CAPEC Definitions

    CAPEC Definitions / CAPEC-460

    CAPEC-460: HTTP Parameter Pollution (HPP)

    An adversary adds duplicate HTTP GET/POST parameters by injecting query string delimiters. Via HPP it may be possible to override existing hardcoded HTTP parameters, modify the application behaviors, access and, potentially exploit, uncontrollable variables, and bypass input validation checkpoints and WAF rules.

    Severity:Medium
    Possibility:

    Extended Description

    No Extended Description.

    Mitigations

    Configuration: If using a Web Application Firewall (WAF), filters should be carefully configured to detect abnormal HTTP requests

    Design: Perform URL encoding

    Implementation: Use strict regular expressions in URL rewriting

    Implementation: Beware of multiple occurrences of a parameter in a Query String

    Relationships with other CAPECs

    CAPEC-15: Command Delimiters

    CAPEC-676: NoSQL Injection

    Prerequisites

    HTTP protocol is used with some GET/POST parameters passed

    Related Weaknesses

    CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

    CWE-147: Improper Neutralization of Input Terminators

    CWE-235: Improper Handling of Extra Parameters