EXPLOITING CLIENT-SIDE PATH TRAVERSAL TO PERFORM CROSS-SITE REQUEST FORGERY

Summary from the TLDR InfoSec newsletter

A group of researchers have discovered a method that utilizes Client-Side Path Traversal (CSPT) to achieve Cross-Site Request Forgery (CSRF). CSPT vulnerabilities have historically been viewed as low severity due to limited impact. This research shows that an attacker could utilize a CSPT vulnerability to chain a CSRF vulnerability and execute actions on behalf of an end user to a web application. The post includes examples of how CSPTs can be utilized to cause CSRF such as by using an open redirect to leak sensitive data associated with the source.