Skip to content

Commit 1ae96d2

Browse files
zinwangzinwang
authored
Update CWE showcases (#43)
1 parent 92c48e3 commit 1ae96d2

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+1261
-638
lines changed

‎CWE-117/CWE-117.py

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
for logOutputBehavior in quarkResult.behaviorOccurList:
1111

12-
secondAPIParam = logOutputBehavior.getParamValues()[1]
12+
secondAPIParam = logOutputBehavior.secondAPI.getArguments()
1313

1414
isKeywordFound = False
1515
for keyword in KEYWORDS_FOR_NEUTRALIZATION:
@@ -18,4 +18,5 @@
1818
break
1919

2020
if not isKeywordFound:
21-
print(f"CWE-117 is detected in method,{secondAPIParam}")
21+
caller = logOutputBehavior.methodCaller.fullName
22+
print(f"CWE-117 is detected in method, {caller}")

‎CWE-117/README.md

Lines changed: 28 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,27 @@
11
# Detect CWE-117 in Android Application (allsafe.apk)
2-
This scenario seeks to find **Improper Output Neutralization for Logs**. See [CWE-117](https://cwe.mitre.org/data/definitions/117.html) for more details.
32

4-
Let’s use this [APK](https://github.com/t0thkr1s/allsafe) and the above APIs to show how the Quark script finds this vulnerability.
53

6-
First, we design a detection rule ``writeContentToLog.json`` to spot on behavior using the method that writes contents to the log file.
4+
This scenario seeks to find **Improper Output Neutralization for Logs**.
5+
See [CWE-117](https://cwe.mitre.org/data/definitions/117.html) for more
6+
details.
77

8-
Then, we use ``behaviorInstance.getParamValues()`` to get all parameter values of this method. And we check if these parameters contain keywords of APIs for neutralization, such as escape, replace, format, and setFilter.
8+
Let's use this [APK](https://github.com/t0thkr1s/allsafe) and the above
9+
APIs to show how the Quark script finds this vulnerability.
910

10-
If the answer is **YES**, that may result in secret context leakage into the log file, or the attacker may perform log forging attacks.
11+
First, we design a detection rule `writeContentToLog.json` to spot on
12+
behavior using the method that writes contents to the log file.
13+
14+
Then, we use `methodInstance.getArguments()` to get all parameter values
15+
of this method. And we check if these parameters contain keywords of
16+
APIs for neutralization, such as `escape`, `replace`, `format`, and
17+
`setFilter`.
18+
19+
If the answer is **YES**, that may result in secret context leakage into
20+
the log file, or the attacker may perform log forging attacks.
1121

1222
## Quark Script CWE-117.py
13-
```python
1423

24+
``` python
1525
from quark.script import Rule, runQuarkAnalysis
1626

1727
SAMPLE_PATH = "allsafe.apk"
@@ -22,21 +32,23 @@ ruleInstance = Rule(RULE_PATH)
2232
quarkResult = runQuarkAnalysis(SAMPLE_PATH, ruleInstance)
2333

2434
for logOutputBehavior in quarkResult.behaviorOccurList:
25-
26-
secondAPIParam = logOutputBehavior.getParamValues()[1]
27-
35+
36+
secondAPIParam = logOutputBehavior.secondAPI.getArguments()
37+
2838
isKeywordFound = False
2939
for keyword in KEYWORDS_FOR_NEUTRALIZATION:
3040
if keyword in secondAPIParam:
3141
isKeywordFound = True
3242
break
3343

3444
if not isKeywordFound:
35-
print(f"CWE-117 is detected in method,{secondAPIParam}")
45+
caller = logOutputBehavior.methodCaller.fullName
46+
print(f"CWE-117 is detected in method, {caller}")
3647
```
3748

3849
## Quark Rule: writeContentToLog.json
39-
```json
50+
51+
``` json
4052
{
4153
"crime": "Write contents to the log.",
4254
"permission": [],
@@ -56,10 +68,12 @@ for logOutputBehavior in quarkResult.behaviorOccurList:
5668
"label": []
5769
}
5870
```
71+
5972
## Quark Script Result
60-
- **allsafe.apk**
6173

