Exploiting Server-Side Parameter Pollution in Query Strings — An API Hacking Tale
1 min read
Summary
This article presents a proof of concept for exploiting server-side parameter pollution (SSPP) to gain unauthorised access to an administrator account.
The attack begins with intercepting a request to the target endpoint /forgot-password using the BurpSuite interception proxy and sending it to the Repeater tool.
Analysis of the JavaScript code for the forgotPassword.js file reveals that the reset token is obtained from a URL parameter and reused for token-based authentication, which implies SSPP.
The intruder tool is then used to brute-force injection of various field parameters in the POST body of the request, which reveals the reset_token as a valid parameter.
The attacker can then reset the administrator’s password and login to the system to perform actions such as deleting other users.
This real-world bug demonstrates the importance of correctly parsing and validating user input in API server-side logic.
Attacks like this can be prevented with input validation, secure API design, and security testing.