You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CWE-921/README.md
+21-20Lines changed: 21 additions & 20 deletions
Original file line number
Diff line number
Diff line change
@@ -1,36 +1,35 @@
1
1
# Detect CWE-921 in Android Application
2
2
3
-
This scenario seeks to find the **unsecured storage mechanism of
4
-
sensitive data** in the APK file.
3
+
This scenario seeks to find the **unsecured storage mechanism of sensitive data** in the APK file.
5
4
6
-
## CWE-921 Storage of Sensitive Data in a Mechanism without Access Control
5
+
## CWE-921: Storage of Sensitive Data in a Mechanism without Access Control
7
6
8
7
We analyze the definition of CWE-921 and identify its characteristics.
9
8
10
-
See [CWE-921](https://cwe.mitre.org/data/definitions/921.html) for more
11
-
details.
9
+
See [CWE-921](https://cwe.mitre.org/data/definitions/921.html) for more details.
10
+
11
+

12
12
13
-

14
13
15
14
## Code of CWE-921 in ovaa.apk
16
15
17
-
We use the [ovaa.apk](https://github.com/oversecured/ovaa) sample to
18
-
explain the vulnerability code of CWE-921.
16
+
We use the [ovaa.apk](https://github.com/oversecured/ovaa) sample to explain the vulnerability code of CWE-921.
19
17
20
-

18
+

21
19
22
-
## Quark Script: CWE-921.py
20
+
## CWE-921 Detection Process Using Quark Script API
21
+
22
+

23
+
24
+
Let’s use the above APIs to show how the Quark script finds this vulnerability.
23
25
24
-
Let's use the above APIs to show how the Quark script finds this
25
-
vulnerability.
26
+
First, we design a detection rule ``checkFileExistence.json`` to spot on behavior that checks if a file exists on a given storage mechanism. Then, we use API ``methodInstance.getArguments()`` to get the file path. Finally, CWE-921 is found if the file path contains the keyword ``sdcard``.
26
27
27
-
First, we design a detection rule `checkFileExistence.json` to spot on
28
-
behavior that checks if a file exists on a given storage mechanism.
29
-
Then, we use API `methodInstance.getArguments()` to get the file path.
30
-
Finally, CWE-921 is found if the file path contains the keyword
31
-
`sdcard`.
28
+
## Quark Script: CWE-921.py
29
+
30
+

32
31
33
-
```python
32
+
```python
34
33
from quark.script import runQuarkAnalysis, Rule
35
34
36
35
SAMPLE_PATH="ovaa.apk"
@@ -48,7 +47,9 @@ for existingFile in quarkResult.behaviorOccurList:
48
47
49
48
## Quark Rule: checkFileExistence.json
50
49
51
-
```json
50
+

51
+
52
+
```json
52
53
{
53
54
"crime": "Check file existence",
54
55
"permission": [],
@@ -71,7 +72,7 @@ for existingFile in quarkResult.behaviorOccurList:
0 commit comments