Login
Login

HTTP parameter pollution

{{short description|Web security vulnerability}}

{{HTTP}}

HTTP Parameter Pollution (HPP) is a web application vulnerability exploited by injecting encoded query string delimiters in already existing parameters. The vulnerability occurs if user input is not correctly encoded for output by a web application.{{Sfn|Balduzzi|Torrano-Gimenez|Carmen|Kirda|2011|p=2}} This vulnerability allows the injection of parameters into web application-created URLs. It was first brought forth to the public in 2009 by Stefano di Paola and Luca Carettoni, in the conference OWASP EU09 Poland.{{Sfn|Balduzzi|Torrano-Gimenez|Carmen|Kirda|2011|p=2}} The impact of such vulnerability varies, and it can range from "simple annoyance" to complete disruption of the intended behavior of a web application. Overriding HTTP parameters to alter a web application's behavior, bypassing input and access validation checkpoints, as well as other indirect vulnerabilities, are possible consequences of a HPP attack.{{Sfn|Balduzzi|Torrano-Gimenez|Carmen|Kirda|2011|p=2}}

There is no RFC standard on what should be done when it has passed multiple parameters. HPP could be used for cross channel pollution, bypassing CSRF protection and WAF input validation checks.{{cite web|url=http://www.madlab.it/slides/BHEU2011/whitepaper-bhEU2011.pdf|title=HTTP Parameter Pollution Vulnerabilities in Web Applications|date=2011}}

Behaviour

When they are passed multiple parameters with the same name, here is how various back ends behave.{{cite web|title=WSTG - Latest:Testing for HTTP Parameter Pollution|url=https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/04-Testing_for_HTTP_Parameter_Pollution}}

class="wikitable"

|+ Behaviour when "param" is passed the values "val1" & "val2"

TechnologyParsing resultExample
ASP.NET/IISAll occurrences concatenated with a commaparam=val1,val2
ASP/IISAll occurrences concatenated with a commaparam=val1,val2
PHP/ApacheLast occurrence onlyparam=val2
PHP/ZeusLast occurrence onlyparam=val2
JSP, Servlet/Apache TomcatFirst occurrence onlyparam=val1
JSP, Servlet/Oracle Application ServerFirst occurrence onlyparam=val1
JSP, Servlet/JettyFirst occurrence onlyparam=val1
IBM Lotus DominoLast occurrence onlyparam=val2
IBM HTTP ServerFirst occurrence onlyparam=val1
mod_perl,libapreq2/ApacheFirst occurrence onlyparam=val1
Perl CGI/ApacheFirst occurrence onlyparam=val1
mod_wsgi (Python)/ApacheFirst occurrence onlyparam=val1
Python/ZopeAll occurrences in list(array)param=['val1','val2']

Types

=Client-side=

  • First Order / Reflected HPP{{cite web|url=https://owasp.org/www-pdf-archive/AppsecEU09_CarettoniDiPaola_v0.8.pdf|title=HTTP Parameter Pollution|author1=Luca Carettoni |author2=Stefano Di Paola }}
  • Second Order / Stored HPP
  • Third Order / DOM HPP

=Server-side=

  • Standard HPP
  • Second Order HPP

Prevention

Proper input validation and awareness about web technology on HPP is protection against HTTP Parameter Pollution.{{cite web|url=https://www.acunetix.com/blog/whitepaper-http-parameter-pollution|title=How to Detect HTTP Parameter Pollution Attacks}}

See also

References

{{reflist}}

Category:Hypertext Transfer Protocol

Category:Internet security

Category:Computer security exploits

Bibliography

  • {{Cite conference|last1=Balduzzi|first1=Marco|last2=Torrano-Gimenez|first2=Carmen|last3=Balzarotti|first3=Davide|last4=Kirda|first4=Engin|date=2011|title=Automated Discovery of Parameter Pollution Vulnerabilities in Web Applications|url=https://www.researchgate.net/publication/221655534|conference=Proceedings of the Network and Distributed System Security Symposium, NDSS 2011|ref=CITEREFBalduzziTorrano-GimenezCarmenKirda2011|via=ResearchGate}}

{{Web-stub}}