CAPEC-460

Detailed Abstraction Level
Meta — Very abstract, high-level category
Standard — Specific enough to understand
Detailed — Tied to specific technique Draft MITRE CAPEC Status
Stable — Fully reviewed and complete
Draft — Under development
Incomplete — Partially defined
Deprecated — No longer recommended
Obsolete — Replaced by another CAPEC Severity: Medium
HTTP Parameter Pollution (HPP)

Description

An adversary adds duplicate HTTP GET/POST parameters by injecting query string delimiters. Via HPP it may be possible to override existing hardcoded HTTP parameters, modify the application behaviors, access and, potentially exploit, uncontrollable variables, and bypass input validation checkpoints and WAF rules.

Prerequisites

HTTP protocol is used with some GET/POST parameters passed

Mitigations

Configuration: If using a Web Application Firewall (WAF), filters should be carefully configured to detect abnormal HTTP requests

Design: Perform URL encoding

Implementation: Use strict regular expressions in URL rewriting

Implementation: Beware of multiple occurrences of a parameter in a Query String