HTTP Parameter Pollution (HPP) is a web application vulnerability exploited by injecting encoded query string delimiters in already existing parameters. The vulnerability occurs if user input is not correctly encoded for output by a web application. This vulnerability allows the injection of parameters into web application-created URLs. It was first brought forth to the public in 2009 by Stefano di Paola and Luca Carettoni, in the conference OWASP EU09 Poland. The impact of such vulnerability varies, and it can range from "simple annoyance" to complete disruption of the intended behavior of a web application. Overriding HTTP parameters to alter a web application's behavior, bypassing input and access validation checkpoints, as well as other indirect vulnerabilities, are possible consequences of a HPP attack.

There is no RFC standard on what should be done when it has passed multiple parameters. HPP could be used for cross channel pollution, bypassing CSRF protection and WAF input validation checks.

Behaviour When they are passed multiple parameters with the same name, here is how various back ends behave. + Behaviour when "param" is passed the values "val1" & "val2" Technology Parsing result Example ASP.NET/IIS All occurrences concatenated with a comma param=val1,val2 ASP/IIS All occurrences concatenated with a comma param=val1,val2 PHP/Apache Last occurrence only param=val2 PHP/Zeus Last occurrence only param=val2 JSP, Servlet/Apache Tomcat First occurrence only param=val1 JSP, Servlet/Oracle Application Server First occurrence only param=val1 JSP, Servlet/Jetty First occurrence only param=val1 IBM Lotus Domino Last occurrence only param=val2 IBM HTTP Server First occurrence only param=val1 mod_perl,libapreq2/Apache First occurrence only param=val1 Perl CGI/Apache First occurrence only param=val1 mod_wsgi (Python)/Apache First occurrence only param=val1 Python/Zope All occurrences in list(array) param=['val1','val2']

Types Client-side First Order / Reflected HPP Second Order / Stored HPP Third Order / DOM HPP

Server-side Standard HPP Second Order HPP

Prevention Proper input validation and awareness about web technology on HPP is protection against HTTP Parameter Pollution.

See also HTTP response splitting HTTP request smuggling

References

Bibliography