62-
```
74+
- **allsafe.apk**
75+
76+
``` TEXT
6377
$ python CWE-117.py
64-
CWE-117 is detected in method,Ljava/lang/StringBuilder;->toString()Ljava/lang/String;(Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;(Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;(Ljava/lang/StringBuilder;-><init>()V(Ljava/lang/StringBuilder;),User entered secret: ),Ljava/lang/Object;->toString()Ljava/lang/String;(Lcom/google/android/material/textfield/TextInputEditText;->getText()Landroid/text/Editable;())))
78+
CWE-117 is detected in method, Linfosecadventures/allsafe/challenges/InsecureLogging; lambda$onCreateView$0 (Lcom/google/android/material/textfield/TextInputEditText; Landroid/widget/TextView; I Landroid/view/KeyEvent;)Z
6579
```

‎CWE-20/CWE-20.py

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
from quark.script import runQuarkAnalysis, Rule
2+
3+
SAMPLE_PATH = "diva.apk"
4+
RULE_PATH = "openUrlThatUserInput.json"
5+
6+
rule = Rule(RULE_PATH)
7+
result = runQuarkAnalysis(SAMPLE_PATH, rule)
8+
9+
VALIDATE_METHODS = ["contains", "indexOf", "matches", "replaceAll"]
10+
11+
for openUrl in result.behaviorOccurList:
12+
calledMethods = openUrl.getMethodsInArgs()
13+
14+
if not any(
15+
method.methodName in VALIDATE_METHODS for method in calledMethods
16+
):
17+
print(f"CWE-20 is detected in method, {openUrl.methodCaller.fullName}")

‎CWE-20/README.md

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
# Detect CWE-20 in Android Application
2+
3+
4+
This scenario seeks to find **Improper Input Validation** in the APK
5+
file.
6+
7+
## CWE-20 Improper Input Validation
8+
9+
We analyze the definition of CWE-20 and identify its characteristics.
10+
11+
See [CWE-20](https://cwe.mitre.org/data/definitions/20.html) for more
12+
details.
13+
14+
![image](https://imgur.com/21CzFUq.jpg)
15+
16+
## Code of CWE-20 in diva.apk
17+
18+
We use the [diva.apk](https://github.com/payatu/diva-android) sample to
19+
explain the vulnerability code of CWE-20.
20+
21+
![image](https://imgur.com/kRIuEHd.jpg)
22+
23+
## Quark Script CWE-20.py
24+
25+
Let's use the above APIs to show how the Quark script finds this
26+
vulnerability.
27+
28+
First, we design a detection rule `openUrlThatUserInput.json`, to spot
29+
the behavior of opening the URL that the user inputs. Then, we use API
30+
`behaviorInstance.getMethodsInArgs()` to get a list of methods that the
31+
URL in `loadUrl` passes through. Finally, we check if any validation
32+
method is in the list. If No, the APK does not validate user input. That
33+
causes CWE-20 vulnerability.
34+
35+
``` python
36+
from quark.script import runQuarkAnalysis, Rule
37+
38+
SAMPLE_PATH = "diva.apk"
39+
RULE_PATH = "openUrlThatUserInput.json"
40+
41+
rule = Rule(RULE_PATH)
42+
result = runQuarkAnalysis(SAMPLE_PATH, rule)
43+
44+
VALIDATE_METHODS = ["contains", "indexOf", "matches", "replaceAll"]
45+
46+
for openUrl in result.behaviorOccurList:
47+
calledMethods = openUrl.getMethodsInArgs()
48+
49+
if not any(
50+
method.methodName in VALIDATE_METHODS for method in calledMethods
51+
):
52+
print(f"CWE-20 is detected in method, {openUrl.methodCaller.fullName}")
53+
```
54+
55+
## Quark Rule: openUrlThatUserInput.json
56+
57+
``` json
58+
{
59+
"crime": "Open the Url that user input",
60+
"permission": [],
61+
"api": [
62+
{
63+
"class": "Landroid/widget/EditText;",
64+
"method": "getText",
65+
"descriptor": "()Landroid/text/Editable;"
66+
},
67+
{
68+
"class": "Landroid/webkit/WebView;",
69+
"method": "loadUrl",
70+
"descriptor": "(Ljava/lang/String;)V"
71+
}
72+
],
73+
"score": 1,
74+
"label": []
75+
}
76+
```
77+
78+
## Quark Script Result
79+
80+
``` TEXT
81+
$ python CWE-20.py
82+
CWE-20 is detected in method, Ljakhar/aseem/diva/InputValidation2URISchemeActivity; get (Landroid/view/View;)V
83+
```

‎CWE-20/openUrlThatUserInput.json

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"crime": "Open the Url that user input",
3+
"permission": [],
4+
"api": [
5+
{
6+
"class": "Landroid/widget/EditText;",
7+
"method": "getText",
8+
"descriptor": "()Landroid/text/Editable;"
9+
},
10+
{
11+
"class": "Landroid/webkit/WebView;",
12+
"method": "loadUrl",
13+
"descriptor": "(Ljava/lang/String;)V"
14+
}
15+
],
16+
"score": 1,
17+
"label": []
18+
}

‎CWE-22/CWE-22.py

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,17 +16,17 @@
1616
quarkResult = runQuarkAnalysis(SAMPLE_PATH, ruleInstance)
