markdown-converter/.security-hardening/02-threat-model.md

# STRIDE Threat Model - MarkdownConverter v4.0.0

**Analysis Date:** 2026-03-15
**Methodology:** STRIDE + MITRE ATT&CK
**Overall Risk Score:** 7.8 (HIGH)

---

## Executive Summary

The analysis identified **10 vulnerabilities** with a combined risk score of **7.8 (HIGH)**. The most critical issues enable complete system compromise through XSS-to-RCE attack chains.

---

## Critical Findings

| Priority | CVE | Vulnerability | CVSS | Impact |
|----------|-----|---------------|------|--------|
| P0 | CVE-MC-001 | Insecure Electron Config (`nodeIntegration: true`, `contextIsolation: false`) | 9.6 | Complete system compromise |
| P0 | CVE-MC-002 | Arbitrary code execution via REPL feature | 9.3 | Remote code execution |
| P1 | CVE-MC-003 | XSS in markdown rendering | 8.0 | Session hijacking, RCE chain |
| P1 | CVE-MC-004 | Path traversal vulnerability | 7.8 | Arbitrary file write |
| P1 | CVE-MC-005 | Weak Content Security Policy | 7.5 | XSS enablement |
| P2 | CVE-MC-006 | Insecure window config for PDF export | 6.5 | Privilege escalation |
| P2 | CVE-MC-007 | PlantUML server data exfiltration | 5.3 | Information disclosure |
| P2 | CVE-MC-008 | Inconsistent security settings | 5.5 | Configuration weakness |
| P3 | CVE-MC-009 | Command execution via external tools | 4.4 | Command injection risk |
| P3 | CVE-MC-010 | Missing dependency version pinning | 3.5 | Supply chain risk |

---

## Key Attack Vectors

### 1. XSS to RCE Chain (Critical)
```
Malicious Markdown File
        │
        ▼
XSS in Preview (CVE-MC-003)
        │
        ▼
nodeIntegration: true (CVE-MC-001)
        │
        ▼
Full Node.js Access
        │
        ▼
Complete System Compromise
```

### 2. REPL Code Execution (Critical)
```
Code Block in Markdown
        │
        ▼
User clicks "Run"
        │
        ▼
REPL executes Python/Bash (CVE-MC-002)
        │
        ▼
Arbitrary Code Execution
```

### 3. Data Exfiltration (Medium)
```
PlantUML Diagram Content
        │
        ▼
Sent to www.plantuml.com (CVE-MC-007)
        │
        ▼
Sensitive Architecture Leaked
```

---

## STRIDE Analysis

### S - Spoofing
| ID | Threat | Likelihood | Impact | Risk |
|----|--------|------------|--------|------|
| S1 | Attacker spoofs markdown file origin | Medium | High | High |
| S2 | Malicious code pretends to be safe | High | Critical | Critical |

### T - Tampering
| ID | Threat | Likelihood | Impact | Risk |
|----|--------|------------|--------|------|
| T1 | XSS modifies local files | High | Critical | Critical |
| T2 | Conversion output tampered | Medium | Medium | Medium |

### R - Repudiation
| ID | Threat | Likelihood | Impact | Risk |
|----|--------|------------|--------|------|
| R1 | No audit trail for operations | Low | Low | Low |

### I - Information Disclosure
| ID | Threat | Likelihood | Impact | Risk |
|----|--------|------------|--------|------|
| I1 | XSS exposes file system | High | Critical | Critical |
| I2 | PlantUML content leaked | Medium | Medium | Medium |
| I3 | Error messages reveal paths | Low | Low | Low |

### D - Denial of Service
| ID | Threat | Likelihood | Impact | Risk |
|----|--------|------------|--------|------|
| D1 | Malicious code crashes app | Medium | Medium | Medium |
| D2 | Large file exhausts resources | Low | Low | Low |

