Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Is this a false positive? (sql / xpath injection)

Liz | Last updated: Feb 19, 2020 03:27PM UTC

Google brought me here. This previous post from 2015 seems similar to what I'm experiencing: https://forum.portswigger.net/thread/probable-bug-sql-injection-avoidable-false-positive-d1e55f31 Basically I have two vulnerabilities showing up, one for xpath and one for sql injection. We don't use XML or xpath for anything, but the string 'xpath' happens to appear in our session token cookie in one of the responses, ex: Set-Cookie: XSRF-TOKEN=eyJpdiI6Indwemc3K2pcL3B4Qm9PZkVESFNZMzhnPT0iLCJ2YWx1ZSI6IjhtbnZjYlIrYzhtd1RcL1RmRVhtVVFrOHBtM0xFaEtUVDNUNHdZdytWXC85TXRRanBwQWJUZTVsa0xPaThvc3IySiIsIm1hYyI6IjgwYmQ0NjBjMTI0MmNmOTEwZGI2YjQzOTNjMjc3ZjkyNDYzODhkMGQ3MDdjMzE3OGIwMTMzNzNhYTg5ZTNiNGYifQ%3D%3D; expires=Sun, 16-Feb-2020 21:53:42 GMT; Max-Age=7200; path=/; secure; httponly Note 'xPaTh' buried in the base 64 encoded string. Similarly on a SQL injection test, the word "FAiL" is buried in the base 64 encoded token Set-Cookie: XSRF-TOKEN=eyJpdiI6IldTM1pDMmZiU1JJazBXY2RaV3ppMnc9PSIsInZhbHVlIjoicWdnVXVuTVB5QXpKbHNXdlp3NUtkUnVlWlpCdE1ocytRRVwvVEExc0tETTBHZ0Q1WnlldnV4dDRyWTNqTmdoMFAiLCJtYWMiOiI4Njc2ZTQzOTJhNmE1ZTU1MWZhOTE1Njg3NjEyOTI5ZGNjZWZmY2NkYTM0NzcwNDBlNWQwNDcwNTdiNDQ0NjVlIn0%3D; expires=Fri, 14-Feb-2020 21:05:53 GMT; Max-Age=7200; path=/; secure; httponly and is being flagged as a High as well. Just looking for reassurance that these are in fact, false positives.

Uthman, PortSwigger Agent | Last updated: Feb 20, 2020 02:57PM UTC

Hi Liz, Both look like false positives, and the post you have mentioned explains it perfectly well. I would suggest manually testing any of the vulnerabilities reported by Burp though. If you are certain XML data is not used by your application, you can be almost sure that the XPath injection vulnerability is a false positive since it is just coincidentally displaying the string "xPaTh' in the response. As mentioned in the article, however, this could actually happen. The SQL response looks similar too. Let me know if you need any further assistance!

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.