cross-domain-attack-chain

Web/AI Cross-Domain Attack Chain Methodology

Overview

In modern systems, Web services and AI/LLM components share data pipelines and infrastructure. Low-severity vulnerabilities at the Web layer (such as restricted SSRF) can escalate to Prompt injection when they reach internal model APIs; conversely, Prompt injection can produce stored XSS by writing back to the database through the Agent toolchain. The value of cross-domain attack chains lies in chaining "medium-to-low severity" issues from two domains into "high/critical severity" ones.

Overview of Cross-Domain Attack Paths

Direction	ID	Entry Vulnerability	Cross-Domain Pivot	Final Impact
Web→AI	W2A-1	XSS	Hijack AI conversation interface	Steal conversation content/inject malicious context
Web→AI	W2A-2	SSRF	Access internal model API	Obtain embeddings/directly execute prompts
Web→AI	W2A-3	SQLi	Modify vector database records	Poison RAG retrieval results
Web→AI	W2A-4	File upload	Upload documents containing hidden instructions	RAG poisoning/indirect injection
Web→AI	W2A-5	API privilege escalation	Unauthenticated management interface	Tamper with System Prompt/model configuration
AI→Web	A2W-1	Prompt injection	Unescaped model output	Generate stored XSS payload
AI→Web	A2W-2	Agent hijacking	SQL/command tools	Execute arbitrary SQL queries or system commands
AI→Web	A2W-3	Tool abuse	File read tool	Read sensitive server files
AI→Web	A2W-4	Code execution	Sandbox escape	Reverse shell/RCE
AI→Web	A2W-5	MCP poisoning	External callback tool	Data exfiltration to attacker server

Phase 0: Attack Surface Mapping

• Identify all interaction points between Web and AI components in the system: RAG data sources (databases, file storage, CMS), model API endpoints, shared caches/queues
• Draw a data flow diagram, marking which Web user inputs ultimately enter the LLM context (directly or via RAG retrieval)
• Confirm the paths by which AI output is written back to the Web layer: whether it is directly rendered to the page, stored in the database, or triggers backend operations

Phase 1: Web→AI Attack Paths

1.1 XSS → Steal AI conversations/inject context Use XSS to hijack the user's WebSocket or API session with the AI, steal conversation history, or inject malicious context (GAARM.0040.001). The key lies in whether the AI chat interface renders Markdown/HTML img tags as actual requests, thereby exfiltrating session content through img src .

1.2 SSRF → Invoke internal model API If Web-layer SSRF can reach internal model endpoints, it can directly send prompt requests, obtain embeddings, or modify parameters. The Agent's own network access capability may also become an SSRF pivot (GAARM.0041.001).

1.3 SQLi → Poison RAG vector database When a RAG system uses a relational database to store document chunks or metadata, SQL injection can modify the retrieved content, indirectly injecting malicious instructions into the LLM context and achieving persistent indirect prompt injection.

1.4 File Upload → RAG Poisoning Upload documents containing hidden instructions (white text in PDFs, hidden paragraphs in DOCX, text in image EXIF), and after the documents are indexed by the RAG pipeline, the hidden instructions are injected into the model context during the retrieval phase.

1.5 API Privilege Escalation → Modify System Prompt/Model Configuration If the management interface lacks authentication or has IDOR, attackers can directly modify the System Prompt, adjust model temperature parameters, and switch the underlying model version, fundamentally changing the AI's behavioral boundaries.

Phase 2: AI→Web Attack Path

2.1 Prompt Injection → Generate Stored XSS Induce the model to generate HTML fragments containing <script> or event handlers; if the Web layer does not perform output encoding on AI output, the payload is stored and executed when other users browse.

2.2 Agent Hijacking → Execute SQL/System Commands Through indirect injection, hijack the Agent's objective so that it calls the database query tool to execute DROP TABLE or calls the shell tool to execute system commands (GAARM.0041.002), with the impact acting directly on the Web backend infrastructure.

2.3 Tool Abuse → Read Sensitive Files Hijack the Agent's file system tool to read .env, database credentials, TLS private keys, and other server sensitive files, and pass the contents to the attacker through dialogue output or callback mechanisms.

2.4 Sandbox Escape → Reverse Shell If a code-execution Agent has insufficient sandbox isolation, prompt injection can induce it to generate and execute an escape payload, obtain host shell privileges, and complete the penetration from the AI layer to the infrastructure layer.

2.5 MCP Poisoning → Data Exfiltration Through tool description poisoning by a malicious MCP Server, hijack the Agent so that when calling legitimate tools it also performs data exfiltration actions, sending user conversations or internal data to the attacker's server via HTTP callbacks.

Attack Chain Combination Decision

Available Entry Points	Recommended Combination Path	Expected Severity
XSS + AI Chat Interface	W2A-1 → Steal Conversation → Extract Internal Information	High
SSRF + Internal Model Endpoint	W2A-2 → Direct Prompt → Information Leakage/Subsequent Injection	Critical
File Upload + RAG Pipeline	W2A-4 → RAG Poisoning → A2W-1 Stored XSS	Critical
SQLi + Vector Database	W2A-3 → Persistent Injection → A2W-2 Agent Executes Commands	Critical
Prompt Injection + Agent Tools	A2W-2/A2W-3 → Read Credentials → Lateral Movement	Critical
MCP Third-Party Server	A2W-5 → Data Exfiltration + A2W-2 Command Execution	High

Detection Checklist

1. [ ] Web 与 AI 组件的交互点已完整映射？数据流方向已标注？
2. [ ] Web 用户输入到 LLM 上下文的路径是否存在注入点？
3. [ ] AI 输出回写到 Web 层时是否做了输出编码和消毒？
4. [ ] RAG 数据源（数据库/文件存储）是否对写入做了权限控制？
5. [ ] 内部模型 API 是否限制了网络访问来源？
6. [ ] Agent 工具调用是否有参数校验和权限隔离？
7. [ ] 文件上传到 RAG 索引的管道是否检测隐藏指令？
8. [ ] 跨域攻击链的组合路径是否纳入威胁建模？