Client-Side Path Traversal
Last updated
Was this helpful?
Last updated
Was this helpful?
Become VeryLazyTech ! 🎁
Follow us on:
✖ Twitter .
👾 Github .
📜 Medium .
📺 YouTube .
📩 Telegram .
🕵️♂️ My Site .
Visit our for e-books and courses. 📚
Client-side path traversal is a serious security vulnerability that occurs when an attacker manipulates file paths in web applications to gain unauthorized access to files stored on the client-side or server-side. Unlike traditional server-side path traversal attacks, client-side path traversal exploits weaknesses in web browsers, JavaScript, or local file access mechanisms. This flaw can lead to sensitive data exposure, code execution, and other security breaches.
In web applications, developers sometimes use client-side scripts to access and manipulate file paths dynamically. This can lead to vulnerabilities if user input is not properly sanitized. When a web application allows users to specify file paths without strict validation, an attacker can craft malicious inputs to access restricted files.
Common techniques include:
Modifying URL parameters to access unintended directories.
Tampering with JavaScript-based file access mechanisms.
Leveraging browser exploits to bypass security restrictions.
The consequences of a successful client-side path traversal attack can be severe:
Unauthorized access to files: Attackers can read sensitive local or remote files.
Cross-site scripting (XSS): Path traversal flaws can lead to XSS attacks when combined with improper JavaScript execution.
Local file inclusion (LFI): In some cases, attackers may execute malicious scripts by including unintended files.
Code execution: If exploited correctly, attackers may execute arbitrary code on the victim’s device.
Nowadays, it is common to have a web application architecture with a back-end API and a dynamic front end such as React or Angular.
In this context, an attacker with control over the {USER_INPUT} value can perform a path traversal in order to route the victim’s request to another endpoint.
An attacker can coerce a victim into executing this unexpected request. This is the starting point of a Client-Side Path Traversal (CSPT).
A Client-Side Path Traversal can be split into two parts. The source is the trigger of the CSPT, while the sinks are the exploitable endpoints that can be reached by this CSPT.
In order to understand how we can use CSPT as an attack vector, both source and sink must be defined.
Use Burp Suite, OWASP ZAP, or DevTools (F12 → Network Tab) to inspect requests containing file paths.
Look for file parameters in URLs:
Check if JavaScript fetches files:
Download all JavaScript files for analysis:
Search for functions handling file paths:
If you find:
This may be vulnerable to path manipulation.
If you have access to JavaScript files, search for dangerous functions:
Example vulnerable code:
Try modifying the parameter to escape directories:
Find URLs with file parameters and modify them.
Original request:
Test with Path Traversal:
If the response contains file contents, it's vulnerable!
Open Burp Suite → Proxy → Intercept Request
Modify:
Use ffuf to fuzz the file parameter:
Example payloads.txt:
Open DevTools Console (F12) and run:
If this succeeds, the application allows local file access.
If you find:
Test modifying it:
XMLHttpRequest to Fetch Local FilesIn DevTools Console (F12), run:
If a file path is stored in localStorage, modify it:
Then refresh the page and check if the file loads.
Open DevTools (F12) → Network → Headers
Look for:
If it allows file:// URLs, it may be exploitable.
A CSPT is redirecting legitimate HTTP requests, allowing the front end to add necessary tokens for API calls, such as authentication or CSRF tokens. This capability can potentially be exploited to circumvent existing CSRF protection measures.
POST CSRF ?
✅
✅
Can control the body ?
✅
❌
Can work with anti-CSRF token ?
❌
✅
Can work with Samesite=Lax ?
❌
✅
GET / PATCH / PUT / DELETE CSRF ?
❌
✅
1-click CSRF ?
❌
✅
Does impact depend on source and on sinks ?
❌
✅
Learn & practice
Become VeryLazyTech ! 🎁
✖ Twitter .
👾 Github .
📜 Medium .
📺 YouTube .
📩 Telegram .
🕵️♂️ My Site .
Visit our for e-books and courses. 📚
