Exploiting Client-Side Path Traversal: CSRF Is Dead, Long Live CSRF
summary
Claims that client‑side path traversal lets a frontend reroute legitimate requests and bypass CSRF mitigations, demonstrated against Rocket.Chat and Mattermost where POST and chained GET→POST flows reach admin actions including plugin install‑from‑url and user promotion. A custom Burp extension scans reflected path parameters and finds exploit sources. Demos return 200s and perform state changes; many instances expose lax backend validation so impact ranges from low to high. A white paper and tool release accompany the findings.
AI-written summary · about
chapters (9)
- 0:00Client-side path traversal intro
- 4:20Understanding client-side path traversal
- 9:17Exploitable CPT2-CSRF primitives
- 12:08Rocket.Chat one-click exploit
- 16:08Mattermost post-request exploit
- 20:48Mattermost get-request gadget
- 29:01Automating CPT2-CSRF discovery
- 33:51Remediation for developers
- 37:41Conclusion and future
related talks
28mOffensive and Defensive Strategies for Client-Side JS Security
42mHack Me If You Can
54mEverything You Wanted to Know About Client side CSRF But Were Afraid to Ask
29mDon't Trust, Verify! - How I Found a CSRF Bug Hiding...
28mXSS, CSRF, CSP, JWT, Wtf? Idk
50mModern WebApp Vulnerabilities
43mAttacking Modern Web Technologies
42mModern web application bugs