/
← Voltar ao feed
medium financial services e-commerce

Client-Side Path Traversal chains in bug bounty targets enable stored XSS, account takeover and account deletion

1 fonte(s) · 1 atualização(ões) · publicado 15/10/2026 17:09 · coletado há 1 dia

Researcher Pedro Cruz (gankd) documents two Client-Side Path Traversal (CSPT) chains found in production bug bounty programs. The first turns CSPT into Stored XSS and account takeover on a payments platform's Angular POS single-page application. The second, found with Felipe Torres, triggers unauthorized account deletion on one of the largest e-commerce platforms in Latin America. Both targets are redacted and no active exploitation is reported. The write-up argues that CSPT is invisible to blackbox scanners and AI tools because the traversal happens in browser JavaScript, so the server never sees it.

Technical Details

  • Finding 1 (read-then-render): The Angular route parameter alphanumId is decoded by DefaultUrlSerializer (%2f becomes /) and concatenated into the printPublic() API URL. The traversal (..%2f..%2f..%2fv1%2foffice%2f801) redirects the request to /v1/office/{id}, which holds an attacker-stored HTML payload in the name field. An unconditional HTTP interceptor (posInterceptor) attaches the victim's token to every request. The response is injected through Renderer2.setProperty('innerHTML'), which bypasses DomSanitizer, so the XSS fires. The print endpoints HTML-encode output, but the traversal sidesteps them.
  • Impact of Finding 1: The XSS reads localStorage and steals a JWT with a 417-day expiry. The same primitive can reach other authenticated endpoints (sales, contacts, payments, subscriptions). The research was enabled by source maps exposed in the staging environment.
  • Finding 2 (write primitive): The checkout_flow parameter of /checkout/finisher is used to build an internal API request. CloudFront blocked plain ../. Felipe Torres bypassed it by interleaving tab characters (%09) with double-encoded dots (%252e), which the frontend JavaScript decodes into ../. Six levels up, the request reaches the account cancellation API (create-cancellation-request) and is sent with the victim's cookies. %26 keeps the query parameters inside the checkout_flow value.
  • The write-up ties the pattern to Doyensec's CSPT2CSRF research and notes that framework routers (Angular, React Router) decode encoded path separators.

Remediation

  • Whitelist destinations in HTTP interceptors so tokens are attached only to the API origin and authenticated path prefixes.
  • Never render API responses with innerHTML or Renderer2.setProperty('innerHTML'). Use sanitized template binding instead.
  • Validate route and query parameters, rejecting /, . and % where an ID is expected.
  • Do not ship source maps to production.
  • Add JavaScript data-flow analysis (manual review, AI-assisted review, Semgrep rules) to the testing workflow.

Linha do tempo

  1. yokai.hakaisecurity.io ↗ · pub. 15/10/2026 17:09 · coletado 19/10 18:03 primeiro registro

    Client-Side Path Traversal chains in bug bounty targets enable stored XSS, account takeover and account deletion

    ler a análise desta fonte

    Researcher Pedro Cruz (gankd) documents two Client-Side Path Traversal (CSPT) chains found in production bug bounty programs. The first turns CSPT into Stored XSS and account takeover on a payments platform's Angular POS single-page application. The second, found with Felipe Torres, triggers unauthorized account deletion on one of the largest e-commerce platforms in Latin America. Both targets are redacted and no active exploitation is reported. The write-up argues that CSPT is invisible to blackbox scanners and AI tools because the traversal happens in browser JavaScript, so the server never sees it.

    Technical Details

    • Finding 1 (read-then-render): The Angular route parameter alphanumId is decoded by DefaultUrlSerializer (%2f becomes /) and concatenated into the printPublic() API URL. The traversal (..%2f..%2f..%2fv1%2foffice%2f801) redirects the request to /v1/office/{id}, which holds an attacker-stored HTML payload in the name field. An unconditional HTTP interceptor (posInterceptor) attaches the victim's token to every request. The response is injected through Renderer2.setProperty('innerHTML'), which bypasses DomSanitizer, so the XSS fires. The print endpoints HTML-encode output, but the traversal sidesteps them.
    • Impact of Finding 1: The XSS reads localStorage and steals a JWT with a 417-day expiry. The same primitive can reach other authenticated endpoints (sales, contacts, payments, subscriptions). The research was enabled by source maps exposed in the staging environment.
    • Finding 2 (write primitive): The checkout_flow parameter of /checkout/finisher is used to build an internal API request. CloudFront blocked plain ../. Felipe Torres bypassed it by interleaving tab characters (%09) with double-encoded dots (%252e), which the frontend JavaScript decodes into ../. Six levels up, the request reaches the account cancellation API (create-cancellation-request) and is sent with the victim's cookies. %26 keeps the query parameters inside the checkout_flow value.
    • The write-up ties the pattern to Doyensec's CSPT2CSRF research and notes that framework routers (Angular, React Router) decode encoded path separators.

    Remediation

    • Whitelist destinations in HTTP interceptors so tokens are attached only to the API origin and authenticated path prefixes.
    • Never render API responses with innerHTML or Renderer2.setProperty('innerHTML'). Use sanitized template binding instead.
    • Validate route and query parameters, rejecting /, . and % where an ID is expected.
    • Do not ship source maps to production.
    • Add JavaScript data-flow analysis (manual review, AI-assisted review, Semgrep rules) to the testing workflow.