Every Service Vulnerability Follows the Same Four-Step Pattern

#Stop Memorizing Exploits. Learn the Pattern.#link

I have reviewed over two hundred CVEs in my career. Different services, different protocols, different programming languages. And they all follow the same structure. A source feeds information into a process. That process runs with certain privileges. The result goes to a destination. Every single time. If you internalize this framework, you stop memorizing exploits and start understanding them.

The four categories are Source, Process, Privileges, and Destination. The Source is where attacker-controlled information enters. Could be an HTTP header, a filename, a SQL query, an FTP command. The Process is the code that handles that input. The Privileges determine what the process can actually do on the system. The Destination is where the result lands, local file, network socket, another service.

Why Does Log4j Fit This Perfectly?

Take CVE-2021-44228. The Source is the HTTP User-Agent header, manipulated by the attacker to contain a JNDI lookup string. The Process is the Log4j library function that logs the header but misinterprets the string as a command. The Privileges are administrator-level because logging frameworks typically run elevated. The Destination is the attacker's remote server that serves a malicious Java class.

Then the cycle repeats. The malicious Java class becomes the new Source. The process reads and executes it. Privileges remain elevated. The Destination is now a reverse shell back to the attacker. Two cycles of the same four-step pattern. That is the entire exploit.

That single header is the Source. Everything else is the target system's problem. The process misinterprets it. The privileges amplify it. The destination delivers your payload. You did not need to understand the internal Java bytecode. You needed to understand the pattern.

Use this framework when you read any CVE writeup. Map the vulnerability to the four categories. Where does attacker input enter? What code processes it? What rights does that code run with? Where does the output go? Do this ten times and you will start predicting attack paths before you finish reading the advisory. That is the difference between a script runner and an operator.