Client-Side Path Traversal: Session Deletion to Takeover

Penetration Testing

• Goes beyond finding bugs → tests real-world impact of flaws.
• Even small misconfigs can escalate to account deletion.
• Example: path traversal in JavaScript let a crafted link delete a signed-in victim's account after the victim confirmed a prompt.
• Root cause: unvalidated user input in a client-built API path + a destructive endpoint without extra confirmation.
• Takeaway: manual pentesting + strong server-side security are essential.

At DeepStrike, we don’t just find vulnerabilities—we analyze their full impact and develop real-world defenses. This write-up demonstrates how a seemingly low-risk issue escalated into a critical security threat and how attackers can abuse client-side logic to manipulate API requests.

Key Takeaways

• How a small mistake in handling user input led to a severe security vulnerability.
• The concept of path traversal and why it is a critical security risk.
• A step-by-step breakdown of how the exploit was crafted and executed.
• Mitigation strategies to prevent such vulnerabilities in future applications.
• Advanced techniques for hunting client-side path traversal vulnerabilities and identifying insecure input handling.

Understanding the Risk (For Non-Technical Readers)

Before diving into the technical aspects, let’s break this down for those who may not be familiar with cybersecurity or programming:

Imagine a website where users can log in and delete their own sessions when they sign out. However, due to a mistake in how the website is programmed, a hacker can send a user a crafted link. If that user is signed in and confirms the prompt, the website's own code sends a request that deletes the user's whole account instead of a single session. This happens because the page puts a value from the link into the request path without checking it.

This kind of issue is known as path traversal, where attackers trick the system into accessing or modifying files and data that should be restricted. If not properly secured, it can lead to severe consequences, such as deleting user accounts, accessing confidential information, or even taking control of the entire system.

Our web app penetration testing services look for this kind of client-side logic flaw. Teams shortlisting a provider can review the top web application penetration testing companies.

Static Analysis Process

The vulnerability was discovered through static analysis of the client-side JavaScript code loaded during application usage. By reviewing the source code, we identified key security weaknesses:

1. The sessionId variable was read directly from the session query parameter (?session=).
2. The parameter was inserted into the API endpoint without validation.
3. The client accepted any value for the path segment, so the request could be redirected to a different API endpoint on the same origin.

This combination created a pathway for malicious exploitation. Static analysis enabled us to trace the execution flow and hypothesize potential attack vectors.

The Vulnerable Code

The following JavaScript snippet facilitated the vulnerability:

if (userConfirmed) {
    fetch(`/api/users/sessions/${sessionId}`, {
        method: "DELETE", // Dangerous: user-controlled sessionId in request path
        credentials: "include",
        headers: {
            "Content-Type": "application/json",
        },
    })
    .then(async (res) => {
        if (res.ok) {
            alert("Session deleted successfully!");
        } else {
            const errorMessage = await res.text();
            alert(`Failed to delete the session. Server response: ${errorMessage}`);
        }
    })
    .catch((error) => {
        console.error("Failed to send delete request:", error);
        alert("An error occurred while deleting the session. Please try again later.");
    });
} else if (!sessionId) {
    alert("No session ID found in the URL.");
}

A vulnerable JavaScript snippet demonstrating an unsafe DELETE request, where user-controlled input (sessionId) is directly injected into the API path, leading to potential exploitation.

Key Vulnerabilities in the Code

1. The sessionId variable (read from the session query parameter) was used without validation.
2. The API path /api/users/sessions/${sessionId} allowed injection of malicious paths.
3. Once the browser resolved the ../ segment, the request reached a different, state-changing endpoint that accepted it.
4. The account-deletion endpoint accepted the victim's cookie-authenticated request with no additional confirmation or re-authentication.

Crafting the Exploit

An attacker could inject path traversal sequences (../) to redirect the request to sensitive endpoints. For example:

https://app.example.com/delete-session?session=../profile

The resulting DELETE request would target /api/users/profile instead of /api/users/sessions/${sessionId}.

Malicious Request

DELETE /api/users/sessions/../profile HTTP/1.1
Host: app.example.com
Content-Type: application/json

The request above shows the raw path as seen when replayed in Burp. In a browser, the ../ segment is resolved before sending, so the request actually sent is:

DELETE /api/users/profile HTTP/1.1

This request resulted in the deletion of the user profile.

Demonstrating the Attack

Construct a malicious URL that manipulates the session parameter

https://app.example.com/delete-session?session=../profile

Unauthorized DELETE request due to a path traversal exploit, allowing account deletion by manipulating session parameters.

The client-side JavaScript constructs the path /api/users/sessions/${sessionId}, which can be manipulated to resolve to /api/users/profile. Once modified, observe the response.

{"message": "Account deleted successfully"}

Path traversal in an API DELETE request (replayed in Burp), allowing account deletion because the client built the request path from unvalidated input.

Mitigation Strategies

Sanitize and validate all user inputs. Avoid directly injecting user-provided values into paths.

if (!isValidSessionId(sessionId)) { throw new Error("Invalid session ID"); }

Validate sessionId against the expected format (for example a UUID) and encode it with encodeURIComponent before building the path. On the server, require explicit confirmation, re-authentication or a CSRF-style token for account deletion, so a redirected request cannot delete the account.

const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
if (!UUID_RE.test(sessionId)) {
    throw new Error("Invalid session ID");
}
fetch(`/api/users/sessions/${encodeURIComponent(sessionId)}`, {
    method: "DELETE",
    credentials: "include",
});

Or we can remove this mechanism and implement a logout mechanism that relies entirely on the server-side, such as clearing cookies or sessions via a /logout endpoint.

Advanced Techniques for Hunting Client-Side Path Traversal Vulnerabilities

Identifying client-side path traversal vulnerabilities requires a methodical approach and a deep understanding of how JavaScript processes user input. To effectively detect such issues:

• Identify JavaScript functions handling sensitive actions such as DELETE, POST, and PUT requests. Pay close attention to API calls that manipulate user data or interact with critical system files.
• Examine how parameters are accepted and whether they can be directly influenced by user input. Check for cases where input values are concatenated into API paths without proper validation.
• Test different input variations, including path traversal sequences (../), to see if you can manipulate the request endpoint.
• Review how the client-side code constructs and sends requests. Determine if the request logic assumes trusted input from the client.
• Observe which endpoint the browser actually calls after the path is resolved, and whether that endpoint performs a sensitive action.

Hunting for client-side path traversal depends on the app's unique logic. Start by spotting sensitive JavaScript functions like delete, post, or put. Analyze their parameters to see if you can manipulate them, and test whether the logic handles input securely or fails.

Conclusion

This vulnerability underscores the dangers of underestimating client-side flaws. By exploiting a path traversal vulnerability, attackers could bypass safeguards and delete user accounts, exposing applications to significant risks.

At DeepStrike, we leverage creative analysis to identify and mitigate vulnerabilities, ensuring applications remain secure against evolving threats. Penetration testing is more than just a job—it’s the art of mastering chaos and turning it into security.