I'm currently running vulnerability scans against my application, which is based on Drupal. One "High" vulnerability is HTTP Parameter Pollution (HPP), and it has to do with pages that make use of drupal's theme_pager().
I know that it could indeed be (and probably is) a false-positive, but I need to be able to understand why it isn't a vulnerability so that I can remediate the scanning report. I'm hoping that someone with more security experience than I can help.
The found vulnerability is as follows (I'll use drupal.org in this example):
- Visit a url that has a pager on it:
- Append a useless query parameter+value to the url such as %26foo%3dbar (or &foo=bar , I'm not sure if it actually matters)
- The "vulnerability", as I understand it, is that the pager link URLs (1,2,3,4,etc) all contain the &foo=bar param.
The actual scan output was as follows:
Vulnerability description This script is possibly vulnerable to HTTP Parameter Pollution > attacks.
HPP attacks consist of injecting encoded query string delimiters into other existing parameters. If the web application does not properly sanitize the user input, a malicious user can compromise the logic of the application to perform either clientside or server-side attacks.
This vulnerability affects /. Discovered by: Scripting (HTTP_Parameter_Pollution.script).
Path Fragment input / was set to qui&n950086=v982658 Parameter precedence: last occurrence Affected link: /search/node/qui?page=1&n950086=v982658 Affected parameter: page=1
Request GET /search/node/qui%26n950086%3dv982658
So my question is two-fold: Should this be considered a false-positive? How is Drupal protecting itself from HPP?