CAPEC-460 HTTP Parameter Pollution (HPP)

An adversary adds duplicate HTTP GET/POST parameters by injecting query string delimiters. Via HPP it may be possible to override existing hardcoded HTTP parameters, modify the application behaviors, access and, potentially exploit, uncontrollable variables, and bypass input validation checkpoints and WAF rules.

1. [Explore] [Find User Input] The adversary finds anywhere in the web application that uses user-supplied input in a form or action. This can also be found by looking at parameters in the URL in the navigation bar of the browser 2. [Experiment] [Add Duplicate Parameter Values] Once the adversary has identified what user input is used as HTTP parameters, they will add duplicates to each parameter one by one to observe the results. If the response from the HTTP request shows the duplicate parameter value concatenated with the original parameter value in some way, or simply just the duplicate parameter value, then HPP is possible. 3. [Exploit] [Leverage HPP] Once the adversary has identified how the backend handles duplicate parameters, they will leverage this by polluting the paramters in a way that benefits them. In some cases, hardcoded parameters will be disregarded by the backend. In others, the adversary can bypass a WAF that might only check a parameter before it has been concatenated by the backend, resulting in malicious queries getting through.

• HTTP protocol is used with some GET/POST parameters passed

• Configuration: If using a Web Application Firewall (WAF), filters should be carefully configured to detect abnormal HTTP requests • Design: Perform URL encoding • Implementation: Use strict regular expressions in URL rewriting • Implementation: Beware of multiple occurrences of a parameter in a Query String