3

I have discovered that a web application allows the setting of certain cookie values through request parameters. Each request param results in a separate Set-Cookie header. i.e. a request like this:

/url?cookie1=first_value&cookie2=second_value

results in the following headers:

Set-Cookie: cookie1=first_value
Set-Cookie: cookie2=second_value

These headers appear after the session id cookie header, so I figure I should be able to fix the session by using a cookie value like the following

first_value; another_cookie=another_value

URL encoding the space, semicolon and equals signs. However once the app sees the semicolon, it simply truncates up to that point, so the response header becomes:

Set-Cookie: first_value

My question is, what other delimiters might a browser accept, or what methods might allow the filter to be bypassed.

2

A CRLF Injection might work. You would use a URL like the following:

/url?cookie1=first_value%0d%0aSet-Cookie:%20cookie2=second_value
| improve this answer | |
  • Good idea, but it doesn't work. The app truncates the query value up to the CRLF. – Slicedpan Mar 3 '14 at 9:22
2

The semicolon is an old, mostly-obsolete value for the CGI record separator, but it's still recognized by many CGI scripts. Most likely what's happening is that your

/url?cookie1=first_value;another_cookie=another_value&cookie2=second_value

is being interpreted as

cookie1=first_value
another_cookie=another_value
cookie2=second_value

and since the CGI script doesn't know what to do with a parameter named another_cookie, it ignores it. You can probably get around this by percent-encoding your semicolon:

/url?cookie1=first_value%3Banother_cookie=another_value&cookie2=second_value
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.