hacktricks/src/pentesting-web/client-side-path-traversal.md

Client Side Path Traversal

{{#include ../banners/hacktricks-training.md}}

Basic Information

A client side path traversal occurs when you can manipulate the path of a URL that is going to be sent to a user to visit in a legit way or that a user is somehow going to be forced to visit for example via JS or CSS.

• In this writeup, it was possible to change the invite URL so it would end up canceling a card.
• In this writeup, it was possible to combine a client side path traversal via CSS (it was possible to change the path where a CSS resource was loaded from) with an open redirect to load the CSS resource from an attacker controlled domain.
• In this writeup, it's possible to see a tachnique on how to abuse CSPT to perform a CSRF attack. This is done by monitoring all the data that an attacker can control (URL path, parameters, fragment, adata injected in the DB...) and the sinks this data ends (requests being performed).
  • Check this browser extension to monitor that.
  • Check this CSPT playground to try the technique.
  • Check this tutorial on how to use the browser extension in the playground.

CSPT-assisted web cache poisoning/deception

CSPT can be chained with extension-based CDN caching to exfiltrate sensitive JSON leaked by authenticated API calls:

• A frontend concatenates user-controlled input into an API path and attaches authentication headers in fetch/XHR.
• By injecting dot-segments (../) you can retarget the authenticated request to a different endpoint on the same origin.
• If that endpoint (or a path variant with a static-looking suffix like .css) is cached by the CDN without varying on auth headers, the victim’s authenticated response can be stored under a public cache key and retrieved by anyone.

Quick recipe:

1. Find SPA code building API URLs from path parameters while sending auth headers.
2. Identify sensitive endpoints and test static suffixes (.css, .js, .jpg, .json) to see if the CDN flips to Cache-Control: public/max-age and X-Cache: Hit while returning JSON.
3. Lure the victim to a URL that injects traversal into the SPA parameter so the authenticated fetch hits the cacheable path variant (for example, ../../../v1/token.css).
4. Read back the same URL anonymously to obtain the cached secret (token → ATO).

See details and mitigations in the Cache Deception page: Cache Poisoning and Cache Deception.

References

• Cache Deception + CSPT: Turning Non Impactful Findings into Account Takeover
• CSPT overview by Matan Berson
• PortSwigger: Web Cache Deception

{{#include ../banners/hacktricks-training.md}}