|
Naziv
|
HTTP Parameter Pollution (HPP)
|
|
Sažetak
|
An attacker overrides or adds HTTP GET/POST parameters by injecting query string delimiters. Via HPP it may be possible to override existing hardcoded HTTP parameters, modify the application behaviors, access and, potentially exploit, uncontrollable variables, and bypass input validation checkpoints and WAF rules.
|
|
Preduvjeti
|
HTTP protocol is used with some GET/POST parameters passed
|
|
Rješenja
|
Configuration: If using a Web Application Firewall (WAF), filters should be carefully configured to detect abnormal HTTP requests Design: Perform URL encoding Implementation: Use strict regular expressions in URL rewriting Implementation: Beware of multiple occurrences of a parameter in a Query String
|
