Skip to content

Commit ab1c9ce

Browse files
authored
Optimize the document of Quark Script CWE-921
1 parent 41e67f5 commit ab1c9ce

File tree

1 file changed

+21
-20
lines changed

1 file changed

+21
-20
lines changed

CWE-921/README.md

Lines changed: 21 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,35 @@
11
# Detect CWE-921 in Android Application
22

3-
This scenario seeks to find the **unsecured storage mechanism of
4-
sensitive data** in the APK file.
3+
This scenario seeks to find the **unsecured storage mechanism of sensitive data** in the APK file.
54

6-
## CWE-921 Storage of Sensitive Data in a Mechanism without Access Control
5+
## CWE-921: Storage of Sensitive Data in a Mechanism without Access Control
76

87
We analyze the definition of CWE-921 and identify its characteristics.
98

10-
See [CWE-921](https://cwe.mitre.org/data/definitions/921.html) for more
11-
details.
9+
See [CWE-921](https://cwe.mitre.org/data/definitions/921.html) for more details.
10+
11+
![image](https://imgur.com/2zlPLHe.jpg)
1212

13-
![image](https://imgur.com/ihtjGAu.jpg)
1413

1514
## Code of CWE-921 in ovaa.apk
1615

17-
We use the [ovaa.apk](https://github.com/oversecured/ovaa) sample to
18-
explain the vulnerability code of CWE-921.
16+
We use the [ovaa.apk](https://github.com/oversecured/ovaa) sample to explain the vulnerability code of CWE-921.
1917

20-
![image](https://imgur.com/ACzJct8.jpg)
18+
![image](https://imgur.com/2u5iL1K.jpg)
2119

22-
## Quark Script: CWE-921.py
20+
## CWE-921 Detection Process Using Quark Script API
21+
22+
![image](https://imgur.com/qHOMqKy.jpg)
23+
24+
Let’s use the above APIs to show how the Quark script finds this vulnerability.
2325

24-
Let's use the above APIs to show how the Quark script finds this
25-
vulnerability.
26+
First, we design a detection rule ``checkFileExistence.json`` to spot on behavior that checks if a file exists on a given storage mechanism. Then, we use API ``methodInstance.getArguments()`` to get the file path. Finally, CWE-921 is found if the file path contains the keyword ``sdcard``.
2627

27-
First, we design a detection rule `checkFileExistence.json` to spot on
28-
behavior that checks if a file exists on a given storage mechanism.
29-
Then, we use API `methodInstance.getArguments()` to get the file path.
30-
Finally, CWE-921 is found if the file path contains the keyword
31-
`sdcard`.
28+
## Quark Script: CWE-921.py
29+
30+
![image](https://imgur.com/HULgyIy.jpg)
3231

33-
``` python
32+
```python
3433
from quark.script import runQuarkAnalysis, Rule
3534

3635
SAMPLE_PATH = "ovaa.apk"
@@ -48,7 +47,9 @@ for existingFile in quarkResult.behaviorOccurList:
4847

4948
## Quark Rule: checkFileExistence.json
5049

51-
``` json
50+
![image](https://imgur.com/zRiYLtS.jpg)
51+
52+
```json
5253
{
5354
"crime": "Check file existence",
5455
"permission": [],
@@ -71,7 +72,7 @@ for existingFile in quarkResult.behaviorOccurList:
7172

7273
## Quark Script Result
7374

74-
``` TEXT
75+
```
7576
$ python3 CWE-921.py
7677
This file is stored inside the SDcard
7778

0 commit comments

Comments
 (0)