It occurs when an application interprets the values of duplicate HTTP request parameters in unintended ways.
The current HTTP standard does not provide any information on how duplicate parameters should be handled, which allows clients to submit requests containing duplicates of the same parameter without causing an error. These extra parameters are sent to the server as a means to "pollute" the request, in an attempt to bypass application protections. Note that an HPP attack can affect both client-side and server-side components.
Consider the following URL that uses two query string parameters to accept a user's first and last name, which will be sent to the server:
The application interprets these two parameters as separate entities containing their own values; "FirstName" will be mapped to the value "Value 1", and "LastName" will map to the value "Value2". Now consider the same URL with the parameter "FirstName" included twice, with two different values:
The manner in which duplicate parameters are parsed depends on the web technology and web server in use. Consider the following examples:
ASP.NET in IIS: the values from all duplicate parameters are concatenated, separated by a comma
PHP in Apache: only the last value is taken from a set of duplicate parameters
Perl CGI in Apache: only the first value is taken from a set of duplicate parameters
Since different technologies handle parameter pollution differently, the issue typically exists if the values from repeat parameters are concatenated together or an error occurs when duplicate parameters are passed.
An In-depth approach to testing this vulnerability can be found here: