Forest Global Training Partners

Cyber Risks · PortSwigger Research

Suspicious input transformation (stored)

Summary: PortSwigger Research describes stored suspicious input transformation, which occurs when an application receives user input, transforms it through decoding such as UTF-8 or URL-encoding or through escape sequences such as backslash escaping, and then performs further processing on the result. The transformation is not a vulnerability by itself, but stored transformed input later embedded in responses can let an attacker bypass input filters by encoding payloads that are decoded after filtering, or consume the start of concatenated data by ending input with the start of a multi-character encoding or escape sequence.

What you should know: The bypass works precisely because the filter and the decoder see different strings, so a payload that passes validation can still arrive decoded at the point of use, and stored transformed input carries that gap into every later response.

Read the original at PortSwigger Research ↗

Topics
Vulnerabilities & Patching
Related