Posts on: Web-Attacks

---

Security Assertion Markup Language (SAML) is an XML-based standard for authentication and authorization between parties, widely used to implement Single Sign-On (SSO). Data is exchanged in digitally signed XML documents, and the security of the entire federation rests on one assumption: the element the Service Provider cryptographically verifies is the same element its application code reads the username from. 2025–2026 context: SAML is built on XML, and XML’s parser complexity has produced a persistent stream of critical authentication-bypass CVEs across every major language ecosystem. The 2025 PortSwigger “Fragile Lock” research introduced attribute pollution, namespace confusion, and Void Canonicalization as new XSW classes. The current CVE feed is dominated by signature wrapping in libraries (authentik, Net::SAML2, ruby-saml, Nokogiri), replay and missing Conditions validation (Casdoor, Logto, Snipe-IT, Keycloak), and XML comment injection (authentik).

IDOR (CWE-639) occurs when an application exposes an internal object reference — a database key, filename, UUID, or account identifier — and fails to verify that the requesting user is authorised to access that specific object. It is not a missing authentication problem; it is a missing authorisation problem. The user is authenticated, the request is legitimate, and the server simply trusts the identifier the client supplied. IDOR is the most common and impactful API vulnerability. OWASP ranks Broken Access Control (A01) as the #1 web application risk in 2025, and Broken Object Level Authorization (BOLA / API1) as the #1 API risk. Roughly 33% of APIs have IDOR, with typical bug-bounty payouts of $500–$10k.

OS command injection occurs when user-controlled input is misinterpreted as part of a system command. It is the highest-impact web vulnerability class after SQLi — a single injection point is often full remote code execution, and the filter-bypass surface is broader than any other injection type because the shell performs its own expansion after the filter has already made its decision. 2025–2026 context: OS command injection is no longer just ; id in a ping parameter. It lives in CLI argument handling (Llama-Index --files), AI/agent tool calling, CI/CD runners, and network appliance diagnostics. The filter-bypass research has shifted toward length-constrained injection and semantic-equivalent mutation that survives WAF inspection.

Web caches sit between the client and the origin server to reduce latency and load. A cache key — a subset of request attributes — decides whether two requests may share a cached response. Every bug in this class is a disagreement between the cache and the origin about what the request means: either the cache keys on something the origin ignores (poisoning), or the cache serves a private response as if it were public (deception).

Local File Inclusion occurs when an application includes a file whose path is influenced by user input, without proper validation. The impact ranges from source disclosure to full remote code execution — and the gap between the two is smaller than it was a few years ago, because 2024–2026 produced PHP filter-chain techniques that turn a plain php://filter read into arbitrary code execution without allow_url_include, without a log file, and without a writable path.

Remote File Inclusion (RFI) occurs when an application loads a file from a remote URL supplied by the attacker — typically through a PHP include() or require() statement that uses user-controlled input. Unlike LFI, which reads files already on the server, RFI fetches the file from the attacker’s server and executes it, which makes it a direct path to remote code execution without writing anything to disk. The catch: RFI requires allow_url_include = On in php.ini. This is disabled by default since PHP 5.2 and remains off on virtually every modern installation. The vulnerability is therefore less common than LFI, but when it exists, it is the fastest route to RCE — no log poisoning, no file upload, no race condition.

An XML External Entity Injection (XXE) vulnerability occurs when an application parses attacker-supplied XML with external entity processing enabled. The parser resolves an attacker-defined entity that references a local file, an internal URL, or a remote DTD — turning the XML input into a file-read, SSRF, or RCE primitive. 2026 context: XXE is no longer just a “SOAP endpoint” bug. It lives in document-processing pipelines (DOCX, XLSX, SVG, PDF/XFA), SAML, XSLT transforms, and AI/LLM document loaders. The scanner-bypass research of 2025–2026 shows that even applications that do implement a DOCTYPE filter can be bypassed through encoding tricks (PhpSpreadsheet’s XmlScanner) and parser-differential behaviour.

XML Path Language (XPath) is a query language for selecting nodes from XML documents, used by applications that store or retrieve data in XML — user stores, configuration files, SOAP/SAML backends, and legacy XML databases. When user input is concatenated into an XPath expression without sanitisation, an attacker can rewrite the query’s logic. Because XPath has no privilege model, a successful injection typically exposes the entire document rather than a single row — there is no table-level or column-level access control to stop it.