This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Parameter Delimiter"
(Reverting to last version not containing links to s1.shard.jp) |
|||
| (22 intermediate revisions by 4 users not shown) | |||
| Line 1: | Line 1: | ||
{{Template:Attack}} | {{Template:Attack}} | ||
| + | <br> | ||
| + | [[Category:OWASP ASDR Project]] | ||
| + | |||
| + | |||
| + | Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}''' | ||
==Description== | ==Description== | ||
| + | This attack is based on the manipulation of parameter delimiters used by web application input vectors in order to cause unexpected behaviors like access control and authorization bypass and information disclosure, among others. | ||
| − | + | ==Risk Factors== | |
| − | + | TBD | |
==Examples == | ==Examples == | ||
| + | In order to illustrate this vulnerability, we will use a vulnerability found on Poster V2, a posting system based on PHP programming language. | ||
| − | + | This application has a dangerous vulnerability that allows inserting data into user fields (username, password, email address and privileges) in “mem.php” file, which is responsible for managing the application user. | |
| − | |||
| − | This application has a dangerous vulnerability that allows inserting data into user fields (username, password, email address and privileges) in “mem.php” file, which is responsible for managing application user. | ||
An example of the file “mem.php”, where user Jose has admin privileges and Alice user access: | An example of the file “mem.php”, where user Jose has admin privileges and Alice user access: | ||
| Line 19: | Line 24: | ||
?> | ?> | ||
| − | When a user wants to edit his profile, he must use edit account” option in the “index.php” page and enter his login information. However, using “|” as a parameter delimiter on email field followed by “admin”, the user could elevate his privileges to administrator. Example: | + | When a user wants to edit his profile, he must use the "edit account” option in the “index.php” page and enter his login information. However, using “|” as a parameter delimiter on email field followed by “admin”, the user could elevate his privileges to administrator. Example: |
Username: Alice | Username: Alice | ||
| Line 31: | Line 36: | ||
In this case, the last parameter delimiter considered is “|admin|” and the user could elevate his privileges by assigning administrator profile. | In this case, the last parameter delimiter considered is “|admin|” and the user could elevate his privileges by assigning administrator profile. | ||
| − | Although this vulnerability doesn’t allow manipulation of | + | Although this vulnerability doesn’t allow manipulation of other users' profiles, it allows privilege escalation for application users. |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | [[:Category: | + | ==Related [[Threat Agents]]== |
| + | * [[:Category: Authorization]] | ||
| + | * [[:Category: Command Execution]] | ||
| + | ==Related [[Attacks]]== | ||
| + | * [[:Category:Injection Attack]] | ||
| − | ==Related | + | ==Related [[Vulnerabilities]]== |
| + | * [[:Category: Input Validation Vulnerability]] | ||
| − | [[:Category: Input Validation | + | ==Related [[Controls]]== |
| + | * [[:Category: Input Validation]] | ||
| + | ==References== | ||
| + | * http://cwe.mitre.org/data/definitions/141.html | ||
| + | * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0307 | ||
| − | |||
| − | [[:Category: | + | [[Category:Injection]] |
| + | [[Category:Attack]] | ||
Latest revision as of 12:50, 3 June 2009
- This is an Attack. To view all attacks, please see the Attack Category page.
Last revision (mm/dd/yy): 06/3/2009
Description
This attack is based on the manipulation of parameter delimiters used by web application input vectors in order to cause unexpected behaviors like access control and authorization bypass and information disclosure, among others.
Risk Factors
TBD
Examples
In order to illustrate this vulnerability, we will use a vulnerability found on Poster V2, a posting system based on PHP programming language.
This application has a dangerous vulnerability that allows inserting data into user fields (username, password, email address and privileges) in “mem.php” file, which is responsible for managing the application user.
An example of the file “mem.php”, where user Jose has admin privileges and Alice user access:
<? Jose|12345678|[email protected]|admin| Alice|87654321|[email protected]|normal| ?>
When a user wants to edit his profile, he must use the "edit account” option in the “index.php” page and enter his login information. However, using “|” as a parameter delimiter on email field followed by “admin”, the user could elevate his privileges to administrator. Example:
Username: Alice Password: 87654321 Email: [email protected] |admin|
This information will be recorded in “mem.php” file like this:
Alice|87654321|[email protected]|admin|normal|
In this case, the last parameter delimiter considered is “|admin|” and the user could elevate his privileges by assigning administrator profile.
Although this vulnerability doesn’t allow manipulation of other users' profiles, it allows privilege escalation for application users.
