vulnerability-chains

Vulnerability Chain Detection

Modern applications consist of multiple services and frameworks. Critical exploits often require chaining vulnerabilities across components.

Why Chains Matter

Single vulnerabilities may have limited impact:

• SSRF with no response → Blind, hard to exploit
• SSTI in internal-only service → Unreachable from internet
• SQLi returning only boolean → Data extraction is slow

Chains amplify impact:

• SSRF → reaches internal SSTI → RCE
• Auth bypass → accesses admin SQLi → full database dump
• Path traversal → reads source → finds hardcoded credentials

Chain Detection Methodology

Step 1: Map the Architecture

# Find orchestration configs
find . -name "docker-compose*.yml" -o -name "supervisord.conf" -o -name "*.k8s.yaml"

# Extract service topology
grep -E "ports:|expose:|links:|depends_on:" docker-compose.yml

# Identify internal-only services
grep -E "127\.0\.0\.1:|localhost:" docker-compose.yml supervisord.conf

Step 2: Identify Pivot Points

Pivot vulnerabilities enable reaching other services:

| Pivot Type | What It Enables | |------------|-----------------| | SSRF | Reach internal services | | Header Injection | Modify downstream requests | | Open Redirect | Phishing, OAuth token theft | | Path Traversal | Read configs, source code | | SQL Injection | Read files, execute commands (in some DBs) |

Step 3: Map Impact Sinks

High-impact sinks in each service:

| Sink Type | Impact | |-----------|--------| | Template Injection (SSTI) | RCE | | Command Injection | RCE | | Deserialization | RCE | | SQL Injection | Data breach, sometimes RCE | | File Write | Code execution via webshell |

Step 4: Connect Pivots to Sinks

For each pivot found:

1. What internal services can it reach?
2. What sinks exist in those services?
3. Can attacker-controlled data reach the sink?

Common Chain Patterns

SSRF → SSTI → RCE (DoxPit Pattern)

┌─────────────┐     ┌─────────────┐     ┌─────────────┐
│   Next.js   │────►│   Flask     │────►│    Shell    │
│   (SSRF)    │     │   (SSTI)    │     │   (RCE)     │
└─────────────┘     └─────────────┘     └─────────────┘
     │                    │
     │ Host header        │ render_template_string()
     │ → internal fetch   │ with user input
     │                    │
     ▼                    ▼
  Attacker server      Jinja2 payload
  redirects to         executes code
  internal Flask

Detection:

1. Find SSRF in externally-accessible service (Next.js redirect, fetch with user URL)
2. Find SSTI in internal service (render_template_string)
3. Verify SSRF can reach SSTI endpoint with controllable input

SSRF → Cloud Metadata → Credential Theft

┌─────────────┐     ┌─────────────────┐     ┌─────────────┐
│   Web App   │────►│ 169.254.169.254 │────►│  AWS/GCP    │
│   (SSRF)    │     │ (Metadata)      │     │  (Creds)    │
└─────────────┘     └─────────────────┘     └─────────────┘

Detection:

1. Find SSRF capability
2. Check if app runs in cloud (AWS, GCP, Azure)
3. Verify no IMDSv2 or metadata endpoint blocking

SQLi → File Read → Source Code → Credentials

┌─────────────┐     ┌─────────────┐     ┌─────────────┐
│   SQLi      │────►│  LOAD_FILE  │────►│   Config    │
│             │     │  (MySQL)    │     │   Secrets   │
└─────────────┘     └─────────────┘     └─────────────┘

Detection:

1. Find SQL injection
2. Check database type and permissions
3. Identify sensitive file paths (config, .env, etc.)

Auth Bypass → Admin Function → High-Impact Vuln

┌─────────────┐     ┌─────────────┐     ┌─────────────┐
│  Middleware │────►│   Admin     │────►│   Command   │
│  Bypass     │     │   Panel     │     │   Injection │
└─────────────┘     └─────────────┘     └─────────────┘

Detection:

1. Find authentication/authorization bypass
2. Identify what protected functionality becomes accessible
3. Audit protected functionality for high-impact vulns

Chain Documentation Template

When documenting a chain:

## Chain: [Name]

**Impact:** [RCE/Data Breach/Account Takeover/etc.]

**Components:**
1. [Service A] - [Vulnerability Type] at [location]
2. [Service B] - [Vulnerability Type] at [location]

**Prerequisites:**
- [What attacker needs: account, network position, etc.]

**Flow:**
1. Attacker [action] → [result]
2. [Result] enables [next action]
3. [Final impact]

**Evidence:**
- [File:line] - [code snippet]
- [File:line] - [code snippet]

Integration with Full Audit

During /full-audit:

1. Architecture phase maps services and connectivity
2. Threat model identifies trust boundaries
3. Deep dive finds individual vulnerabilities
4. Chain analysis connects vulnerabilities across services

Verification Checklist

Before reporting a chain as exploitable:

• [ ] Each component vulnerability confirmed
• [ ] Network path between components verified
• [ ] Data flow from attacker input to sink traced
• [ ] Filters/sanitization accounted for
• [ ] Prerequisites documented