(
        ":uid".to_string(),
        AttributeValue::S(user_id),
    )]);

    let resp = client
        .query()
        .table_name("MyTable")
        .key_condition_expression(key_condition)
        .expression_attribute_values(expression_attr_values)
        .send()
        .await
        .map_err(|e| (axum::http::StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

    // Process items safely
    Ok(axum::Json(resp.items.unwrap_or_default()))
}

fn app() -> Router {
    let client = Arc::new(Client::new(&aws_config::load_from_env().await));
    Router::new().route("/items", get(move |user_id| query_items(Arc::clone(&client), user_id)))
}

For FilterExpressions, apply the same pattern: use placeholders and bind values separately. Never construct expressions by formatting strings with user input. If you must incorporate dynamic field names (which is rare), validate them against a strict allowlist of known attributes rather than accepting arbitrary input.

Additionally, enforce server-side validation in Axum using strong types and validation libraries (e.g., validator or custom extractors) to ensure input conforms to expected patterns before it reaches the SDK layer. This complements the expression parameterization and reduces the attack surface for injection-style issues in DynamoDB interactions.