So I'm pen-testing a web application. Upon submitting certain data it sends it in a POST request which contains the data in a JSON object. So while fuzzing it I was testing for improper encoding handling. Sure enough when sending a unicode character in the format \u2030 I get a response from the server complaining about the bogus data.

However, when it tells me what I sent to it instead of having the character per mille which is what \u2030 is I get this JSON object containing three separate characters for the unicode character I entered:

{"success": false, "errorcode": 1, 
"errormessage": "Section 'init' or action 'ȃ0' is invalid"}

The ȃ0' is invalid part being the part of interest. I'm curious as to whether or not this may reveal a potential security risk in the form of a buffer overflow because one of the 3 bytes comprising the unicode character could be interpreted as a null byte then having more data after it that will overwrite other memory.

Any info, advice, etc would be great. Thanks.

EDIT: It just occurred to me that Burp, which I'm using to intercept the response, may be incorrectly displaying the unicode character when the server responds with it. Is this a known bug?

  • 1
    If you suspect a bug in BURP, I recommend reaching out to Portswigger.
    – Jeroen
    Jun 4 '18 at 4:22
  • Do you know what language the server application is written in?
    – Anders
    Jun 4 '18 at 8:12
  • @Anders Based on the error messages I've gotten back from other tests I would say JavaScript Jun 4 '18 at 9:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.