cspt

Client-Side Path Traversal (CSPT)

What Is Broken and Why

Client-Side Path Traversal occurs when attacker-controlled input is concatenated directly into the path component of a JavaScript fetch() or XHR URL without proper encoding. The injected ../ sequences traverse the URL path, redirecting the request to an unintended endpoint. Unlike server-side path traversal (which reads files), CSPT redirects API calls — enabling response injection, data exfiltration, and XSS when chained with an open redirect that fetch() auto-follows to an attacker-controlled domain.

Key Signals

• JavaScript source with user-controlled input concatenated into a fetch/XHR path:

  fetch("/api/users/" + userId + "/profile")
  fetch(`/api/posts/${postId}/comments`)
  xhr.open("GET", "/api/data/" + param)
  

• Input lands in the path segment (before ?), not the query string
• No encodeURIComponent() wrapping the input, or encoding applied only to specific chars
• Application has open redirect endpoints (/redirect?u=, /oauth/authorize?redirect_uri=)
• SPA frameworks where routing inputs feed directly into API calls
• Response content is rendered as HTML or passed to innerHTML / eval()

Methodology

1. Map all fetch() / XHR calls in JavaScript source — look for string concatenation in the URL path.
2. Identify which parameters control the path segment (not query string).
3. Test basic traversal: inject ../../../anything — did the request path change?
4. Determine depth needed: count path segments to traverse to root or to a useful endpoint.
5. Find a usable gadget endpoint — open redirect (/redirect?u=ATTACKER) or any endpoint whose response is reflected in the DOM.
6. Craft final payload: traverse to the gadget, chain to attacker-controlled response.
7. If WAF blocks, apply encoding bypass strategy (see table below).
8. Confirm XSS or data exfiltration via OOB callback.

WAF Bypass: Encoding Level Matrix