XML Signature Wrapping
An attack technique targeting XML-based digital signature verification. By retaining legitimate signature nodes and inserting structurally similar forged nodes, it induces business logic to read tampered content.
Timeline (last 90 days)
The root cause of XML Signature Wrapping attacks lies in the ambiguity between node references under XPath semantics and actual processing paths in XML documents, allowing attackers to inject forged assertion nodes so that signature validation passes while the effective identity is tampered with.
In an XML Signature Wrapping (XSW) attack, the attacker inserts a forged assertion into the document while preserving the original legitimate signature node, causing the verification logic to check the signed portion while the application logic uses the forged portion.
All Facts (2)
The root cause of XML Signature Wrapping attacks lies in the ambiguity between node references under XPath semantics and actual processing paths in XML documents, allowing attackers to inject forged assertion nodes so that signature validation passes while the effective identity is tampered with.
50%UnverifiedIn an XML Signature Wrapping (XSW) attack, the attacker inserts a forged assertion into the document while preserving the original legitimate signature node, causing the verification logic to check the signed portion while the application logic uses the forged portion.
50%