Malicious data is deliberately crafted input intended to exploit an application’s parsing, processing, or business logic. It can include SQL statements or execution commands that cause serious damage when accepted by a server. section 3.3
Client-side validation cannot establish trust: users can call backend APIs with any client, and attackers may send crafted requests directly. Treat every incoming value—and data from APIs, services, responses, and databases—as untrusted. section 3.3
An indirect injection through identity data
A threat actor places malicious code in an external identity provider profile. When the actor registers, the application imports the profile and executes the code against its database, potentially dropping the users table.
Reduce exposure and improve investigation by:
- Validate all data at server boundaries, regardless of origin, and enforce the constraints required by each data model. section 3.3
- Record suspicious requests, injection indicators, 401/403 and 400/422 responses, unusual latency, headers, bodies, and full URLs when appropriate. section 11.5