### E - Elevation of Privilege
| ID | Threat | Likelihood | Impact | Risk |
|----|--------|------------|--------|------|
| E1 | XSS → nodeIntegration → System | High | Critical | Critical |
| E2 | REPL code execution | High | Critical | Critical |

---

## MITRE ATT&CK Mapping

| Technique | ID | Applicability |
|-----------|-----|---------------|
| User Execution | T1204.002 | Malicious markdown file |
| Command and Scripting Interpreter | T1059.007 | JavaScript via nodeIntegration |
| Command and Scripting Interpreter | T1059.006 | Python via REPL |
| Command and Scripting Interpreter | T1059.004 | Bash via REPL |
| Exploit Public-Facing Application | T1190 | XSS in preview |
| Data Exfiltration Over Web Service | T1043 | PlantUML server |
| File and Directory Discovery | T1083 | Path traversal |

---

## Trust Boundaries

```
┌─────────────────────────────────────────────────────────────────────┐
│                         TRUST BOUNDARY MAP                          │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│   ┌─────────────┐         ┌─────────────────────────────────────┐  │
│   │   USER      │ ──────► │        APPLICATION                  │  │
│   │ (Untrusted) │         │  ┌───────────┐  ┌───────────────┐  │  │
│   └─────────────┘         │  │ Renderer  │  │ Main Process  │  │  │
│                           │  │ (Sandbox) │  │ (Privileged)  │  │  │
│                           │  └─────┬─────┘  └───────┬───────┘  │  │
│                           │        │  IPC           │           │  │
│                           │        ▼                ▼           │  │
│                           │  ┌─────────────────────────────┐   │  │
│                           │  │      File System            │   │  │
│                           │  └─────────────────────────────┘   │  │
│                           └─────────────────────────────────────┘  │
│                                           │                        │
│                                           ▼                        │
│   ┌─────────────────────────────────────────────────────────────┐ │
│   │                    EXTERNAL SERVICES                         │ │
│   │  • PlantUML Server (www.plantuml.com)                       │ │
│   │  • CDN (cdn.jsdelivr.net, cdnjs.cloudflare.com) [REMOVED]   │ │
│   │  • External Tools (Pandoc, FFmpeg, LibreOffice)             │ │
│   └─────────────────────────────────────────────────────────────┘ │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘
```

---

## Business Impact Analysis

### Successful Attack Consequences

| Impact Category | Estimate |
|-----------------|----------|
| Data breach costs | $500,000 - $5,000,000+ |
| Regulatory fines (GDPR) | Up to 4% annual revenue |
| Reputation damage | Incalculable |
| Business disruption | Hours to days |

### Affected Assets
- User documents and files
- System credentials
- Proprietary information in diagrams
- Application integrity

---

## Remediation Priority

### P0 - Immediate (24-48 hours)
1. **CVE-MC-001**: Set `nodeIntegration: false`, `contextIsolation: true`
2. **CVE-MC-002**: Remove or sandbox REPL code execution

### P1 - Short-term (1-2 weeks)
3. **CVE-MC-003**: Audit markdown extensions for XSS
4. **CVE-MC-004**: Add path validation (✅ COMPLETED)
5. **CVE-MC-005**: Strengthen CSP (✅ COMPLETED)

### P2 - Medium-term (1 month)
6. **CVE-MC-006**: Consistent window security settings
7. **CVE-MC-007**: Add local PlantUML option or warning
8. **CVE-MC-008**: Audit all BrowserWindow configurations

### P3 - Long-term
9. **CVE-MC-009**: Validate filenames for external tools
10. **CVE-MC-010**: Pin dependency versions, add scanning

---

## Conclusion

The MarkdownConverter application has a **HIGH RISK** threat profile due to the combination of:
- Untrusted content rendering (markdown preview)
- Direct system access (nodeIntegration)
- Code execution capability (REPL)

**Immediate action required on P0 items to reduce attack surface.**

The fixes applied in this session (CSP, path traversal, UI accessibility) have reduced the risk profile, but the critical nodeIntegration issue requires significant refactoring.