A CSPT is redirecting legitimate HTTP requests, allowing the front end to add necessary tokens for API calls, such as authentication or CSRF tokens. This capability can potentially be exploited to circumvent existing CSRF protection measures. | | CSRF | CSPT2CSRF | | ------------------------------------------- | ----------------- | ------------------ | | POST CSRF ? | :white_check_mark: | :white_check_mark: | | Can control the body ? | :white_check_mark: | :x: | | Can work with anti-CSRF token ? | :x: | :white_check_mark: | | Can work with Samesite=Lax ? | :x: | :white_check_mark: | | GET / PATCH / PUT / DELETE CSRF ? | :x: | :white_check_mark: | | 1-click CSRF ? | :x: | :white_check_mark: | | Does impact depend on source and on sinks ? | :x: | :white_check_mark: | Real-World Scenarios: * 1-click CSPT2CSRF in Rocket.Chat * CVE-2023-45316: CSPT2CSRF with a POST sink in Mattermost : `/<team>/channels/channelname?telem_action=under_control&forceRHSOpen&telem_run_id=../../../../../../api/v4/caches/invalidate` * CVE-2023-6458: CSPT2CSRF with a GET sink in Mattermost * [Client Side Path Manipulation - erasec.be](https://www.erasec.be/blog/client-side-path-manipulation/): CSPT2CSRF `https://example.com/signup/invite?email=foo%40bar.com&inviteCode=123456789/../../../cards/123e4567-e89b-42d3-a456-556642440000/cancel?a=` * [CVE-2023-5123 : CSPT2CSRF in Grafana’s JSON API Plugin](https://medium.com/@maxime.escourbiac/grafana-cve-2023-5123-write-up-74e1be7ef652)
Source: Client Side Path Traversal/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.