Exploit Chains

> The best-paid reports in the corpus are rarely one bug — they are a chain where each link > upgrades the impact of the last. A "medium" SSRF becomes a critical when it reaches cloud metadata; > a "low" open redirect becomes account takeover when it sits in an OAuth flow. This page catalogs the > recurring escalation patterns distilled from ~1,980 mined reports that carried an explicit chain, > so you learn to look for the next rung instead of stopping at first blood.

Cross-links: every vulnerabilities/* and attack-surface/* page has an "Escalation & chaining" section that feeds this catalog. See also 2.

§The escalation ladder (mental model)

§Pattern 1 — Email-verification / SSO merge → account & store takeover

The single highest-signal chain in the corpus (Shopify family, thousands of votes). An email-verification bypass lets you bind an attacker-controlled identity to a victim's email; SSO then merges accounts, handing over every same-email store.

• #867513 (v2993): email-verify bypass → verified Shopify ID → SSO account merge → full store takeover.
• #791775 (v1913): email-verify bypass → SSO merge → master password over all same-email stores.
• #910300 (v559): email-verification bypass → SSO identity bind → full store + partner account takeover.
• Insight: wherever "verified email" is a trust anchor for SSO/account-linking, attack the

verification, not the login. See 0.

§Pattern 2 — SSRF → cloud metadata → infrastructure

• #341876 (v577): HTML-render SSRF → GCP metadata token + kube-env → kubelet client cert →

kubectl pod exec → root on all containers ($25k).

• #2262382 (v516): HTML injection → server-side PDF render SSRF → AWS IMDS → credentials.
• #422944 (v830): image upload → ImageMagick delegate → Ghostscript %pipe% RCE → AWS IMDS IAM creds.
• Insight: any server-side renderer (screenshot/PDF/image) is an SSRF gun aimed at the metadata

service. See 0, 1.

§Pattern 3 — Open redirect / origin bypass → OAuth token theft → ATO

• #1567186 (v506): OAuth response_mode switch → token in reddit.com fragment → redditmedia

XSS reads window.name → token exfil.

• #129873 (v616): origin bypass → associate attacker phone → password reset → ATO.
• #401793 (v547): deeplink open-redirect → WebView JS bridge → account-data exfil.
• Insight: open redirect is "low" alone; in an OAuth/redirect_uri or WebView context it is ATO.

See 0, 1.

§Pattern 4 — HTTP request smuggling → cache poisoning / token exfiltration

• #737140 (v867): CL.TE desync → request-line rewrite → backend 301 open-redirect → victim cookie leak.
• #771666 (v559): CL.TE desync → smuggled absolute-URL GET → backend 301 → X-Access-Token exfiltration.
• #488147 (v683): desync → cached redirect → stored XSS on the sign-in page.
• See 0, 1.

§Pattern 5 — File read / injection → secrets → full compromise

• #827052 (v1500): arbitrary file read → leak secrets.yml/tokens/config.
• #591295 (v1239): pre-auth file read (CVE-2019-11510) → cached plaintext creds/session → 2FA bypass → admin.
• #658013 (v777): flag injection --output → overwrite ~git/.ssh/authorized_keys → SSH RCE.
• #716292 (v738): leaked key → internal API → AWS account takeover.
• See 0, 1.

§Pattern 6 — File upload → webshell / parser RCE

• #506646 (v687): upload filter bypass → webshell → OS command + source/DB disclosure.
• #422944: see Pattern 2 (ImageMagick delegate RCE).
• See 0.

§Pattern 7 — Client/desktop XSS → RCE (Electron/WebView/native)

• #873614 (v777): missing Origin check → command injection into Electron nav → nodeIntegration → child_process.
• #783877 (v507): HTML injection → in-app _self redirect → BrowserWindow leak → nodeIntegration window.
• #409850 (v493): XSS → custom protocol handler → RCE.
• See 0, 1.

§Pattern 8 — Memory corruption → ROP → RCE → kernel/sandbox escape

• #470520 (v1287): malicious web page → hidden iframe steam:// → A2S_PLAYER overflow →

unicode ROP → RCE.

• #826026 (v741): WebKit sandbox → setsockopt UAF → hijack ip6po_pktinfo → kernel R/W → kernel code exec.
• See 0.

§Pattern 9 — Subdomain takeover → cookie/CORS theft → account access

• #335330 (v780): subdomain takeover → steal .roblox.com cookies / CORS-read chat → account access.
• See 0, 1.

§Pattern 10 — IDOR / access-control → token leak → tenant-wide impact

• #542340 (v642): IDOR → leaked mobile auth token → account takeover.
• #446585 (v758): import → instance-wide service template → mass exfiltration/mutation of other

tenants' resources.

• See 0, 1.

§How to hunt chains

1. On every finding, ask "so what?" until you hit business impact (see triage-and-impact).
2. Keep a bag of primitives (redirect, XSS, SSRF, id leak, file read) and try to connect them.
3. Re-read the app's disclosed reports (this corpus) — patched bugs leave adjacent, chainable variants.
4. Prove the whole chain in the PoC; "could lead to" is worth a fraction of a demonstrated chain.

The full set of ~1,980 chained reports is in 0; each class page lists its own chains.