the-web-application-hackers-handbook

Chapter 13 n Attacking Users: Other Techniques 549
Within the inbox, several links are displayed next to each message to perform
actions such as delete, forward, and reply. For example, the link to reply to message
number 12 is as follows:
reply
Several parameters within these links are being copied from parameters in
the inbox URL. Even if the application defends robustly against XSS attacks, it
may still be possible for an attacker to construct a URL that displays the inbox
with different values echoed within these links. For example, the attacker can
supply a parameter like this:
start=1%26action=delete
This contains a URL-encoded & character that the application server will
automatically decode. The value of the start parameter that is passed to the
application is as follows:
1&action=delete
If the application accepts this invalid value and still displays the inbox, and
if it echoes the value without modification, the link to reply to message number
12 becomes this:
reply
This link now contains two action parameters—one specifying delete, and
one specifying reply. As with standard HTTP parameter pollution, the application’s
behavior when the user clicks the “reply” link depends on how it handles
the duplicated parameter. In many cases, the first value is used, so the user is
unwittingly induced to delete any messages he tries to reply to.
In this example, note that the links to perform actions contain an rnd parameter,
which is in fact an anti-CSRF token, preventing an attacker from easily
inducing these actions via a standard CSRF attack. Since the client-side HPP
attack injects into existing links constructed by the application, the anti-CSRF
tokens are handled in the normal way and do not prevent the attack.
In most real-world web mail applications, it is likely that many more actions
exist that can be exploited, including deleting all messages, forwarding individual
messages, and creating general mail forwarding rules. Depending on
how these actions are implemented, it may be possible to inject several required
parameters into links, and even exploit on-site redirection functions, to induce
the user to perform complex actions that normally are protected by anti-CSRF
defenses. Furthermore, it may be possible to use multiple levels of URL encoding
to inject several attacks into a single URL. That way, for example, one action