Skip to content

Commit d5c7799

Browse files
LiangPPPLiangPPP
authored
Add CWE-78 and fix CWE-88 Quark Script (#29)
1 parent 6ce9595 commit d5c7799

File tree

5 files changed

+169
-36
lines changed

5 files changed

+169
-36
lines changed

‎CWE-78/CWE-78.py

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
from quark.script import runQuarkAnalysis, Rule, findMethodInAPK
2+
3+
SAMPLE_PATH = "Vuldroid.apk"
4+
RULE_PATH = "ExternalStringCommand.json"
5+
6+
7+
STRING_MATCHING_API = set([
8+
("Ljava/lang/String;", "contains", "(Ljava/lang/CharSequence)Z"),
9+
("Ljava/lang/String;", "indexOf", "(I)I"),
10+
("Ljava/lang/String;", "indexOf", "(Ljava/lang/String;)I"),
11+
("Ljava/lang/String;", "matches", "(Ljava/lang/String;)Z"),
12+
("Ljava/lang/String;", "replaceAll", "(Ljava/lang/String; Ljava/lang/String;)Ljava/lang/String;")
13+
])
14+
15+
specialElementsPattern = r"[ ;|,>`]+"
16+
17+
ruleInstance = Rule(RULE_PATH)
18+
quarkResult = runQuarkAnalysis(SAMPLE_PATH, ruleInstance)
19+
20+
for ExternalStringCommand in quarkResult.behaviorOccurList:
21+
22+
methodCalled = set()
23+
caller = ExternalStringCommand.methodCaller
24+
25+
for method in ExternalStringCommand.getMethodsInArgs():
26+
methodCalled.add(method.fullName)
27+
28+
if methodCalled.intersection(STRING_MATCHING_API) and not ExternalStringCommand.hasString(specialElementsPattern):
29+
continue
30+
else:
31+
print(f"CWE-78 is detected in method, {caller.fullName}")

‎CWE-78/ExternalStringCommand.json

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"crime": "Using external strings as commands",
3+
"permission": [],
4+
"api": [
5+
{
6+
"class": "Landroid/content/Intent;",
7+
"method": "getStringExtra",
8+
"descriptor": "(Ljava/lang/String;)Ljava/lang/String"
9+
},
10+
{
11+
"class": "Ljava/lang/Runtime;",
12+
"method": "exec",
13+
"descriptor": "(Ljava/lang/String;)Ljava/lang/Process"
14+
}
15+
],
16+
"score": 1,
17+
"label": []
18+
}

‎CWE-78/README.md

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
Detect CWE-78 in Android Application (Vuldroid.apk )
2+
-----------------------------------------------------------------------
3+
This scenario seeks to find **Improper Neutralization of Special Elements used in an OS Command**. See [CWE-78](https://cwe.mitre.org/data/definitions/78.html) for more details.
4+
5+
Let’s use this [APK](https://github.com/jaiswalakshansh/Vuldroid) and the above APIs to show how the Quark script finds this vulnerability.
6+
7+
First, we design a detection rule ``ExternalStringsCommands.json`` to spot on behavior using external strings as commands.
8+
9+
Next, we use Quark API ``behaviorInstance.getMethodsInArgs()`` to get the methods that passed the external command.
10+
11+
Then we check if the method neutralizes any special elements found in the argument.
12+
13+
If the neutralization is not complete, then it may cause CWE-78 vulnerability.
14+
15+
16+
Quark Script CWE-78.py
17+
=======================
18+
19+
The Quark Script below uses Vuldroid.apk to demonstrate.
20+
21+
``` python
22+
from quark.script import runQuarkAnalysis, Rule, findMethodInAPK
23+
24+
SAMPLE_PATH = "Vuldroid.apk"
25+
RULE_PATH = "ExternalStringCommand.json"
26+
27+
28+
STRING_MATCHING_API = set([
29+
("Ljava/lang/String;", "contains", "(Ljava/lang/CharSequence)Z"),
30+
("Ljava/lang/String;", "indexOf", "(I)I"),
31+
("Ljava/lang/String;", "indexOf", "(Ljava/lang/String;)I"),
32+
("Ljava/lang/String;", "matches", "(Ljava/lang/String;)Z"),
33+
("Ljava/lang/String;", "replaceAll", "(Ljava/lang/String; Ljava/lang/String;)Ljava/lang/String;")
34+
])
35+
36+
specialElementsPattern = r"[ ;|,>`]+"
37+
38+
ruleInstance = Rule(RULE_PATH)
39+
quarkResult = runQuarkAnalysis(SAMPLE_PATH, ruleInstance)
40+
41+
for ExternalStringCommand in quarkResult.behaviorOccurList:
42+
43+
methodCalled = set()
44+
caller = ExternalStringCommand.methodCaller
45+
46+
for method in ExternalStringCommand.getMethodsInArgs():
47+
methodCalled.add(method.fullName)
48+
49+
if methodCalled.intersection(STRING_MATCHING_API) and not ExternalStringCommand.hasString(specialElementsPattern):
50+
continue
51+
else:
52+
print(f"CWE-78 is detected in method, {caller.fullName}")
53+
54+
```
55+
56+
Quark Rule: ExternalStringCommand.json
57+
=========================================
58+
59+
```json
60+
{
61+
"crime": "Using external strings as commands",
62+
"permission": [],
63+
"api": [
64+
{
65+
"class": "Landroid/content/Intent;",
66+
"method": "getStringExtra",
67+
"descriptor": "(Ljava/lang/String;)Ljava/lang/String"
68+
},
69+
{
70+
"class": "Ljava/lang/Runtime;",
71+
"method": "exec",
72+
"descriptor": "(Ljava/lang/String;)Ljava/lang/Process"
73+
}
74+
],
75+
"score": 1,
76+
"label": []
77+
}
78+
```
79+
80+
Quark Script Result
81+
======================
82+
- **Vuldroid.apk**
83+
84+
```
85+
$ python3 CWE-78.py
86+
CWE-78 is detected in method, Lcom/vuldroid/application/RootDetection; onCreate (Landroid/os/Bundle;)V
87+
```