1717

1818
for accessExternalDir in quarkResult.behaviorOccurList:
19-
2019
filePath = accessExternalDir.secondAPI.getArguments()[2]
2120

2221
if quarkResult.isHardcoded(filePath):
2322
continue
2423

2524
caller = accessExternalDir.methodCaller
2625
strMatchingAPIs = [
27-
api for api in STRING_MATCHING_API if quarkResult.findMethodInCaller(
28-
caller, api)
26+
api
27+
for api in STRING_MATCHING_API
28+
if quarkResult.findMethodInCaller(caller, api)
2929
]
3030

3131
if not strMatchingAPIs:
32-
print(f"CWE-22 is detected in method, {caller.fullName}")
32+
print(f"CWE-22 is detected in method, {caller.fullName}")

‎CWE-22/README.md

Lines changed: 41 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,44 @@
1-
# Detect CWE-22 in Android Application (ovaa.apk and InsecureBankv2.apk )
1+
# Detect CWE-22 in Android Application
22

3-
This scenario seeks to find **the improper limitation of a pathname to a restricted directory ('Path Traversal')**. See [CWE-22](https://cwe.mitre.org/data/definitions/22.html) for more details.
3+
This scenario seeks to find **the improper limitation of a pathname to a
4+
restricted directory ('Path Traversal')**.
45

5-
Let’s use [ovaa.apk](https://github.com/oversecured/ovaa), [InsecureBankv2.apk](https://github.com/dineshshetty/Android-InsecureBankv2/releases), and the above APIs to show how the Quark script finds this vulnerability.
6+
## CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')
67

7-
First, we design a detection rule `accessFileInExternalDir.json` to spot behavior accessing a file in an external directory.
8+
We analyze the definition of CWE-22 and identify its characteristics.
89

9-
Next, we use API `methodInstance.getArguments()` to get the argument for the file path and use `quarkResultInstance.isHardcoded(argument)` to check if the argument is hardcoded into the APK. If **No**, the argument is from external input.
10+
See [CWE-22](https://cwe.mitre.org/data/definitions/22.html) for more
11+
details.
1012

11-
Finally, we use Quark API `quarkResultInstance.findMethodInCaller(callerMethod, targetMethod)` to check if there are any APIs in the caller method for string matching. If NO, the APK does not neutralize special elements within the argument, which may cause CWE-22 vulnerability.
13+
![image](https://imgur.com/agRPwp8.png)
1214

13-
## Quark Script CWE-22.py
14-
The Quark Script below uses ovaa.apk to demonstrate. You can change the `SAMPLE_PATH` to the sample you want to detect. For example, `SAMPLE_PATH = InsecureBankv2.apk`.
15+
## Code of CWE-22 in ovaa.apk
1516

16-
```python
17+
We use the [ovaa.apk](https://github.com/oversecured/ovaa) sample to
18+
explain the vulnerability code of CWE-22.
19+
20+
![image](https://imgur.com/WFpfzFk.png)
21+
22+
## Quark Script: CWE-22.py
23+
24+
Let's use the above APIs to show how the Quark script finds this
25+
vulnerability.
26+
27+
First, we design a detection rule `accessFileInExternalDir.json` to spot
28+
behavior accessing a file in an external directory.
29+
30+
Next, we use API `methodInstance.getArguments()` to get the argument for
31+
the file path and use `quarkResultInstance.isHardcoded(argument)` to
32+
check if the argument is hardcoded into the APK. If No, the argument is
33+
from external input.
34+
35+
Finally, we use Quark API
36+
`quarkResultInstance.findMethodInCaller(callerMethod, targetMethod)` to
37+
check if there are any APIs in the caller method for string matching. If
38+
NO, the APK does not neutralize special elements within the argument,
39+
which may cause CWE-22 vulnerability.
40+
41+
``` python
1742
from quark.script import runQuarkAnalysis, Rule
1843

1944
SAMPLE_PATH = "ovaa.apk"
@@ -32,25 +57,25 @@ ruleInstance = Rule(RULE_PATH)
3257
quarkResult = runQuarkAnalysis(SAMPLE_PATH, ruleInstance)
3358

3459
for accessExternalDir in quarkResult.behaviorOccurList:
35-
3660
filePath = accessExternalDir.secondAPI.getArguments()[2]
3761

3862
if quarkResult.isHardcoded(filePath):
3963
continue
4064

4165
caller = accessExternalDir.methodCaller
4266
strMatchingAPIs = [
43-
api for api in STRING_MATCHING_API if quarkResult.findMethodInCaller(
44-
caller, api)
67+
api
68+
for api in STRING_MATCHING_API
69+
if quarkResult.findMethodInCaller(caller, api)
4570
]
4671

4772
if not strMatchingAPIs:
4873
print(f"CWE-22 is detected in method, {caller.fullName}")
4974
```
5075

