HTTP Parameter Pollution
HTTP Parameter Pollution, abbreviated as HPP, occurs because different web containers handle multiple identical parameters in various ways, which can lead to the potential bypassing of certain defenses.
HPP is not a vulnerability itself, but in cases where a website has SQL injection or XSS vulnerabilities and is protected by a WAF, it may be possible to bypass the WAF using this method.
Consider this URL:http://www.xxxx.com/search.php?id=110&id=911
Baidu interprets it as a search for: 110 # selects the first parameter, ignoring the second parameter.
Yahoo interprets it as a search for: 911 # selects the second parameter, ignoring the first parameter.
Google interprets it as a search for: 110 911 # both parameters are selected simultaneously.
These are the three main interpretations.
This mainly arises from the fact that different websites have different methods for handling parameters.
Effects of HTTP Parameter Pollution
The dangers of HPP may include the ability to bypass certain firewall rules, as the parameters obtained by the firewall may not match those obtained by the application, allowing for the circumvention of some WAF rules. Of course, if the parameters include actions related to operations, it may also be used for privilege escalation.
Preventing HPP is relatively simple; before assembling the URL, URL-encode the input values, which means using the hexadecimal value of the character prefixed by %.
HTTP Parameter Handling
|
Web Server |
Parameter Retrieval Function |
Retrieved Parameter |
|
PHP/Apache |
$_GET(“par”) |
Last |
|
JSP/Tomcat |
Request.getParameter(“par”) |
First |
|
Perl(CGI)/Apache |
Param(“par”) |
First |
|
Python/Apache |
Getvalue(“par”) |
All(List) |
|
ASP/IIS |
Request.QueryString(“par”) |
All(comma-delimited string) |