HTTP parameter pollution

In a nutshell

HTTP Parameter Pollution (HPP) is a web application vulnerability exploited by injecting encoded query string delimiters in already existing parameters. The vulnerability occurs if user input is not correctly encoded for output by a web application. This vulnerability allows the injection of parameters into web application-created URLs. It was first brought forth to the public in 2009 by Stefano di Paola and Luca Carettoni, in the conference OWASP EU09 Poland. The impact of such vulnerability varies, and it can range from "simple annoyance" to complete disruption of the intended behavior of a web application. Overriding HTTP parameters to alter a web application's behavior, bypassing input and access validation checkpoints, as well as other indirect vulnerabilities, are possible consequences of a HPP attack.

Related on Lably

Through Web application, Delimiter and Parameter

Lab · Class 10–12Recommendation Engine Lab · Class 6–12AI & Python Builds (Medha AI)Lab · Class 11–12Databases & SQL

There is no RFC standard on what should be done when it has passed multiple parameters. HPP could be used for cross channel pollution, bypassing CSRF protection and WAF input validation checks.

Behaviour

When they are passed multiple parameters with the same name, here is how various back ends behave.

2 more chapters are free with a Lably account.

More in Computing and communication

ISBNUnique numeric book identifier since 1970 X (social network)American social networking service Wayback MachineDigital archive by the Internet Archive Python (programming language)General-purpose programming language MacOSOperating system for Apple computers UnicodeCharacter encoding standard

HTTP parameter pollution

Behaviour

Types

Client-side

Server-side

Prevention

More in Computing and communication