Summary
Supplying multiple HTTP parameters with the same name may cause an application to interpret values in unanticipated ways. By exploiting these effects, an attacker may be able to bypass input validation, trigger application errors or modify internal variables values. As HTTP Parameter Pollution (in short HPP) affects a building block of all web technologies, server and client side at- tacks exist.
Current HTTP standards do not include guidance on how to inter- pret multiple input parameters with the same name. For instance, RFC 3986 simply defines the term Query String as a series of
field-value pairs and RFC 2396 defines classes of reversed and
unreserved query string characters. Without a standard in place, web application components handle this edge case in a variety of ways (see the table below for details).
By itself, this is not necessarily an indication of vulnerability. How- ever, if the developer is not aware of the problem, the presence of duplicated parameters may produce an anomalous behavior in the application that can be potentially exploited by an attacker. GET /index.html HTTP/1.1 host: www.example.com HEAD /index.html HTTP/1.1 host: www.example.com POST /index.html HTTP/1.1 host: www.example.com PUT /index.html HTTP/1.1 host: www.example.com DELETE /index.html HTTP/1.1 host: www.example.com TRACE /index.html HTTP/1.1 host: www.example.com CONNECT /index.html HTTP/1.1 host: www.example.com #!/bin/bash
for webservmethod in GET POST PUT TRACE CONNECT OPTIONS PROPFIND;
do
printf “$webservmethod “ ;
printf “$webservmethod / HTTP/1.1\nHost: $1\n\n” | nc -q 1 $1 80 | grep “HTTP/1.1”
done
As often in security, unexpected behaviors are a usual source of weaknesses that could lead to HTTP Parameter Pollution attacks in this case. To better introduce this class of vulnerabilities and the outcome of HPP attacks, it is interesting to analyze some real-life examples that have been discovered in the past.
Input Validation and filters bypass
In 2009, immediately after the publication of the first research on HTTP Parameter Pollution, the technique received attention from the security community as a possible way to bypass web applica- tion firewalls.
One of these flaws, affecting ModSecurity SQL Injection Core Rules, represents a perfect example of the impedance mismatch between applications and filters.
The ModSecurity filter would correctly blacklist the following string: select 1,2,3 from table, thus blocking this example URL from being processed by the web server: /index.aspx?page=se- lect 1,2,3 from table. However, by exploiting the concatenation of multiple HTTP parameters, an attacker could cause the applica- tion server to concatenate the string after the ModSecurity filter already accepted the input.
As an example, the URL /index.aspx?page=select 1&page=2,3 from table would not trigger the ModSecurity filter, yet the appli- cation layer would concatenate the input back into the full mali- cious string.
Another HPP vulnerability turned out to affect Apple Cups, the well-known printing system used by many UNIX systems. Ex- ploiting HPP, an attacker could easily trigger a Cross-Site Scripting
vulnerability using the following URL: http://127.0.0.1:631/admin
/?kerberos=onmouseover=alert(1)&kerberos. The application val- idation checkpoint could be bypassed by adding an extra kerberos argument having a valid string (e.g. empty string). As the valida- tion checkpoint would only consider the second occurrence, the first kerberos parameter was not properly sanitized before being used to generate dynamic HTML content. Successful exploitation would result in Javascript code execution under the context of the hosting web site.
Authentication bypass
An even more critical HPP vulnerability was discovered in Blogger, the popular blogging platform. The bug allowed malicious users to take ownership of the victim’s blog by using the following HTTP request:
The flaw resided in the authentication mechanism used by the
web application, as the security check was performed on the first blogID parameter, whereas the actual operation used the second occurrence.
Expected Behavior by Application Server
The following table illustrates how different web technologies be- have in presence of multiple occurrences of the same HTTP pa- rameter.
Given the URL and querystring: http://example.com/?color=red&- color=blue
(source: Media:AppsecEU09_CarettoniDiPaola_v0.8.pdf )
How to Test
Luckily, because the assignment of HTTP parameters is typical- ly handled via the web application server, and not the application code itself, testing the response to parameter pollution should be standard across all pages and actions. However, as in-depth busi- ness logic knowledge is necessary, testing HPP requires manual testing. Automatic tools can only partially assist auditors as they tend to generate too many false positives. In addition, HPP can manifest itself in client-side and server-side components.
Server-side HPP
To test for HPP vulnerabilities, identify any form or action that al- lows user-supplied input. Query string parameters in HTTP GET requests are easy to tweak in the navigation bar of the browser. If the form action submits data via POST, the tester will need to use an intercepting proxy to tamper with the POST data as it is sent to the server. Having identified a particular input parameter to test, one can edit the GET or POST data by intercepting the request, or change the query string after the response page loads. To test for HPP vulnerabilities simply append the same parameter to the GET or POST data but with a different value assigned.
For example: if testing the search_string parameter in the query string, the request URL would include that parameter name and value.
http://example.com/?search_string=kittens
The particular parameter might be hidden among several other pa- rameters, but the approach is the same; leave the other parameters in place and append the duplicate.
http://example.com/?mode=guest&search_string=kittens&num_ results=100
Append the same parameter with a different value
Web Application Server Backend
ASP.NET / IIS ASP / IIS PHP / Apache PHP / Zeus
JSP, Servlet / Apache Tomcat JSP, Servlet / Oracle Application Server 10g
JSP, Servlet / Jetty IBM Lotus Domino IBM HTTP Server
mod_perl, libapreq2 / Apache Perl CGI / Apache
mod_wsgi (Python) / Apache Python / Zope
ASP
All occurrences concatenated with a comma
All occurrences concatenated with a comma
Last occurrence only Last occurrence only First occurrence only First occurrence only First occurrence only Last occurrence only First occurrence only First occurrence only First occurrence only First occurrence only All occurrences in List data type JSP color=red,blue color=red,blue color=blue color=blue color=red color=red color=red color=blue color=red color=red color=red color=red color=[‘red’,’blue’] POST /add-authors.do HTTP/1.1 security_token=attackertoken&blogID=attackerblogidvalue &blogID=victimblogidvalue&authorsList=goldshlager19test% 40gmail.com(attacker email)&ok=Invite
In particular, pay attention to responses having HPP vectors with- in data, src, href attributes or forms actions. Again, whether or not this default behavior reveals a potential vulnerability depends on the specific input validation, filtering and application business logic. In ad- dition, it is important to notice that this vulnerability can also affect query string parameters used in XMLHttpRequest (XHR), runtime attribute creation and other plugin technologies (e.g. Adobe Flash’s flashvars variables).
Tools
OWASP ZAP HPP Passive/Active Scanners [1] HPP Finder (Chrome Plugin) [2]
References Whitepapers
• HTTP Parameter Pollution - Luca Carettoni, Stefano di Paola [3] • Split and Join (Bypassing Web Application Firewalls with HTTP Pa-
rameter Pollution) - Lavakumar Kuppan [4]
• Client-side Http Parameter Pollution Example (Yahoo! Classic Mail
flaw) - Stefano di Paola [5]
• How to Detect HTTP Parameter Pollution Attacks - Chrysostomos
Daniel [6]
• CAPEC-460: HTTP Parameter Pollution (HPP) - Evgeny Lebanidze
[7]
• Automated Discovery of Parameter Pollution Vulnerabilities in Web
Applications - Marco Balduzzi, Carmen Torrano Gimenez, Davide Bal- zarotti, Engin Kirda [8]