Skip to content

Latest commit

 

History

History
123 lines (97 loc) · 6.96 KB

attack-tree.md

File metadata and controls

123 lines (97 loc) · 6.96 KB

Attack Tree Analysis for mozilla/pdf.js

Objective: [[Attacker's Goal: Execute Arbitrary JavaScript]]

Attack Tree Visualization

[[Attacker's Goal: Execute Arbitrary JavaScript]]
                     |
                     |
-----------------------------------------------------
|                                                   |
[[Vulnerability in PDF Parsing/Rendering]]      [Vulnerability in JavaScript API Interaction]
|===>                                           |===>
-------------------------                ---------------------------------------
|                       |                |
[[Malformed PDF]]   [Out-of-Bounds]        [[Unsafe Function Use]]
|===>                    |===>            |===>
|                       |                |
[[Crafted Font]]   [[Memory Access]]        [[eval() related]]
|===>                    |===>
|
[[Font Parsing Bug]] [[Read/Write]]
                     |
                     |
               [[Control Flow Hijack]]

Attack Tree Path: [[Vulnerability in PDF Parsing/Rendering]]

Description: This is the core area where vulnerabilities in pdf.js's handling of the PDF file format reside. The complexity of the PDF specification makes this a prime target. Why Critical/High-Risk: This is the most common entry point for attacks, and successful exploitation often leads directly to code execution.

Attack Tree Path: [[Malformed PDF]]

Description: The attacker provides a PDF file that intentionally violates the PDF specification in ways designed to trigger bugs in the parsing or rendering process. Why Critical/High-Risk: This is the broadest and most common attack vector. It encompasses many sub-categories of vulnerabilities. Attack Steps:

  1. Attacker crafts a malformed PDF.
  2. User opens the PDF in the vulnerable application.
  3. pdf.js attempts to parse the malformed PDF.
  4. A bug in the parsing logic is triggered.
  5. The bug leads to a exploitable condition (e.g., buffer overflow, type confusion).

Attack Tree Path: [[Crafted Font]]

Description: The malformed PDF contains a specially crafted font with corrupted data structures or tables. Why Critical/High-Risk: Font parsing is a complex and historically vulnerable area. Attack Steps:

  1. Attacker crafts a PDF with a malicious embedded font.
  2. User opens the PDF.
  3. pdf.js attempts to parse the embedded font.
  4. A vulnerability in the font parsing engine is triggered.
  5. The vulnerability leads to an exploitable condition.

Attack Tree Path: [[Font Parsing Bug]]

Description: A specific, identified bug in the font parsing code of pdf.js is exploited. Why Critical/High-Risk: This represents a known, exploitable vulnerability. Attack Steps:

  1. Attacker identifies a known font parsing bug in pdf.js.
  2. Attacker crafts a PDF that specifically triggers this bug.
  3. User opens the PDF.
  4. The bug is triggered, leading to a predictable exploitable state.

Attack Tree Path: [Out-of-Bounds Read/Write]

Description: The parser attempts to access memory outside the allocated buffer for a PDF object, either reading from or writing to an invalid memory location. Why High-Risk: Leads directly to memory corruption, which is a highly exploitable condition. Attack Steps:

  1. Attacker crafts a PDF that causes the parser to calculate an incorrect offset or size.
  2. User opens the PDF.
  3. pdf.js attempts to access memory using the incorrect offset/size.
  4. An out-of-bounds read or write occurs.
  5. The attacker gains control over memory contents.

Attack Tree Path: [[Memory Access (Read/Write)]]

Description: The attacker gains the ability to read from or write to arbitrary memory locations within the application's address space. Why Critical/High-Risk: This is a very powerful primitive that can be used to achieve code execution. Attack Steps: (These steps follow from a successful out-of-bounds read/write)

  1. The out-of-bounds access allows the attacker to overwrite critical data (e.g., function pointers, object metadata).
  2. The attacker carefully crafts the overwritten data to redirect program execution.

Attack Tree Path: [[Read/Write]]

Description: This is the direct consequence of gaining memory access. Why Critical: This is the fundamental capability that allows for further exploitation. Attack Steps: N/A - This is a state, not a series of steps.

Attack Tree Path: [[Control Flow Hijack]]

Description: The attacker uses the read/write primitive to modify program data (e.g., function pointers, return addresses) to redirect execution to attacker-controlled code. Why Critical: This is the final step in achieving arbitrary code execution. Attack Steps:

  1. Attacker uses memory access to overwrite a function pointer or return address.
  2. The overwritten pointer/address now points to attacker-supplied shellcode.
  3. When the overwritten function is called, or the function returns, execution jumps to the shellcode.

Attack Tree Path: [Vulnerability in JavaScript API Interaction]

Description: Vulnerabilities introduced by how the application uses the pdf.js API, rather than vulnerabilities within pdf.js itself. Why High-Risk: Even a secure library can be used insecurely.

Attack Tree Path: [[Unsafe Function Use]]

Description: The application uses pdf.js API functions in a way that is not intended or documented, or in a way that is known to be unsafe. Why Critical/High-Risk: This can create vulnerabilities even if pdf.js itself is bug-free. Attack Steps: (These steps are highly dependent on the specific unsafe function use)

  1. The application uses a pdf.js API function incorrectly.
  2. The incorrect usage creates a vulnerability (e.g., allows injection of untrusted data).
  3. The attacker exploits this vulnerability.

Attack Tree Path: [[eval() related]]

Description: The application uses the eval() function (or similar functions like Function()) with data derived from a PDF, directly or indirectly. Why Critical/High-Risk: eval() with untrusted data is a classic and extremely dangerous vulnerability, leading directly to code execution. Attack Steps:

  1. The application extracts data from a PDF (e.g., form field values, JavaScript actions).
  2. This data is passed to eval() without proper sanitization or validation.
  3. The attacker crafts the PDF to include malicious JavaScript code in the relevant data.
  4. When eval() is called, the attacker's code is executed.