# XSRF and Cookie manipulation on google.com

Unsanitized prefsval parameter reflected into a Set-Cookie header allowed XSRF cookie injection and tampering on google.com via Set-Cookie folding in Safari.

- Payout: $3,134
- Severity: medium
- Program: Google VRP
- Credited: Michele Spagnuolo
- Disclosed: 2013-09-15
- Write-up quality: 7/10
- Original: https://blog.miki.it/2013/9/15/xsrf-cookie-setting-google/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-miki-it-2013-9-15-xsrf-cookie-setting-google
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:medium technique:param-pollution vuln:crlf-injection vuln:csrf vuln:xss

**Target:** google.ca/finance/prefs endpoint (prefsval parameter)
**Root cause:** The prefsval parameter is reflected into a Set-Cookie response header without sanitizing commas/semicolons, and the endpoint lacks an anti-XSRF token, allowing cookie injection via Set-Cookie folding.
**Steps:**
1. Craft URL `http://www.google.ca/finance/prefs?action=set&prefsgroup=global&prefskey=RV&prefsval=<PAYLOAD>` where PAYLOAD contains commas/semicolons
2. Use payload `X;,%20USER_CONTROLLED_COOKIE_NAME=<script>alert('XSS')</script>;,DUMMY=` to fold multiple cookies into one Set-Cookie header
3. Add `path=/; Max-Age=999999999; domain=.google.ca` to make injected cookies valid site-wide
4. Serve auto-submitting HTML form to a logged-in victim to trigger the request cross-site (no CSRF token required)
5. Victim's browser (Safari or folding-supporting) sets arbitrary cookie and tampers with PREF cookie
**How found:** Noticed the prefsval parameter was reflected into a Set-Cookie header and tested whether commas/semicolons were sanitized, then applied RFC 2109 Set-Cookie folding to inject additional cookies.
**Exploitation:** Attacker hosts an auto-submitting form pointing at the prefs endpoint with a crafted prefsval; when a logged-in victim visits, the response Set-Cookie header is folded into multiple cookies, letting the attacker set arbitrary cookie names/values and overwrite existing Google cookies like PREF with attacker-controlled path/domain/expiry.
**Insight:** Parameters reflected into Set-Cookie headers are a cookie-injection sink; test comma/semicolon injection and Set-Cookie folding on browsers that still support it, especially on endpoints lacking CSRF tokens.