Skip to content

Latest commit

 

History

History
74 lines (64 loc) · 6.79 KB

attack-tree.md

File metadata and controls

74 lines (64 loc) · 6.79 KB

Attack Tree Analysis for adam-p/markdown-here

Objective: Compromise Application via Markdown Here Exploitation

Attack Tree Visualization

Attack Goal: Compromise Application via Markdown Here Exploitation [CRITICAL NODE]
└───[OR]─ Exploit Vulnerabilities in Markdown Here Library [CRITICAL NODE, HIGH-RISK PATH START]
    └───[OR]─ Markdown Injection leading to XSS [CRITICAL NODE, HIGH-RISK PATH]
        ├───[AND]─ Identify unsanitized Markdown syntax [CRITICAL NODE, HIGH-RISK PATH]
        │   ├─── Identify Markdown syntax that translates to HTML with script execution (e.g., <img> onerror, <svg><script>, event handlers in tags) [HIGH-RISK PATH]
        │   └─── Identify Markdown syntax that translates to HTML with iframe injection [HIGH-RISK PATH]
        ├─── Craft malicious Markdown payload [CRITICAL NODE, HIGH-RISK PATH]
        │   ├─── Embed malicious JavaScript code within Markdown syntax [HIGH-RISK PATH]
        │   └─── Embed iframe pointing to attacker-controlled malicious site [HIGH-RISK PATH]
        ├─── Inject crafted Markdown into application input processed by Markdown Here [HIGH-RISK PATH]
        ├─── User interaction triggers Markdown rendering (e.g., viewing content, previewing input) [HIGH-RISK PATH]
        │   └─── User's browser executes injected JavaScript or loads malicious iframe [CRITICAL NODE, HIGH-RISK PATH]
        └─── Achieve XSS: [CRITICAL NODE, HIGH-RISK PATH START]
            ├─── Steal user session cookies [CRITICAL NODE, HIGH-RISK PATH]
            ├─── Redirect user to phishing site [CRITICAL NODE, HIGH-RISK PATH]
            └─── Exfiltrate sensitive data [CRITICAL NODE, HIGH-RISK PATH]

Attack Tree Path: Exploit Vulnerabilities in Markdown Here Library [CRITICAL NODE, HIGH-RISK PATH START]

  • Attack Vector: This is the starting point for exploiting Markdown Here. The attacker aims to find weaknesses within the library's code that can be leveraged to compromise the application.
  • Focus: Primarily focuses on vulnerabilities related to how Markdown Here processes and converts Markdown to HTML.

Attack Tree Path: Markdown Injection leading to XSS [CRITICAL NODE, HIGH-RISK PATH]

  • Attack Vector: This is the most critical vulnerability. Attackers inject malicious Markdown code into application inputs that are processed by Markdown Here. If Markdown Here doesn't properly sanitize the output, it can lead to Cross-Site Scripting (XSS).
  • Sub-Vectors:
    • Identify unsanitized Markdown syntax [CRITICAL NODE, HIGH-RISK PATH]:
      • Attack Vector: Attackers analyze Markdown Here's parsing rules to find syntax that translates into HTML tags capable of executing JavaScript or loading external resources without proper sanitization.
      • Examples:
        • Markdown syntax that results in <img> tags with onerror or onload attributes.
        • Markdown syntax that results in <svg> tags containing <script> tags.
        • Markdown syntax that results in HTML event handlers within tags (e.g., onclick, onmouseover).
        • Markdown syntax that results in <iframe> tags.
    • Craft malicious Markdown payload [CRITICAL NODE, HIGH-RISK PATH]:
      • Attack Vector: Once vulnerable syntax is identified, attackers create specific Markdown payloads to inject malicious code.
      • Examples:
        • Markdown embedding JavaScript code directly (e.g., ![alt text](javascript:alert('XSS')) - though less common and often blocked by browsers).
        • Markdown embedding HTML tags with JavaScript event handlers (e.g., <img src="x" onerror="alert('XSS')"> within raw HTML blocks in Markdown).
        • Markdown embedding <svg><script>alert('XSS')</script></svg> within raw HTML blocks.
        • Markdown embedding <iframe> tags pointing to attacker-controlled malicious websites.
    • Inject crafted Markdown into application input processed by Markdown Here [HIGH-RISK PATH]:
      • Attack Vector: Attackers need to find input fields in the application that use Markdown Here for rendering and inject their malicious Markdown payloads into these fields.
      • Examples:
        • Comment sections
        • Forum posts
        • User profile descriptions
        • Any text input field where Markdown rendering is enabled.
    • User interaction triggers Markdown rendering (e.g., viewing content, previewing input) [HIGH-RISK PATH]:
      • Attack Vector: The injected Markdown payload is rendered when a user interacts with the application, such as viewing content containing the malicious Markdown or previewing their input.
      • Result:
        • User's browser executes injected JavaScript or loads malicious iframe [CRITICAL NODE, HIGH-RISK PATH]: The malicious JavaScript code embedded in the Markdown payload executes within the user's browser, or the malicious iframe loads content from an attacker-controlled site. This happens in the context of the application's domain, enabling various attacks.

Attack Tree Path: Achieve XSS: [CRITICAL NODE, HIGH-RISK PATH START]

  • Attack Vector: This node represents the successful exploitation of XSS through Markdown injection. It outlines the potential impacts and objectives an attacker can achieve once XSS is successful.
  • Sub-Vectors (Impacts of XSS):
    • Steal user session cookies [CRITICAL NODE, HIGH-RISK PATH]:
      • Attack Vector: Using JavaScript within the XSS payload to access document.cookie and send session cookies to an attacker-controlled server.
      • Impact: Account takeover by impersonating the user using stolen session cookies.
    • Redirect user to phishing site [CRITICAL NODE, HIGH-RISK PATH]:
      • Attack Vector: Using JavaScript within the XSS payload to redirect the user's browser to a fake login page or other phishing site controlled by the attacker.
      • Impact: Credential theft when users unknowingly enter their login details on the phishing site.
    • Exfiltrate sensitive data [CRITICAL NODE, HIGH-RISK PATH]:
      • Attack Vector: Using JavaScript within the XSS payload to access sensitive data visible to the user within the application's DOM (e.g., user data, API responses) and send it to an attacker-controlled server.
      • Impact: Data breach and privacy violation through unauthorized data exfiltration.