51-
5276
## Quark Rule: accessFileInExternalDir.json
53-
```json
77+
78+
``` json
5479
{
5580
"crime": "Access a file in an external directory",
5681
"permission": [],
@@ -71,16 +96,9 @@ for accessExternalDir in quarkResult.behaviorOccurList:
7196
}
7297
```
7398

74-
7599
## Quark Script Result
76-
+ **ovaa.apk**
77-
```
78-
$ python3 CWE-22.py
79-
CWE-22 is detected in method, Loversecured/ovaa/providers/TheftOverwriteProvider; openFile (Landroid/net/Uri; Ljava/lang/String;)Landroid/os/ParcelFileDescriptor;
80-
```
81100

82-
+ **InsecureBankv2.apk**
83-
```
101+
``` TEXT
84102
$ python3 CWE-22.py
85-
CWE-22 is detected in method, Lcom/android/insecurebankv2/ViewStatement; onCreate (Landroid/os/Bundle;)V
103+
CWE-22 is detected in method, Loversecured/ovaa/providers/TheftOverwriteProvider; openFile (Landroid/net/Uri; Ljava/lang/String;)Landroid/os/ParcelFileDescriptor;
86104
```

‎CWE-23/CWE-23.py

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,11 @@
99
["Ljava/lang/String;", "indexOf", "(I)I"],
1010
["Ljava/lang/String;", "indexOf", "(Ljava/lang/String;)I"],
1111
["Ljava/lang/String;", "matches", "(Ljava/lang/String;)Z"],
12-
["Ljava/lang/String;", "replaceAll",
13-
"(Ljava/lang/String; Ljava/lang/String;)Ljava/lang/String;"],
12+
[
13+
"Ljava/lang/String;",
14+
"replaceAll",
15+
"(Ljava/lang/String; Ljava/lang/String;)Ljava/lang/String;",
16+
],
1417
]
1518

1619
ruleInstance = Rule(RULE_PATH)
@@ -25,11 +28,12 @@
2528

2629
caller = accessExternalDir.methodCaller
2730
strMatchingAPIs = [
28-
api for api in STRING_MATCHING_API if quarkResult.findMethodInCaller(
29-
caller, api)
31+
api
32+
for api in STRING_MATCHING_API
33+
if quarkResult.findMethodInCaller(caller, api)
3034
]
3135

3236
if not strMatchingAPIs:
3337
print(f"CWE-23 is detected in method, {caller.fullName}")
3438
elif strMatchingAPIs.find("..") == -1:
35-
print(f"CWE-23 is detected in method, {caller.fullName}")
39+
print(f"CWE-23 is detected in method, {caller.fullName}")

0 commit comments

Comments
 (0)