Your company decides to start the business of selling toys online and shipping globally. The software development is conducting threat modeling and identifies a misuse case that an attacker can manipulate the backend database by sending XML messages through HTTP POST. Which of the following vulnerability should be fixed first?
A. SQL Injection
B. XML External Entities (XEE)
C. Broken Authentication
D. Cross-Site Request Forgery (CSRF)
Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.
My suggested answer is B. XML External Entities (XEE).
- Web services may be subject to XML External Entities (XEE) attack, one type of injection. If sending XML messages can manipulate the database, it’s a proven flaw that must be corrected immediately.
- “Sending XML messages through HTTP POST” implies sending HTTP requests to a back-end service with application programming interfaces (APIs) as an entry point to the system. Broken Authentication is a common flaw in APIs. However, not every API requires authentication, e.g., the login API. XML External Entities (XEE) attacks apply both to authenticated and unauthenticated requests.
- The database in this question is not necessarily the SQL database.
- Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application with authenticated sessions. This attack is triggered by the end user, not initiated by the attacker.