POST (multipart) arguments are skipped when field name is not in quotes

[i-rinat]

POST (multipart) arguments are skipped when field name is not in quotes

[i-rinat]

Oh, so you were asking if that's still an issue for me specifically? If so, then I need to say that I don't use libhtp at the moment. This parsing peculiarity surfaced up when I was evaluating libhtp as a replacement for an in-house security oriented HTTP parser. I don't work on that project anymore, and don't know if they use libhtp or have any code based on libhtp.

[victorjulien]

I will have a look, thanks.

[catenacyber]

Is this still an issue ?

[i-rinat]

Is this still an issue?

The test still fails.

[catenacyber]

How are you using libhtp ? With Suricata ?

[catenacyber]

May be still an issue, but likely not for Suricata's usage

[i-rinat]

but likely not for Suricata's usage

This is a potential bypass vector. Combined with HTTP Parameter Pollution this may be used to feed some innocent parameter values to detectors in Suricata, but allow to pass malicious payloads to the protected application.

[catenacyber]

This is a potential bypass vector.

Yes, but Suricata does not use libhtp multipart code, and has its own (which had similar bugs fixed recently)

[i-rinat]

Suricata does not use libhtp multipart code

Oh... okay.