Skip to content

Latest commit

 

History

History
53 lines (41 loc) · 6.24 KB

attack-tree.md

File metadata and controls

53 lines (41 loc) · 6.24 KB

Attack Tree Analysis for codermjlee/mjextension

Objective: Execute Arbitrary Code within the Application Context (using mjextension)

Attack Tree Visualization

Goal: Execute Arbitrary Code within the Application Context (using mjextension)
└── 1.  Exploit Object Instantiation/Property Setting
    └── 1.3  Exploit Deserialization Gadgets [HIGH RISK]
        ├── 1.3.1  If mjextension uses `NSCoding` or similar, look for "gadget chains." [CRITICAL]
        │   └── 1.3.1.1  Craft a malicious JSON/Plist that, when deserialized, triggers a chain of method calls leading to arbitrary code execution.  [HIGH RISK] [CRITICAL]
        └── 1.3.2 Bypass blacklist/whitelist checks (if any)
            └── 1.3.2.1 If mjextension implements any class whitelisting or blacklisting, try to bypass these checks.

Attack Tree Path: 1.3 Exploit Deserialization Gadgets [HIGH RISK]

  • Description: This is the most dangerous attack vector. It leverages the inherent risks of deserializing data from untrusted sources. If mjextension uses NSCoding, NSKeyedUnarchiver, or any other mechanism that allows the instantiation of arbitrary objects based on the input data, it becomes vulnerable to "gadget chain" attacks.
    • How it works:
      1. The attacker crafts a malicious JSON or Plist payload. This payload doesn't directly contain malicious code. Instead, it describes a series of objects and their properties.
      2. When mjextension deserializes this payload, it creates the specified objects.
      3. The attacker carefully chooses the object types and property values so that the process of object creation and property setting triggers a chain of method calls.
      4. This chain of calls, known as a "gadget chain," ultimately leads to the execution of arbitrary code. This often involves exploiting existing methods within the application or its dependencies that have unintended side effects when called in a specific sequence.
      5. Common gadgets include methods that perform file operations, execute system commands, or load dynamic libraries.
    • Why it's high risk:
      • High Impact: Successful exploitation leads to Remote Code Execution (RCE), giving the attacker complete control over the application.
      • Medium to High Likelihood: If NSCoding or similar is used, the attack surface is significant. Finding gadget chains can be challenging, but numerous tools and techniques exist to aid attackers.
      • Difficult to Prevent: Completely preventing deserialization vulnerabilities is extremely difficult without fundamentally changing the way data is handled.

Attack Tree Path: 1.3.1 If mjextension uses NSCoding or similar, look for "gadget chains." [CRITICAL]

  • Description: This is the critical condition that enables the high-risk attack. The use of NSCoding (or an equivalent mechanism) is the fundamental vulnerability.
    • Why it's critical: Without this, the attacker cannot instantiate arbitrary objects based on the input data, making gadget chain attacks impossible. This node's presence or absence determines whether the entire high-risk path is viable.

Attack Tree Path: 1.3.1.1 Craft a malicious JSON/Plist that, when deserialized, triggers a chain of method calls leading to arbitrary code execution. [HIGH RISK] [CRITICAL]

  • Description: This is the specific action the attacker takes to exploit the vulnerability. It involves crafting the malicious payload that triggers the gadget chain.
    • Detailed Steps:
      1. Identify Gadget Chains: The attacker analyzes the application's code and its dependencies (including mjextension and any libraries it uses) to find sequences of method calls that can be chained together to achieve a malicious outcome. This often involves using automated tools and public databases of known gadget chains.
      2. Craft the Payload: The attacker constructs a JSON or Plist payload that, when deserialized, will create the objects and set the properties necessary to trigger the identified gadget chain. This requires a deep understanding of how mjextension maps JSON/Plist data to Objective-C objects.
      3. Deliver the Payload: The attacker delivers the malicious payload to the application through any input vector that is processed by mjextension. This could be a network request, a file upload, or any other means of providing data to the application.
    • Why it's high risk and critical: This is the direct path to RCE. If the attacker succeeds at this step, they have achieved their goal.

Attack Tree Path: 1.3.2 Bypass blacklist/whitelist checks (if any)

  • Description: If mjextension or the application using it implements any form of class blacklisting (preventing certain classes from being deserialized) or whitelisting (allowing only specific classes), the attacker will attempt to bypass these checks.
    • How it works:
      • Class Name Obfuscation: The attacker might try variations of class names, using different capitalization, adding prefixes or suffixes, or using Unicode characters to try to trick the filtering mechanism.
      • Logic Flaws: The attacker might look for flaws in the implementation of the blacklist/whitelist. For example, if the check is performed using string comparisons, it might be vulnerable to case-sensitivity issues or other string manipulation tricks.
      • Indirect Instantiation: The attacker might try to find ways to indirectly instantiate a forbidden class, perhaps through a factory method or another mechanism that is not directly subject to the blacklist/whitelist check.
    • Why it is important: Successful bypass of these checks allows the attacker to proceed with the primary deserialization gadget attack (1.3.1.1), even if the application attempts to restrict the classes that can be instantiated.