41

I'm reading about HTTP parameter pollution and I'm confused about one thing. If there is an endpoint like this,

https://security.stackexchange.com/editpost/?postuid=19348

and you tried a HPP attack, that looked like

https://security.stackexchange.com/editpost/?postuid=19348&postuid=1

Wouldn't the backend still try to verfiy that it's your user's post you're trying to edit? through the cookies you send along with the request

Why could this work,

https://security.stackexchange.com/editpost/?postuid=19348&postuid=1

and why can't you just edit the URL like this?

https://security.stackexchange.com/editpost/?postuid=1
Improve this question
1
  • 7
    In general techniques that pollute parameters or headers depends on the implementation of the server. So your problem depends on how your web server handles the parameters.
    – camp0
    Jun 24, 2019 at 12:02

1 Answer 1

Reset to default
78

The idea would be that different parts of the server code interpret the request in different ways, resulting in an application that is vulnerable to HTTP Parameter Pollution.

For your example /editpost/?postuid=19348&postuid=1 the query string would be parsed differently for the code parts that carry out authorization (those would have to check for authorization on postuid=19348) and actual editing (those would have to edit for postuid=1).

This isn't a regular problem in modern web applications because parameter parsing is done by the framework usually, in (modern versions of) php for example, $_GET["postuid"] would contain the same value for both code fragments, making a HTTP PP attack useless.

HTTP PP used to be a big problem (and still is, whenever this is the case) when parameters are parsed "by hand", i.e. on the application logic layer. That opens the door for different people implementing this parsing differently.

Improve this answer
5
  • 1
    Thanks for the easy to understand explanation!
    – Kevin Lance
    Jun 24, 2019 at 20:51
  • 1
    And even if you're parsing parameters in the application logic layer, you'd still have to parse them repeatedly. If you parse your parameters at the start and then pass them along, you should always be working on the same instance of the parameter.
    – Nzall
    Jun 26, 2019 at 15:04
  • Like i said, they have to be parsed differently.
    – Tobi Nary
    Jun 26, 2019 at 15:09
  • So basically only embedded devices nowadays?
    – jaskij
    Jun 26, 2019 at 19:43
  • Not necessarily. The general idea lives on in other attacks where the same named argument is not expected. Also, you could still not use a framework for web development, maybe for efficiency reasons. Or parse the request manually because you implemented something non-Standard.
    – Tobi Nary
    Jun 26, 2019 at 21:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .