HTTP parameter pollution

HTTP Parameter Pollution (HPP) is a web application vulnerability exploited by injecting encoded query string delimiters in already existing parameters. The vulnerability occurs if user input is not correctly encoded for output by a web application.[1] This vulnerability allows the injection of parameters into web application-created URLs. It was first brought forth to the public in 2009 by Stefano di Paola and Luca Carettoni, in the conference OWASP EU09 Poland.[1] The impact of such vulnerability varies, and it can range from "simple annoyance" to complete disruption of the intended behavior of a web application. Overriding HTTP parameters to alter a web application's behavior, bypassing input and access validation checkpoints, as well as other indirect vulnerabilities, are possible consequences of a HPP attack.[1]

There is no RFC standard on what should be done when it has passed multiple parameters. HPP could be used for cross channel pollution, bypassing CSRF protection and WAF input validation checks.[2]

Behaviour

When they are passed multiple parameters with the same name, here is how various back ends behave.[3]

Behaviour when "param" is passed the values "val1" & "val2"
Technology Parsing result Example
ASP.NET/IIS All occurrences concatenated with a comma param=val1,val2
ASP/IIS All occurrences concatenated with a comma param=val1,val2
PHP/Apache Last occurrence only param=val2
PHP/Zeus Last occurrence only param=val2
JSP, Servlet/Apache Tomcat First occurrence only param=val1
JSP, Servlet/Oracle Application Server First occurrence only param=val1
JSP, Servlet/Jetty First occurrence only param=val1
IBM Lotus Domino Last occurrence only param=val2
IBM HTTP Server First occurrence only param=val1
mod_perl,libapreq2/Apache First occurrence only param=val1
Perl CGI/Apache First occurrence only param=val1
mod_wsgi (Python)/Apache First occurrence only param=val1
Python/Zope All occurrences in list(array) param=['val1','val2']

Types

Client-side

  • First Order / Reflected HPP[4]
  • Second Order / Stored HPP[4]
  • Third Order / DOM HPP[4]

Server-side

  • Standard HPP[4]
  • Second Order HPP[4]

Prevention

Proper input validation and awareness about web technology on HPP is protection against HTTP Parameter Pollution.[5]

See also

References

  1. ^ a b c Balduzzi et al. 2011, p. 2.
  2. ^ "HTTP Parameter Pollution Vulnerabilities in Web Applications" (PDF). 2011.
  3. ^ "WSTG - Latest:Testing for HTTP Parameter Pollution".
  4. ^ a b c d e Luca Carettoni; Stefano Di Paola. "HTTP Parameter Pollution" (PDF).
  5. ^ "How to Detect HTTP Parameter Pollution Attacks".

Bibliography

Stub icon

This World Wide Web–related article is a stub. You can help Wikipedia by adding missing information.

Content Disclaimer

Informasi ini disarikan dari Wikipedia dan disajikan kembali untuk tujuan edukasi. Konten tersedia di bawah lisensi CC BY-SA 3.0. Kami tidak bertanggung jawab atas ketidakakuratan data yang bersumber dari kontribusi publik tersebut.

  1. The information displayed on this website is sourced in part or in whole from Wikipedia and has been adapted for the purpose of restating it. We strive to provide accurate and relevant information, however:
  2. There is no guarantee of absolute accuracy. Wikipedia is an open, collaborative project that can be edited by anyone, so information is subject to change.
  3. It is not intended to constitute professional advice. The content displayed is for informational and educational purposes only. For important decisions (e.g., medical, legal, or financial), please consult a professional.
  4. Content copyright. Wikipedia is licensed under the Creative Commons Attribution-ShareAlike License (CC BY-SA). This means that content may be reused with appropriate attribution and shared under a similar license.
  5. Responsible use. Any risk arising from the use of information from this website is entirely the responsibility of the user.