XML is used extensively in today's web applications, both in requests and responses between the browser and front-end application server and in messages between back-end application components such as SOAP services. Both of these locations are susceptible to attacks whereby crafted input is used to interfere with the operation of the application and normally perform some unauthorized action.
In today's web applications, XML is often used to submit data from the client to the server. The server-side application then acts on this data and may return a response containing XML or data in any other format. This behavior is most commonly found in Ajax-based applications where asynchronous requests are used to communicate in the background. It can also appear in the context of browser extension components and other client-side technologies.
For example, consider a search function that, to provide a seamless user experience, is implemented using Ajax. When a user enters a search term, a client-side script issues the following request to the server:
POST /search/128/AjaxSearch.ashx HTTP/1.1 Host: mdsec.net content-Type: text/xml; charset=UTF-8 Content-Length: 44 <Search><SearchTerm>nothing will change</SearchTerm></Search>
The server's response is as follows (although vulnerabilities may exist regardless of the format used in responses):
HTTP/1.1 200 OK Content-Type: text/xml; charset=utf-8 Content-Length: 81 <Search><SearchResult>No ...