// Payloads · Client Side Path Traversal

Client Side Path Traversal

Client Side Path Traversal

Client-Side Path Traversal (CSPT), sometimes also referred to as “On-site Request Forgery,” is a vulnerability that can be exploited as a tool for CSRF or XSS attacks.
It takes advantage of the client side’s ability to make requests using fetch to a URL, where multiple ”../” characters can be injected. After normalization, these characters redirect the request to a different URL, potentially leading to security breaches.
Since every request is initiated from within the frontend of the application, the browser automatically includes cookies and other authentication mechanisms, making them available for exploitation in these attacks.

Summary

Tools

Methodology

CSPT to XSS

cspt-query-param

A post-serving page calls the fetch function, sending a request to a URL with attacker-controlled input which is not properly encoded in its path, allowing the attacker to inject ../ sequences to the path and make the request get sent to an arbitrary endpoint. This behavior is referred to as a CSPT vulnerability.

Example:

  • The page https://example.com/static/cms/news.html takes a newsitemid as parameter
  • Then fetch the content of https://example.com/newitems/<newsitemid>
  • A text injection was also discovered in https://example.com/pricing/default.js via the cb parameter
  • Final payload is https://example.com/static/cms/news.html?newsitemid=../pricing/default.js?cb=alert(document.domain)//

CSPT to CSRF

A CSPT is redirecting legitimate HTTP requests, allowing the front end to add necessary tokens for API calls, such as authentication or CSRF tokens. This capability can potentially be exploited to circumvent existing CSRF protection measures.

CSRFCSPT2CSRF
POST CSRF ?:white_check_mark::white_check_mark:
Can control the body ?:white_check_mark::x:
Can work with anti-CSRF token ?:x::white_check_mark:
Can work with Samesite=Lax ?:x::white_check_mark:
GET / PATCH / PUT / DELETE CSRF ?:x::white_check_mark:
1-click CSRF ?:x::white_check_mark:
Does impact depend on source and on sinks ?:x::white_check_mark:

Real-World Scenarios:

  • 1-click CSPT2CSRF in Rocket.Chat
  • CVE-2023-45316: CSPT2CSRF with a POST sink in Mattermost : /<team>/channels/channelname?telem_action=under_control&forceRHSOpen&telem_run_id=../../../../../../api/v4/caches/invalidate
  • CVE-2023-6458: CSPT2CSRF with a GET sink in Mattermost
  • Client Side Path Manipulation - erasec.be: CSPT2CSRF https://example.com/signup/invite?email=foo%40bar.com&inviteCode=123456789/../../../cards/123e4567-e89b-42d3-a456-556642440000/cancel?a=
  • CVE-2023-5123 : CSPT2CSRF in Grafana’s JSON API Plugin

Labs

References

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.