Vulnerability Chaining for Higher Impact

Vulnerability chaining combines multiple lower-severity vulnerabilities into a single exploit chain with a higher overall impact. A chain of SSRF + IMDS access + IAM credential theft has far greater impact than any individual component rated alone.

Programs reward impact, not individual bug count. A low-severity XSS combined with a self-XSS bypass + CSRF to trigger it may constitute an account takeover chain worth high/critical reward instead of three separate low-severity submissions.

Self-XSS is normally rejected (you attack yourself). But chain it with a CSRF that forces a victim to trigger the XSS payload in their session. Now the attacker can execute arbitrary JS in the victim's context — account takeover. Two low findings = critical chain.

Server-Side Request Forgery that only reaches internal infrastructure (normally medium) becomes critical when chained with access to the AWS EC2 metadata service (169.254.169.254) to steal IAM credentials, then using those credentials for full AWS account access.

An open redirect on example.com allows redirecting OAuth authorization responses to an attacker-controlled URL. Chain with a phishing setup to steal OAuth authorization codes, redeem them server-side, and gain full account access. Two medium findings = critical.

Host header injection in password reset emails allows a victim's reset link to point to an attacker-controlled server. When the victim clicks, the attacker receives the reset token and takes over the account — host header injection (low) becomes account takeover (critical).

Think about what each vulnerability provides: SSRF = ability to make requests from the server, XSS = JS execution in victim's browser, CSRF = force authenticated actions, open redirect = control of redirect destination. Connect what one provides to what another requires.

When reporting a chain, demonstrate each step of the chain with distinct HTTP requests and responses. Show the precondition → first bug triggers → provides X → second bug uses X to achieve Y → final impact. Every link in the chain must be proven, not theoretical.

High-value chain components: information disclosure (reveals internal IPs, usernames), SSRF (internal access), open redirect (token theft pivot), XSS (JS execution), CSRF (force actions), IDOR (access to other resources), weak JWT (session forgery). Learn all of these well.

Note seemingly low-impact findings during recon instead of dismissing them. A reflected parameter with only numeric values might be usable in a chain. Track findings in a local note system and revisit them when you find connecting pieces.

Only demonstrate chains to the extent necessary to prove impact. If SSRF can access IMDS, show the credentials returned but do not actually use them. Document the escalation path without fully exploiting it to avoid causing real harm.

Why are self-XSS vulnerabilities often rejected in isolation but valuable in chains?

Vulnerability chaining transforms low-severity findings into high-impact exploit chains. By understanding what each vulnerability provides and what it enables, researchers combine SSRF + IMDS, XSS + CSRF, and open redirect + OAuth theft to demonstrate critical impact and maximize rewards.