A critical XPath injection vulnerability in the XML::Sig library allows unauthenticated attackers to manipulate document digest verification, potentially leading to signature bypass.

The library fails to properly escape or validate the SignedInfo/Reference/@URI value when building XPath expressions. This allows an attacker to inject arbitrary XPath operators, enabling the selection of unintended XML elements during verification.

Successful exploitation allows an attacker to manipulate which nodes are validated, effectively subverting the integrity of XML-based security signatures. Given the 9.1 CVSS score, this represents a significant risk to applications relying on XML::Sig for authentication or data integrity, potentially leading to unauthorized access or data tampering.

Immediate Action: Upgrade to version 0.71 or higher immediately to apply the necessary sanitization logic for XPath expressions.

Proactive Monitoring: Monitor applications using this library for malformed XML input or unexpected XPath processing errors in application logs.

Compensating Controls: If immediate patching is not feasible, implement strict input validation on all XML documents to ensure that URIs conform to expected formats and do not contain malicious characters.

Public Exploit Available: No

This vulnerability presents a high risk to systems relying on XML signatures for secure communication. Security teams should prioritize the update to version 0.71 to prevent potential signature forgery and maintain the integrity of their XML-based workflows.