Defencely Explains HTTP Parameter Contamination
HTTP Parameter Contamination
In terms of application development during the standard phases, multi-tier application architecture is prevalent. The multi-tier architecture is a client-server architecture, where the presentation, the application processing and the data management is a complete separate processes. In basic terms, the multi-tier architecture are convenient for developers. The reason they are convenient for developers is the fact that developers have to re-use code and develop applications in which the whole application framework needn’t have to be written all over again. They could only modify parts of the application architecture based on tiers and profit flexibility in the use of such applications. The unfortunate part is the handling of the same data over multiple platform can lead to security breach, or leave the application vulnerable. Logical errors are triggered this way and are completely different from Injection based attacks such as:
- LDAP/Blind LDAP Injections
- XML Injection
- HTML Injection
- SQL Injection
- ORM based Injection
- Spring Injection/nHibernate Injection
- Xpath Injection
- Command Injection
HTTP Parameter Contamination Beneficial’s
Before I prove the absolute necessity for a manual application test, I must say, highlighting the beneficiaries of this particular vulnerability would be very essential to all of the security community in common. But before that, let’s see how applications are deployed in different ways and treated different way when handled or invoked for a ‘useful task’ to be accomplished. I want the readers to already know the primary basics of application deployment which is why I am taking the talk into the next steps which the reader must be already acquainted with. Web Architecture have become more complex and to keep everything simpler for the developers, the developers add layers (RAD Lifecycle) to re-use functions of those layers but this in itself could introduce security vulnerabilities. The diagram below would illustrate how a general application is deployed for convenience purposes:
In coherence with HTTP Parameter Pollution, which refers to additionally place query strings with the same name manipulating the logic how this newly formed query string is handled by a HTTP Handler of the web-server; there are possibilities HTTP Parameter Contamination attacks which target logical weaknesses of the web-architecture could be harnesses to benefit the attackers. This is where manual penetration testing review is an essential part of any security testing be it an application code review along with web-server logic review or a formal application penetration testing. To really harness the power of HTTP Parameter Contamination, a penetration tester or the attacker must have a deeper know-about of the HTTP and the HTTP Handler they are dealing with. Additionally, an attacker or the web penetration tester must know how HTTP Parameter Pollution attacks could be tested to give security or target an application for their beneficiaries. So what are these beneficiaries?
- HTTP Parameter Contamination could be used to circumvent various Filters, security restrictions or regulations to bypass the Web Application Firewalls.
- HTTP Parameter Contamination could be used by an attacker to benefit from the in-security a HTTP Handler might just throw such as informational application based web-server errors.
- HTTP Parameter Contamination could be used by an attacker in parallel to existing vulnerabilities to bypass security rules and hence exploit these vulnerabilities.
Using the payload: http://127.0.0.1/test.asp?file=.%./shritam_bhowmick.txt
It is possible to bypass the security restrictions which are provided by mod_security and hence accomplish path traversal attacks which were originally never possible. This (Path Traversal) in contrast with HTTP Parameter Contamination made such resilient attacks possible and hence actually manipulated the query somehow in order to accomplish the bypass using how HTTP traffic were handled by the HTTP Handler. This similarly could be used along with MS-SQL Injection wherein an IIS server using MS-SQL Databases could lead to critical compromise and hence cause a severe damage.
Example:
The pattern here to bypass the MS-SQL Injection which had previous security restrictions used HPC or HTTP Parameter Contamination. This could be as well be targeted towards PHP Interpreters.
An example back-end PHP code:
And Perl is no longer bulletproof:
The perl code along with HTTP Parameter Contamination applied gave these results:
Now, that I had proved my point across different application behaving in a different way using HTTP Parameter Contamination payloads, the take-away is to not use developer’s production time to keep them consuming development and rather actually focus on manual penetration test services to mitigate deeper issues which I had dealt with previous in large scale enterprise applications.Please Check Defencely talks about Application Deployment .
Defencely – Un-Breakable
Among application security in India, Defencely is the top playing company which has made it to proving its services globally in little time and with huge success stories to share. Defencely is an application security service provider and now have various services stared apart from application security. This includes:- Web Application Security
- Network Security
- Mobile Security
- Business Logic Security