Exploit Chain Construction

Exploit Chain Construction

The Key Insight

Vulnerability scanners find individual issues. Elite reviewers find chains.

A "Medium" directory traversal + a "Low" information disclosure + a "Medium" SSRF = Critical RCE with data exfiltration. The individual findings are unremarkable. The chain is devastating.

This is the difference between a B-tier and S-tier security reviewer.

Chain Construction Methodology

Step 1: Map All Findings

After reviewing a codebase, list every finding regardless of severity:

• Information disclosures (error messages, stack traces, version leaks)
• Input validation gaps (missing sanitization, type coercion)
• Access control weaknesses (missing auth, IDOR, CSRF)
• Configuration issues (verbose errors, debug endpoints, permissive CORS)
• Injection points (XSS, SQLi, SSRF, command injection)
• Logic flaws (race conditions, state violations, missing checks)

Step 2: Build the Attack Graph

For each finding, ask:

1. What can the attacker learn or obtain from exploiting this? (tokens, IDs, internal URLs, error details)
2. What does each other vulnerability NEED as input? (valid session, user ID, internal URL, specific parameter)
3. Draw arrows: Finding A produces X → Finding B requires X → Finding B produces Y → Finding C requires Y

Step 3: Walk the Chain

Start from the attacker's initial position (unauthenticated, external) and walk through the graph:

Attacker (external, no auth)
  → Exploit vuln 1: gain information/access
    → Use output as input to vuln 2: escalate
      → Use output as input to vuln 3: achieve objective

Step 4: Assess Chain Severity

The chain's severity = the impact of the final step, not the average of individual findings.

Real-World Chain Patterns

Chain 1: SSRF → Cloud Metadata → Full Compromise

1. [MEDIUM] SSRF via Image optimization wildcard
2. [INFO] AWS metadata endpoint accessible (no IMDSv2)
3. [CRITICAL CHAIN] SSRF → fetch metadata → steal IAM creds → access S3/RDS/Lambda

Individual: Medium + Info = Low urgency Chained: CRITICAL — complete cloud infrastructure compromise

Chain 2: Prototype Pollution → Template Gadget → RCE

1. [MEDIUM] Prototype pollution via deep merge of user input
2. [INFO] EJS template engine in dependency tree
3. [CRITICAL CHAIN] Pollute outputFunctionName → EJS compilation → arbitrary code execution

Individual: Medium + Info (EJS is just a dependency) Chained: CRITICAL — unauthenticated RCE

Chain 3: Open Redirect → OAuth → Token Theft

1. [LOW] Open redirect on /callback?next=<url>
2. [INFO] OAuth flow uses redirect for token delivery
3. [HIGH CHAIN] Craft OAuth URL with redirect → user authenticates → token sent to attacker domain

Individual: Low + Info Chained: HIGH — auth token theft, account takeover

Chain 4: IDOR + CSRF → Account Takeover

1. [MEDIUM] IDOR on profile update (can update any user's email)
2. [MEDIUM] No CSRF protection on profile update endpoint
3. [CRITICAL CHAIN] Attacker hosts page → victim visits → CSRF changes victim's email → attacker resets password

Individual: Two mediums Chained: CRITICAL — full account takeover

Chain 5: XSS → Admin Session → Data Export

1. [MEDIUM] Stored XSS in user profile "bio" field
2. [INFO] Admin dashboard renders user profiles
3. [HIGH] Admin has bulk data export capability
4. [CRITICAL CHAIN] XSS in bio → admin views profile → session stolen → export all data

Chain 6: Race Condition → Double Spend → Financial Loss

1. [MEDIUM] TOCTOU in balance check (no DB locking)
2. [LOW] No idempotency on transfer endpoint
3. [HIGH CHAIN] Concurrent requests → balance check passes N times → N transfers of full balance

Chain 7: Information Leak → Targeted SSRF → Internal API → Data

1. [LOW] Stack trace reveals internal microservice URLs
2. [MEDIUM] SSRF via webhook URL parameter
3. [HIGH] Internal API has no auth (trusts network boundary)
4. [CRITICAL CHAIN] Learn internal URLs → SSRF to internal API → access database/admin functions

Chain Patterns for Our Stack (Next.js + Supabase)

Next.js Specific Chains

Missing auth on Server Action + IDOR on resource ID
→ Unauthenticated data modification of any user's resources

Verbose error in API route + SSRF via fetch proxy
→ Map internal infrastructure + access metadata

getSession() instead of getUser() + JWT tampering
→ Forge admin claims + access admin-only features

Image wildcard + redirect on allowed CDN
→ SSRF through image optimization → metadata theft

Supabase Specific Chains

Missing RLS on table + anon key in frontend (always true)
→ Complete database dump with single curl command

service_role in NEXT_PUBLIC_ + any frontend access
→ Full database bypass, complete CRUD on all tables

Missing RLS on storage.objects + public bucket
→ Access all user files, upload malicious content

SECURITY DEFINER function + missing auth check inside
→ RLS bypass via RPC function call

Cross-Stack Chains

XSS in React component + Supabase session token in cookie (not HttpOnly)
→ Session theft → full account access

Race condition on entry submission + missing unique constraint
→ Bypass entry limit → unfair advantage in competition

Open redirect + OAuth callback + Supabase Auth
→ Steal auth tokens during social login flow

How to Present Chains in Reviews

Chain Finding Format

## 🔗 Exploit Chain: [Name]

**Chain Severity**: CRITICAL
**Individual Findings**: F1 (Medium) + F2 (Low) + F3 (Medium)
**Chain Impact**: [Full description of what attacker achieves]

### Attack Path
1. **F1**: [Finding] — attacker gains [output]
2. **F2**: [Finding] — using [F1 output], attacker obtains [output]  
3. **F3**: [Finding] — using [F2 output], attacker achieves [final impact]

### Why These Chain
[Explain the logical connection between findings]

### Fix Priority
Fix **F1** first — it breaks the entire chain.
[Or: Fix F3 — it's the highest impact step and may be easiest to patch]

Chain-Breaking Strategy

You don't have to fix every link. Breaking ONE link breaks the chain:

• Break at the cheapest point: Which fix requires least effort?
• Break at the earliest point: Stops the attacker soonest
• Break at the highest-impact point: Even if other links survive, the final step fails
• Defense in depth: Fix multiple links (preferred for critical chains)

Training the Chain Mindset

After every code review, spend 5 minutes asking:

1. "If I were attacking this app, where would I start?" — What's the weakest entry point?
2. "What does this finding give me?" — Not just the direct impact, but what INFORMATION or ACCESS does it provide?
3. "What could I do with that?" — Which other weakness becomes exploitable with this new capability?
4. "What's the worst case?" — Follow the chain to its logical end

This is the mindset that separates a vulnerability lister from a threat modeler.

Integration with Review Process

Add as Phase 11: Chain Analysis (after Phase 10: Adversarial Review):

1. List all findings from the review (including P3/Low severity)
2. For each finding, document what it PROVIDES to an attacker
3. Draw connections between findings
4. Walk any chains from external attacker to critical impact
5. If chains exist, escalate the chain severity to the verdict
6. Recommend chain-breaking fixes in priority order

References

For individual vulnerability detection, see all other security skills. For detailed chain examples by category, see references/chain-examples.md.