Web Attacks Using HTTP Parameter Pollution

May 20, 2009

At the OWASP AppSec Poland 2009 web security conference two Italian security experts presented a new kind of web application attack threat. The presentation slides for the method called HTTP Parameter Pollution (HPP) are now available online.

The new attack class adds yet another method to the known ones attackers have used to inject scripts or SQL queries into HTTP GET or POST requests. Security researchers Stefano Di Paola and Luca Carettoni explain the method in their presentation through the assignment of parameter-value pairs.

The multiple parameter definitions in the following HTTP request can lead to unexpected behavior in web applications:

GET /foo?par1=val1&par1=val2 HTTP/1.1

That depends on the web application. Some take the first parameter value, some the second, others concatenate them and still others build an array.

What begins at HTTP servers ends up in frameworks and applications. Di Paola und Carettoni demonstrate the HTTP Parameter Pollution (HPP) effect on the CUPS print system web interface, during a CPAN search and in the Plone web framework. By the estimation of the two security experts, hard-coded variables can be overwritten with an HPP attack to exploit the vulnerabilities of the program. Even web application firewalls (WAFs) and other detection and repair methods could be outfoxed by the HPP attack under circumstances.

Other presentation slides show how an HPP attack interacts with program code and ties HTTP cookies and URL rewriting into the process. Further practical examples describe attacks on ModSecurity, PHPIDS, the Google Search Appliance and other web search engines, as well as Yahoo! Mail Classic.

Countermeasures suggested by Di Paola and Carettoni include applying URL encoding and using strict regular expressions (regex) with URL rewriting. Above all, they suggest being aware of the weaknesses of individual application components and to use strict filtering. The two have published an extensive white paper on the subject. The presentation slides can be downloaded from the Open Web Application Security Project (OWASP) website.

Related content

  • Intrusion 101

    You need to think like an attacker to keep your network safe. We asked security columnist Kurt Seifried for an inside look at the art of intrusion.

  • Honeynet

    Security-conscious admins can use a honeynet to monitor, log, and analyze intrusion techniques.

  • Intrusion Prevention Intro

    This month we look into the intruder's toolkit and investigate some prudent counter-measures for detecting and preventing attacks.

  • OWASP Releases Web-Security Videos

    The Open Web Application Security Project (OWASP) has placed videos of its latest conference online. The open- source project concerns itself with web application security.

  • Attack on SSL Users Discovered, Tool Sources Released

    SSL won't come to a rest: the newest attack isn't about encryption or errors in the Secure Sockets Layer protocol, it's about the weakest link in the chain -- the user.


comments powered by Disqus
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters

Support Our Work

Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.

Learn More