41

I'm reading about HTTP parameter pollution and I'm confused about one thing. If there is an endpoint like this,

https://security.stackexchange.com/editpost/?postuid=19348

and you tried a HPP attack, that looked like

https://security.stackexchange.com/editpost/?postuid=19348&postuid=1

Wouldn't the backend still try to verfiy that it's your user's post you're trying to edit? through the cookies you send along with the request

Why could this work,

https://security.stackexchange.com/editpost/?postuid=19348&postuid=1

and why can't you just edit the URL like this?

https://security.stackexchange.com/editpost/?postuid=1
  • 7
    In general techniques that pollute parameters or headers depends on the implementation of the server. So your problem depends on how your web server handles the parameters. – camp0 Jun 24 at 12:02
78

The idea would be that different parts of the server code interpret the request in different ways, resulting in an application that is vulnerable to HTTP Parameter Pollution.

For your example /editpost/?postuid=19348&postuid=1 the query string would be parsed differently for the code parts that carry out authorization (those would have to check for authorization on postuid=19348) and actual editing (those would have to edit for postuid=1).

This isn't a regular problem in modern web applications because parameter parsing is done by the framework usually, in (modern versions of) php for example, $_GET["postuid"] would contain the same value for both code fragments, making a HTTP PP attack useless.

HTTP PP used to be a big problem (and still is, whenever this is the case) when parameters are parsed "by hand", i.e. on the application logic layer. That opens the door for different people implementing this parsing differently.

  • 1
    Thanks for the easy to understand explanation! – Kevin Lance Jun 24 at 20:51
  • 1
    And even if you're parsing parameters in the application logic layer, you'd still have to parse them repeatedly. If you parse your parameters at the start and then pass them along, you should always be working on the same instance of the parameter. – Nzall Jun 26 at 15:04
  • Like i said, they have to be parsed differently. – Tobi Nary Jun 26 at 15:09
  • So basically only embedded devices nowadays? – Jan Dorniak Jun 26 at 19:43
  • Not necessarily. The general idea lives on in other attacks where the same named argument is not expected. Also, you could still not use a framework for web development, maybe for efficiency reasons. Or parse the request manually because you implemented something non-Standard. – Tobi Nary Jun 26 at 21:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.