This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit

OWASP Periodic Table of Vulnerabilities - Routing Detour

Revision as of 06:38, 7 June 2013 by Peter Mosmans (talk | contribs) (initial page setup)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Return to Periodic Table Working View

Routing Detour

Root Cause Summary

This is a man in the middle type of attack, where (XML) content processors can be injected to route sensitive information to an attacker-controlled outside location. The attacker can modify the contents of the package and send it back to the original processor, unaware of the modifications.

Browser / Standards Solution

Perimeter Solution

Use SSL/TLS for connections between all trusted locations, and verify each host.

Generic Framework Solution

Custom Framework Solution

Custom Code Solution

Discussion / Controversy

This is actually a type of attack and not a vulnerability


XML Routing Detour Attacks (MITRE)
Routing Detour (WASC)