exploiting-client-side-path-traversal

Map sources to sinks by wrapping fetch, XMLHttpRequest, and the framework router in DevTools to log URLs containing ../ sequences. Then inject dot-segment payloads into route params or stored slugs and confirm the dispatched request re-targets a different same-origin endpoint with credentials included.

CSPT lands the traversal on the same origin in the victim's authenticated browser context, not on the server filesystem. The impact comes from re-targeting credentialed requests to destructive endpoints, cacheable paths, or redirects rather than reading server files.

A traversal like ../../v1/token.css makes the authenticated fetch hit a static-looking path, so the CDN caches the JSON token under a public key. The attacker then requests that URL anonymously and recovers the token, taking over the account.

The Doyensec CSPT Burp extension clusters parameters reflected into other requests' paths, Eval Villain monitors sources and sinks in Firefox, and browser DevTools can wrap fetch/XHR to catch dispatched traversals. Burp or ZAP history helps spot double-encoded %252e%252e patterns.

Naive normalization strips plain ../ sequences, so you need encoded variants like %2e%2e/, ..;/ matrix params, or double URL-encoding (%252e%252e) that the frontend decodes before dispatch. Also verify the request uses credentials: include, since uncredentialed traversals are rarely impactful.

CSPT has little impact when the dispatched request does not carry credentials or auth headers, when the path is strictly allow-listed to fixed identifiers, or when the CDN varies on auth headers and never caches authenticated responses.