CAPEC-460 - HTTP Parameter Pollution (HPP)

An attacker overrides or adds HTTP GET/POST parameters by injecting query string delimiters. Via HPP it may be possible to override existing hardcoded HTTP parameters, modify the application behaviors, access and, potentially exploit, uncontrollable variables, and bypass input validation checkpoints and WAF rules.






HTTP protocol is used with some GET/POST parameters passed

Any tool that enables intercepting and tampering with HTTP requests

Configuration: If using a Web Application Firewall (WAF), filters should be carefully configured to detect abnormal HTTP requests
Design: Perform URL encoding
Implementation: Use strict regular expressions in URL rewriting
Implementation: Beware of multiple occurrences of a parameter in a Query String