Bypass cookie validation

Question

I have discovered that a web application allows the setting of certain cookie values through request parameters. Each request param results in a separate Set-Cookie header. i.e. a request like this:

/url?cookie1=first_value&cookie2=second_value

results in the following headers:

Set-Cookie: cookie1=first_value
Set-Cookie: cookie2=second_value

These headers appear after the session id cookie header, so I figure I should be able to fix the session by using a cookie value like the following

first_value; another_cookie=another_value

URL encoding the space, semicolon and equals signs. However once the app sees the semicolon, it simply truncates up to that point, so the response header becomes:

Set-Cookie: first_value

My question is, what other delimiters might a browser accept, or what methods might allow the filter to be bypassed.

Answer 1

A CRLF Injection might work. You would use a URL like the following:

/url?cookie1=first_value%0d%0aSet-Cookie:%20cookie2=second_value

Answer 2

The semicolon is an old, mostly-obsolete value for the CGI record separator, but it's still recognized by many CGI scripts. Most likely what's happening is that your

/url?cookie1=first_value;another_cookie=another_value&cookie2=second_value

is being interpreted as

cookie1=first_value
another_cookie=another_value
cookie2=second_value

and since the CGI script doesn't know what to do with a parameter named another_cookie, it ignores it. You can probably get around this by percent-encoding your semicolon:

/url?cookie1=first_value%3Banother_cookie=another_value&cookie2=second_value