Back to Details

payloads-cspt

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Client Side Path Traversal Payloads

客户端路径遍历（Client-Side Path Traversal）攻击载荷

Source: PayloadsAllTheThings/Client Side Path Traversal Category: 
payloads-research
| Skill ID: 
payloads-cspt
来源： PayloadsAllTheThings/Client Side Path Traversal 分类： 
payloads-research
| Skill ID： 
payloads-cspt

Overview

概览

Client-side path traversal payloads for XSS gadgets and fetch URL manipulation.
This skill integrates the full PayloadsAllTheThings (PATT) payload library for the Client Side Path Traversal Payloads domain into the REA_Skill framework. Use it during authorized penetration testing, bug bounty research, security audits, and CTF challenges.
用于 XSS gadget 和 fetch URL 操纵的客户端路径遍历攻击载荷。
此 skill 将完整的 PayloadsAllTheThings（PATT）攻击载荷库中针对客户端路径遍历攻击载荷领域的全部内容集成到 REA_Skill 框架中。将其用于获得授权的渗透测试、漏洞赏金研究、安全审计和 CTF 挑战。

Workflow

工作流

1. Recon & Identification

1. 侦察与识别

  • Identify the target technology stack and injection points
  • Enumerate endpoints, parameters, and input vectors
  • Determine applicable payload categories from the reference below
  • 识别目标技术栈和注入点
  • 枚举端点、参数和输入向量
  • 根据下方参考内容确定适用的攻击载荷类别

2. Payload Selection

2. 攻击载荷选择

  • Browse the PATT payload library for the attack class
  • Select encoding-appropriate payloads for the target environment
  • Consider WAF bypass variants and obfuscation techniques
  • 浏览 PATT 攻击载荷库以查找相应攻击类别
  • 选择编码方式适合目标环境的攻击载荷
  • 考虑 WAF 绕过变体和混淆技术

3. Exploitation (Authorized Only)

3. 利用（仅限授权场景）

  • Test payloads in order: passive → active → escalation
  • Document every payload tested and its response
  • Capture PoC evidence (screenshots, HTTP logs, curl output)
  • 按顺序测试攻击载荷：被动 → 主动 → 升级利用
  • 记录每个已测试的攻击载荷及其响应
  • 捕获 PoC 证据（截图、HTTP 日志、curl 输出）

4. Verification & Reporting

4. 验证与报告

  • Confirm the vulnerability with a clean minimal PoC
  • Map findings to CVE/CWE where applicable
  • Report with remediation recommendations and code fixes
  • 使用干净、最小化的 PoC 确认漏洞
  • 在适用的情况下，将发现映射到 CVE/CWE
  • 报告发现，并提供修复建议和代码修复

Full PATT Reference

完整 PATT 参考

Client Side Path Traversal

客户端路径遍历

Client-Side Path Traversal (CSPT), sometimes also referred to as "On-site Request Forgery," is a vulnerability that can be exploited as a tool for CSRF or XSS attacks.
It takes advantage of the client side's ability to make requests using fetch to a URL, where multiple "../" characters can be injected. After normalization, these characters redirect the request to a different URL, potentially leading to security breaches.
Since every request is initiated from within the frontend of the application, the browser automatically includes cookies and other authentication mechanisms, making them available for exploitation in these attacks.
客户端路径遍历（Client-Side Path Traversal，CSPT）有时也称为“站内请求伪造”（On-site Request Forgery），是一种可用作 CSRF 或 XSS 攻击工具的漏洞。
它利用客户端通过 fetch 向 URL 发起请求的能力，可向该 URL 注入多个 
../
字符。规范化处理后，这些字符会将请求重定向到其他 URL，从而可能导致安全泄露。
由于每个请求都从应用前端发起，浏览器会自动附带 Cookie 和其他身份验证机制，使这些机制可在此类攻击中被利用。

