3

In HTTP Parameter Pollution, I know theory how it work; you inject multiple HTTP parameters with the same name to trigger bugs in the server, but I can't understand how one can exploit this.

When I send some request using this technique and for example I know that the server is using last occurrence of parameter, how this technique can be useful, because no matter what, server this uses last occurrence, so it doesn't matter what were other occurrences right? Or when server does concatenate parameters with same name, some server script will get concatenated result.

Improve this question
1
  • The bottom line is that some implementations only filter parameters once, so an attack using repeated values can succeed.
    – postoronnim
    Commented Nov 18, 2019 at 19:27

2 Answers 2

Reset to default
2

HTTP parameter pollution is an attack which exploits a different interpretation between parameter validation and parameter use. For example in case of foo=innocent&foo=some-sql-injection the validation inside a Web Application Firewall or inside the web application itself might extract the first value innocent as the parameter value and do some security checks on it. The actual use of this parameter inside the web application might though take the second value some-sql-injection instead.

The attack pattern of exploiting interpretation differences is not unique to HTTP parameter pollution. It can be for example done with HTTP header fields (which Content-length header is the correct when two are given?) as in HTTP cache poisoning or HTTP smuggling or with XML signatures in XML signature wrapping attacks.

Improve this answer
2
  • So it all depends on implementation, like if which occurrence is server using and also on how application is working with parameters? Because I probably imagine it wrong way, but in case of foo=innocent&foo=some-sql-injection, when app extracts first argument, it works only with that argument, so that sql-injection might be ignored.
    – Martin Sutovsky
    Commented Nov 18, 2019 at 19:46
  • 1
    @MartinSutovsky: yes, it depends on the specific implementations. An exploit is possible if the validation checks a different value compared to the one which gets actually get used later. A proper validation would better make sure that the parameter is used only once if it is expected only once by the application.
    – Steffen Ullrich
    Commented Nov 18, 2019 at 19:54
1

It occurs when an application interprets the values of duplicate HTTP request parameters in unintended ways.

The current HTTP standard does not provide any information on how duplicate parameters should be handled, which allows clients to submit requests containing duplicates of the same parameter without causing an error. These extra parameters are sent to the server as a means to "pollute" the request, in an attempt to bypass application protections. Note that an HPP attack can affect both client-side and server-side components.

Consider the following URL that uses two query string parameters to accept a user's first and last name, which will be sent to the server: http://example.com/test?Parameter1=Value1&LastName=Value2 The application interprets these two parameters as separate entities containing their own values; "FirstName" will be mapped to the value "Value 1", and "LastName" will map to the value "Value2". Now consider the same URL with the parameter "FirstName" included twice, with two different values: http://example.com/test?FirstName=Value1&LastName=Value2&FirstName=Value3 The manner in which duplicate parameters are parsed depends on the web technology and web server in use. Consider the following examples: ASP.NET in IIS: the values from all duplicate parameters are concatenated, separated by a comma PHP in Apache: only the last value is taken from a set of duplicate parameters Perl CGI in Apache: only the first value is taken from a set of duplicate parameters Since different technologies handle parameter pollution differently, the issue typically exists if the values from repeat parameters are concatenated together or an error occurs when duplicate parameters are passed.

An In-depth approach to testing this vulnerability can be found here: https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_(OTG-INPVAL-004)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .