Skip to content

Latest commit

 

History

History
95 lines (85 loc) · 5.07 KB

attack-tree.md

File metadata and controls

95 lines (85 loc) · 5.07 KB

Attack Tree Analysis for perwendel/spark

Objective: Gain Unauthorized Access or Disrupt Service via Spark

Attack Tree Visualization

[Attacker's Goal: Gain Unauthorized Access or Disrupt Service via Spark]
    |
    ---***-------------------------------------------------
    |								|
[1. Exploit Request Handling Vulnerabilities]		  [2. Abuse Configuration Weaknesses]
    |								|
    ---***-------------------------				 ---***-------------------------
    |				 |									|				 |
[1.1 Path Traversal]	  [***1.2 Parameter***]				   [***2.2 Default***]
    |				 [***Tampering/Pollution***]			   [***Settings***]
    |															|
[1.1.1 Read]		 [***1.2.1 Inject***]				[***2.2.1 Unchanged***]
[Arbitrary Files]	[***Unvalidated***]				 [***Credentials***]
    |				 [***Input***]
    |
[1.1.2 Bypass]
[Filters/Checks]
    |
    |
[1.1.3 Access]
[Restricted Dirs]

Attack Tree Path: High-Risk Path 1: Exploit Request Handling Vulnerabilities -> Path Traversal

  • Overall Description: This path focuses on exploiting vulnerabilities in how Spark handles incoming HTTP requests, specifically targeting the file system access.
  • 1.1 Path Traversal: The attacker attempts to access files or directories outside the intended web root by manipulating the URL path.
    • Likelihood: Medium
    • Impact: High
    • Effort: Low
    • Skill Level: Intermediate
    • Detection Difficulty: Medium
  • 1.1.1 Read Arbitrary Files: The attacker successfully reads files outside the web root, potentially gaining access to sensitive information like configuration files, source code, or system files.
    • Likelihood: Medium
    • Impact: High
    • Effort: Low
    • Skill Level: Intermediate
    • Detection Difficulty: Medium
    • Example: /files/../../etc/passwd
  • 1.1.2 Bypass Filters/Checks: The attacker uses techniques like URL encoding or double encoding to bypass any security filters or checks that are in place to prevent path traversal.
    • Likelihood: Low
    • Impact: High
    • Effort: Medium
    • Skill Level: Advanced
    • Detection Difficulty: Hard
    • Example: %2e%2e%2f instead of ../
  • 1.1.3 Access Restricted Directories: The attacker uses techniques to access directories that should be restricted.
    • Likelihood: Medium
    • Impact: High
    • Effort: Low
    • Skill Level: Intermediate
    • Detection Difficulty: Medium
    • Example: /admin/

Attack Tree Path: High-Risk Path 2: Exploit Request Handling Vulnerabilities -> Parameter Tampering/Pollution

  • Overall Description: This path focuses on manipulating request parameters to inject malicious input or alter application behavior. This is a critical path due to its high likelihood and impact.
  • [1.2 Parameter Tampering/Pollution] (Critical Node): The attacker modifies request parameters (query parameters, form data) to inject malicious input or influence the application's logic.
    • Likelihood: High
    • Impact: High
    • Effort: Low
    • Skill Level: Intermediate
    • Detection Difficulty: Medium
  • [1.2.1 Inject Unvalidated Input] (Critical Node): The attacker successfully injects malicious data into the application through unvalidated parameters. This is a precursor to many other attacks (SQLi, XSS, etc.). Spark itself doesn't prevent this; it's the application's responsibility.
    • Likelihood: High
    • Impact: High
    • Effort: Low
    • Skill Level: Intermediate
    • Detection Difficulty: Medium
    • Example: Submitting a form with <script>alert('XSS')</script> in a text field that is later displayed without sanitization.

Attack Tree Path: High-Risk Path 3: Abuse Configuration Weaknesses -> Default Settings

  • Overall Description: This path focuses on exploiting insecure default configurations in Spark or its dependencies.
  • [2.2 Default Settings] (Critical Node): The attacker leverages default settings that are insecure, such as unchanged default credentials or predictable session IDs.
    • Likelihood: Medium
    • Impact: High
    • Effort: Low
    • Skill Level: Intermediate
    • Detection Difficulty: Medium
  • [2.2.1 Unchanged Credentials] (Critical Node): The attacker gains access to the application using default credentials that were not changed during setup. This is the most critical vulnerability.
    • Likelihood: Medium
    • Impact: Very High
    • Effort: Very Low
    • Skill Level: Novice
    • Detection Difficulty: Very Easy
    • Example: Using "admin/admin" as the username and password for a Spark management interface.