Summary

摘要

Tools

工具

Methodology

方法论

CSPT to XSS

CSPT 转为 XSS

cspt-query-param
A post-serving page calls the fetch function, sending a request to a URL with attacker-controlled input which is not properly encoded in its path, allowing the attacker to inject 
../
sequences to the path and make the request get sent to an arbitrary endpoint. This behavior is referred to as a CSPT vulnerability.
Example:
  • The page 
    https://example.com/static/cms/news.html
    takes a 
    newsitemid
    as parameter
  • Then fetch the content of 
    https://example.com/newitems/<newsitemid>
  • A text injection was also discovered in 
    https://example.com/pricing/default.js
    via the 
    cb
    parameter
  • Final payload is 
    https://example.com/static/cms/news.html?newsitemid=../pricing/default.js?cb=alert(document.domain)//
cspt-query-param
一个页面加载后调用 fetch 函数，向一个 URL 发起请求；该 URL 的路径中包含攻击者可控且未经过正确编码的输入。这使攻击者能够向路径注入 
../
序列，让请求被发送到任意端点。此类行为称为 CSPT 漏洞。
示例：
  • 页面 
    https://example.com/static/cms/news.html
    接受 
    newsitemid
    作为参数
  • 随后获取 
    https://example.com/newitems/<newsitemid>
    的内容
  • 还发现可通过 
    cb
    参数向 
    https://example.com/pricing/default.js
    注入文本
  • 最终攻击载荷为 
    https://example.com/static/cms/news.html?newsitemid=../pricing/default.js?cb=alert(document.domain)//

CSPT to CSRF

CSPT 转为 CSRF

A CSPT is redirecting legitimate HTTP requests, allowing the front end to add necessary tokens for API calls, such as authentication or CSRF tokens. This capability can potentially be exploited to circumvent existing CSRF protection measures.
CSRFCSPT2CSRF
POST CSRF ?:white_check_mark::white_check_mark:
Can control the body ?:white_check_mark::x:
Can work with anti-CSRF token ?:x::white_check_mark:
Can work with Samesite=Lax ?:x::white_check_mark:
GET / PATCH / PUT / DELETE CSRF ?:x::white_check_mark:
1-click CSRF ?:x::white_check_mark:
Does impact depend on source and on sinks ?:x::white_check_mark:
Real-World Scenarios:
  • 1-click CSPT2CSRF in Rocket.Chat
  • CVE-2023-45316: CSPT2CSRF with a POST sink in Mattermost : 
    /<team>/channels/channelname?telem_action=under_control&forceRHSOpen&telem_run_id=../../../../../../api/v4/caches/invalidate
  • CVE-2023-6458: CSPT2CSRF with a GET sink in Mattermost
  • Client Side Path Manipulation - erasec.be: CSPT2CSRF 
    https://example.com/signup/invite?email=foo%40bar.com&inviteCode=123456789/../../../cards/123e4567-e89b-42d3-a456-556642440000/cancel?a=
  • CVE-2023-5123 : CSPT2CSRF in Grafana’s JSON API Plugin
CSPT 会重定向合法的 HTTP 请求，使前端能够为 API 调用添加必要的 token，例如身份验证 token 或 CSRF token。这一能力可能被利用来绕过现有的 CSRF 防护措施。
CSRFCSPT2CSRF
支持 POST CSRF？:white_check_mark::white_check_mark:
能控制请求体吗？:white_check_mark::x:
可与 anti-CSRF token 配合使用吗？:x::white_check_mark:
可与 Samesite=Lax 配合使用吗？:x::white_check_mark:
支持 GET / PATCH / PUT / DELETE CSRF？:x::white_check_mark:
支持单击式 CSRF？:x::white_check_mark:
影响是否取决于 source 和 sink？:x::white_check_mark:
真实世界场景：
  • Rocket.Chat 中的一键 CSPT2CSRF
  • CVE-2023-45316：在 Mattermost 中利用 POST sink 实施 CSPT2CSRF：
    <team>/channels/channelname?telem_action=under_control&forceRHSOpen&telem_run_id=../../../../../../api/v4/caches/invalidate
  • CVE-2023-6458：在 Mattermost 中利用 GET sink 实施 CSPT2CSRF
  • 客户端路径操纵 - erasec.be：CSPT2CSRF 
    https://example.com/signup/invite?email=foo%40bar.com&inviteCode=123456789/../../../cards/123e4567-e89b-42d3-a456-556642440000/cancel?a=
  • CVE-2023-5123：Grafana JSON API Plugin 中的 CSPT2CSRF

Labs

实验环境

References

参考资料

REA MCP Integration

REA MCP 集成

javascript
// REA MCP — Automated payload injection via REA tools
// Use analyze_function, procedure_pseudo_code, or observe_native_calls
// to identify injection sinks, then apply payloads from this skill.
javascript
// REA MCP — Automated payload injection via REA tools
// Use analyze_function, procedure_pseudo_code, or observe_native_calls
// to identify injection sinks, then apply payloads from this skill.

Legal Notice

法律声明

⚠️ Authorized Use Only. All payloads in this skill are for security research, penetration testing with written permission, CTF competitions, and defensive study. Unauthorized use against systems you do not own or have explicit permission to test is illegal.
⚠️ 仅限授权使用。 此 skill 中的所有攻击载荷仅用于安全研究、经书面许可的渗透测试、CTF 竞赛和防御性研究。未经授权对非自有系统或未获得明确测试许可的系统使用，均属违法行为。