Server-side parameter pollution in a constructed request
An outer input injects or alters parameters in a server-created downstream request.
Candidate CWE: CWE-235
Test hypothesis#
Trace an observed service call to a local stub. Submit one outer value containing a controlled delimiter marker and compare the downstream request with normal and correctly encoded controls. Use a source-confirmed synthetic field to establish changed policy semantics.
Evidence required#
Outer request bytes, decoding and concatenation order, actual downstream parameter map, and a controlled action/data boundary crossed. Distinguish input delimiter injection from merely providing a documented extra top-level parameter.
Rule out false positives#
A marker remaining inside one correctly encoded value, an intentionally supported parameter, or changed output without an observed downstream request boundary is not enough.
Playbook and command references#
- Request values: duplicate parameters, parser conflicts and downstream queries — Trace the value a security layer validates through to the value the application or downstream service actually consumes.
- Trace input into queries, commands, and templates — Prove interpretation at a specific sink using small paired experiments instead of payload spraying.
Find the associated command snippets
Referenced by these target playbooks#
Report checklist#
- Capture the affected version, configuration, identities, and object ownership.
- Preserve a valid baseline and a negative control.
- Reproduce the forbidden data access, action, or state change on controlled fixtures.
- Explain the intended security rule and why the observed behavior violates it.
- State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.
Conditional ATT&CK mapping#
No direct ATT&CK mapping selected. Record the weakness and demonstrated impact without forcing an adversary-behavior classification. See the mapping guide.