|
| 1 | +Detect CWE-601 in Android Application (ovaa) |
| 2 | +------------------------------------------------------ |
| 3 | + |
| 4 | +This scenario aims to demonstrate the detection of the **URL Redirection to Untrusted Site** vulnerability using [ovaa.apk](https://github.com/oversecured/ovaa). See [CWE-601](https://cwe.mitre.org/data/definitions/601.html) for more details. |
| 5 | + |
| 6 | +To detect the vulnerability, we need to find all the caller methods of ``startActivity`` API that might receive external input without input validation. The ``findMethodInAPK`` function finds all the methods in the APK file that call the ``startActivity`` API. Next, we examine the arguments of each method to discover the methods receiving external input. If a method receives external input but lacks of proper input validation, the CWE-601 vulnerability is identified. |
| 7 | + |
| 8 | +Quark Script CWE-601.py |
| 9 | +========================== |
| 10 | + |
| 11 | +The Quark Script below uses ovaa.apk to demonstrate. |
| 12 | + |
| 13 | +```python |
| 14 | + |
| 15 | + |
| 16 | +from quark.script import findMethodInAPK |
| 17 | + |
| 18 | +SAMPLE_PATH = 'ovaa.apk' |
| 19 | + |
| 20 | +# This is the input for findMethodInAPK, formatted as class name, method name, descriptor |
| 21 | +TARGET_METHOD = ["", "startActivity", "(Landroid/content/Intent;)V"] |
| 22 | + |
| 23 | +""" |
| 24 | +Due to varying descriptors and classes in smali code from different APIs, |
| 25 | +our search relies solely on the consistent method names. |
| 26 | +""" |
| 27 | + |
| 28 | +EXTERNAL_INPUT_METHODS = [ |
| 29 | + "getIntent", |
| 30 | + "getQueryParameter" |
| 31 | +] |
| 32 | + |
| 33 | +INPUT_FILTER_METHODS = [ |
| 34 | + "parse", |
| 35 | + "isValidUrl", |
| 36 | + "Pattern", |
| 37 | + "Matcher", |
| 38 | + "encode", |
| 39 | + "decode", |
| 40 | + "escapeHtml", |
| 41 | + "HttpURLConnection" |
| 42 | +] |
| 43 | + |
| 44 | +redirectMethods = findMethodInAPK(SAMPLE_PATH, TARGET_METHOD) |
| 45 | + |
| 46 | +for redirectMethod in redirectMethods: |
| 47 | + arguments = redirectMethod.getArguments() |
| 48 | + for argument in arguments: |
| 49 | + if any(externalInput in argument for |
| 50 | + externalInput in EXTERNAL_INPUT_METHODS): |
| 51 | + if not any(filterMethod in argument for |
| 52 | + filterMethod in INPUT_FILTER_METHODS): |
| 53 | + print(f"CWE-601 is detected in {redirectMethod.fullName}") |
| 54 | + |
| 55 | + |
| 56 | + |
| 57 | + |
| 58 | + |
| 59 | +``` |
| 60 | + |
| 61 | +Quark Script Result |
| 62 | +====================== |
| 63 | +- **ovaa.apk** |
| 64 | + |
| 65 | +``` |
| 66 | +
|
| 67 | +$ python CWE-601.py |
| 68 | +CWE-601 is detected in Loversecured/ovaa/activities/DeeplinkActivity; processDeeplink (Landroid/net/Uri;)V |
| 69 | +CWE-601 is detected in Loversecured/ovaa/activities/LoginActivity; onLoginFinished ()V |
| 70 | +
|
| 71 | +``` |
0 commit comments