markdown-converter/.security-hardening/02-threat-model.md

STRIDE Threat Model - MarkdownConverter v4.0.0

Analysis Date: 2026-03-15 Methodology: STRIDE + MITRE ATT&CK Overall Risk Score: 7.8 (HIGH)

---

Executive Summary

The analysis identified 10 vulnerabilities with a combined risk score of 7.8 (HIGH). The most critical issues enable complete system compromise through XSS-to-RCE attack chains.

---

Critical Findings

Priority	CVE	Vulnerability	CVSS	Impact
P0	CVE-MC-001	Insecure Electron Config (nodeIntegration: true, contextIsolation: false)	9.6	Complete system compromise
P0	CVE-MC-002	Arbitrary code execution via REPL feature	9.3	Remote code execution
P1	CVE-MC-003	XSS in markdown rendering	8.0	Session hijacking, RCE chain
P1	CVE-MC-004	Path traversal vulnerability	7.8	Arbitrary file write
P1	CVE-MC-005	Weak Content Security Policy	7.5	XSS enablement
P2	CVE-MC-006	Insecure window config for PDF export	6.5	Privilege escalation
P2	CVE-MC-007	PlantUML server data exfiltration	5.3	Information disclosure
P2	CVE-MC-008	Inconsistent security settings	5.5	Configuration weakness
P3	CVE-MC-009	Command execution via external tools	4.4	Command injection risk
P3	CVE-MC-010	Missing dependency version pinning	3.5	Supply chain risk

---

Key Attack Vectors

1. XSS to RCE Chain (Critical)

Malicious Markdown File
        │
        ▼
XSS in Preview (CVE-MC-003)
        │
        ▼
nodeIntegration: true (CVE-MC-001)
        │
        ▼
Full Node.js Access
        │
        ▼
Complete System Compromise

2. REPL Code Execution (Critical)

Code Block in Markdown
        │
        ▼
User clicks "Run"
        │
        ▼
REPL executes Python/Bash (CVE-MC-002)
        │
        ▼
Arbitrary Code Execution

3. Data Exfiltration (Medium)

PlantUML Diagram Content
        │
        ▼
Sent to www.plantuml.com (CVE-MC-007)
        │
        ▼
Sensitive Architecture Leaked

---

STRIDE Analysis

S - Spoofing

ID	Threat	Likelihood	Impact	Risk
S1	Attacker spoofs markdown file origin	Medium	High	High
S2	Malicious code pretends to be safe	High	Critical	Critical

T - Tampering

ID	Threat	Likelihood	Impact	Risk
T1	XSS modifies local files	High	Critical	Critical
T2	Conversion output tampered	Medium	Medium	Medium

R - Repudiation

ID	Threat	Likelihood	Impact	Risk
R1	No audit trail for operations	Low	Low	Low

I - Information Disclosure

ID	Threat	Likelihood	Impact	Risk
I1	XSS exposes file system	High	Critical	Critical
I2	PlantUML content leaked	Medium	Medium	Medium
I3	Error messages reveal paths	Low	Low	Low

D - Denial of Service

ID	Threat	Likelihood	Impact	Risk
D1	Malicious code crashes app	Medium	Medium	Medium
D2	Large file exhausts resources	Low	Low	Low

E - Elevation of Privilege

ID	Threat	Likelihood	Impact	Risk
E1	XSS → nodeIntegration → System	High	Critical	Critical
E2	REPL code execution	High	Critical	Critical

---

MITRE ATT&CK Mapping

Technique	ID	Applicability
User Execution	T1204.002	Malicious markdown file
Command and Scripting Interpreter	T1059.007	JavaScript via nodeIntegration
Command and Scripting Interpreter	T1059.006	Python via REPL
Command and Scripting Interpreter	T1059.004	Bash via REPL
Exploit Public-Facing Application	T1190	XSS in preview
Data Exfiltration Over Web Service	T1043	PlantUML server
File and Directory Discovery	T1083	Path traversal

---

Trust Boundaries

┌─────────────────────────────────────────────────────────────────────┐
│                         TRUST BOUNDARY MAP                          │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│   ┌─────────────┐         ┌─────────────────────────────────────┐  │
│   │   USER      │ ──────► │        APPLICATION                  │  │
│   │ (Untrusted) │         │  ┌───────────┐  ┌───────────────┐  │  │
│   └─────────────┘         │  │ Renderer  │  │ Main Process  │  │  │
│                           │  │ (Sandbox) │  │ (Privileged)  │  │  │
│                           │  └─────┬─────┘  └───────┬───────┘  │  │
│                           │        │  IPC           │           │  │
│                           │        ▼                ▼           │  │
│                           │  ┌─────────────────────────────┐   │  │
│                           │  │      File System            │   │  │
│                           │  └─────────────────────────────┘   │  │
│                           └─────────────────────────────────────┘  │
│                                           │                        │
│                                           ▼                        │
│   ┌─────────────────────────────────────────────────────────────┐ │
│   │                    EXTERNAL SERVICES                         │ │
│   │  • PlantUML Server (www.plantuml.com)                       │ │
│   │  • CDN (cdn.jsdelivr.net, cdnjs.cloudflare.com) [REMOVED]   │ │
│   │  • External Tools (Pandoc, FFmpeg, LibreOffice)             │ │
│   └─────────────────────────────────────────────────────────────┘ │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘

---

Business Impact Analysis

Successful Attack Consequences

Impact Category	Estimate
Data breach costs	$500,000 - $5,000,000+
Regulatory fines (GDPR)	Up to 4% annual revenue
Reputation damage	Incalculable
Business disruption	Hours to days

Affected Assets

• User documents and files
• System credentials
• Proprietary information in diagrams
• Application integrity

---

Remediation Priority

P0 - Immediate (24-48 hours)

1. CVE-MC-001: Set nodeIntegration: false, contextIsolation: true
2. CVE-MC-002: Remove or sandbox REPL code execution

P1 - Short-term (1-2 weeks)

3. CVE-MC-003: Audit markdown extensions for XSS
4. CVE-MC-004: Add path validation (✅ COMPLETED)
5. CVE-MC-005: Strengthen CSP (✅ COMPLETED)

P2 - Medium-term (1 month)

6. CVE-MC-006: Consistent window security settings
7. CVE-MC-007: Add local PlantUML option or warning
8. CVE-MC-008: Audit all BrowserWindow configurations

P3 - Long-term

9. CVE-MC-009: Validate filenames for external tools
10. CVE-MC-010: Pin dependency versions, add scanning

---

Conclusion

The MarkdownConverter application has a HIGH RISK threat profile due to the combination of:

• Untrusted content rendering (markdown preview)
• Direct system access (nodeIntegration)
• Code execution capability (REPL)

Immediate action required on P0 items to reduce attack surface.

The fixes applied in this session (CSP, path traversal, UI accessibility) have reduced the risk profile, but the critical nodeIntegration issue requires significant refactoring.