Web Attacks Using HTTP Parameter Pollution
At the OWASP AppSec Poland 2009 web security conference two Italian security experts presented a new kind of web application attack threat. The presentation slides for the method called HTTP Parameter Pollution (HPP) are now available online.
The new attack class adds yet another method to the known ones attackers have used to inject scripts or SQL queries into HTTP GET or POST requests. Security researchers Stefano Di Paola and Luca Carettoni explain the method in their presentation through the assignment of parameter-value pairs.
The multiple parameter definitions in the following HTTP request can lead to unexpected behavior in web applications:
GET /foo?par1=val1&par1=val2 HTTP/1.1
That depends on the web application. Some take the first parameter value, some the second, others concatenate them and still others build an array.
What begins at HTTP servers ends up in frameworks and applications. Di Paola und Carettoni demonstrate the HTTP Parameter Pollution (HPP) effect on the CUPS print system web interface, during a CPAN search and in the Plone web framework. By the estimation of the two security experts, hard-coded variables can be overwritten with an HPP attack to exploit the vulnerabilities of the program. Even web application firewalls (WAFs) and other detection and repair methods could be outfoxed by the HPP attack under circumstances.
Other presentation slides show how an HPP attack interacts with program code and ties HTTP cookies and URL rewriting into the process. Further practical examples describe attacks on ModSecurity, PHPIDS, the Google Search Appliance and other web search engines, as well as Yahoo! Mail Classic.
Countermeasures suggested by Di Paola and Carettoni include applying URL encoding and using strict regular expressions (regex) with URL rewriting. Above all, they suggest being aware of the weaknesses of individual application components and to use strict filtering. The two have published an extensive white paper on the subject. The presentation slides can be downloaded from the Open Web Application Security Project (OWASP) website.
Comments
comments powered by DisqusSubscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
Canonical Bumps LTS Support to 12 years
If you're worried that your Ubuntu LTS release won't be supported long enough to last, Canonical has a surprise for you in the form of 12 years of security coverage.
-
Fedora 40 Beta Released Soon
With the official release of Fedora 40 coming in April, it's almost time to download the beta and see what's new.
-
New Pentesting Distribution to Compete with Kali Linux
SnoopGod is now available for your testing needs
-
Juno Computers Launches Another Linux Laptop
If you're looking for a powerhouse laptop that runs Ubuntu, the Juno Computers Neptune 17 v6 should be on your radar.
-
ZorinOS 17.1 Released, Includes Improved Windows App Support
If you need or desire to run Windows applications on Linux, there's one distribution intent on making that easier for you and its new release further improves that feature.
-
Linux Market Share Surpasses 4% for the First Time
Look out Windows and macOS, Linux is on the rise and has even topped ChromeOS to become the fourth most widely used OS around the globe.
-
KDE’s Plasma 6 Officially Available
KDE’s Plasma 6.0 "Megarelease" has happened, and it's brimming with new features, polish, and performance.
-
Latest Version of Tails Unleashed
Tails 6.0 is based on Debian 12 and includes GNOME 43.
-
KDE Announces New Slimbook V with Plenty of Power and KDE’s Plasma 6
If you're a fan of KDE Plasma, you'll be thrilled to hear they've announced a new Slimbook with an AMD CPU and the latest version of KDE Plasma desktop.
-
Monthly Sponsorship Includes Early Access to elementary OS 8
If you want to get a glimpse of what's in the pipeline for elementary OS 8, just set up a monthly sponsorship to help fund its continued existence.
greenatmos
We have just added your latest post "Web Attacks Using HTTP Parameter Pollution - Linux Magazine Online" to our <a href="http://www.greenatmos.com"> Directory of Environment </a> . You can check the inclusion of the post <a href="http://greenatmos.com/story...inux-magazine-online"> here </a> . We are delighted to invite you to submit all your future posts to the <a href="http://www.greenatmos.com"> directory </a> for getting a huge base of visitors to your website and gaining a valuable backlink to your site.
Warm Regards
greenatmos.com Team
http://www.greenatmos.com