‎CWE-88/CWE-88.py

Lines changed: 15 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,31 @@
1-
from quark.script import runQuarkAnalysis, Rule
1+
from quark.script import runQuarkAnalysis, Rule, findMethodInAPK
22

33
SAMPLE_PATH = "Vuldroid.apk"
44
RULE_PATH = "ExternalStringCommand.json"
55

66

7-
STRING_MATCHING_API = [
8-
["Ljava/lang/String;", "contains", "(Ljava/lang/CharSequence)Z"],
9-
["Ljava/lang/String;", "indexOf", "(I)I"],
10-
["Ljava/lang/String;", "indexOf", "(Ljava/lang/String;)I"],
11-
["Ljava/lang/String;", "matches", "(Ljava/lang/String;)Z"],
12-
["Ljava/lang/String;", "replaceAll",
13-
"(Ljava/lang/String; Ljava/lang/String;)Ljava/lang/String;"],
14-
]
7+
STRING_MATCHING_API = set([
8+
("Ljava/lang/String;", "contains", "(Ljava/lang/CharSequence)Z"),
9+
("Ljava/lang/String;", "indexOf", "(I)I"),
10+
("Ljava/lang/String;", "indexOf", "(Ljava/lang/String;)I"),
11+
("Ljava/lang/String;", "matches", "(Ljava/lang/String;)Z"),
12+
("Ljava/lang/String;", "replaceAll", "(Ljava/lang/String; Ljava/lang/String;)Ljava/lang/String;")
13+
])
1514

16-
delimiters = [' ', ';', '||', '|', ',', '>', '>>', '`']
15+
delimeter = "-"
1716

1817
ruleInstance = Rule(RULE_PATH)
1918
quarkResult = runQuarkAnalysis(SAMPLE_PATH, ruleInstance)
2019

2120
for ExternalStringCommand in quarkResult.behaviorOccurList:
2221

22+
methodCalled = set()
2323
caller = ExternalStringCommand.methodCaller
2424

25-
strMatchingAPIs = [
26-
api for api in STRING_MATCHING_API if
27-
quarkResult.findMethodInCaller(caller, api)
28-
]
25+
for method in ExternalStringCommand.getMethodsInArgs():
26+
methodCalled.add(method.fullName)
2927

30-
if not strMatchingAPIs or \
31-
any(dlm not in strMatchingAPIs for dlm in delimiters):
28+
if methodCalled.intersection(STRING_MATCHING_API) and not ExternalStringCommand.hasString(delimeter):
29+
continue
30+
else:
3231
print(f"CWE-88 is detected in method, {caller.fullName}")

‎CWE-88/README.md

Lines changed: 18 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
CWE-88
21
Detect CWE-88 in Android Application (Vuldroid.apk )
32
-----------------------------------------------------------------------
43
This scenario seeks to find **Improper Neutralization of Argument Delimiters in a Command**. See [CWE-88](https://cwe.mitre.org/data/definitions/88.html) for more details.
@@ -7,11 +6,11 @@ Let’s use this [APK](https://github.com/jaiswalakshansh/Vuldroid) and the abov
76

87
First, we design a detection rule ``ExternalStringsCommands.json`` to spot on behavior using external strings as commands.
98

10-
Next, we use Quark API ``quarkResultInstance.findMethodInCaller(callerMethod, targetMethod)`` to check if any APIs in the caller method for string matching.
9+
Next, we use Quark API ``behaviorInstance.getMethodsInArgs()`` to get the methods that passed the external command.
1110

12-
If NO, the APK does not neutralize special elements within the argument, which may cause CWE-88 vulnerability.
11+
Then we check if the method neutralizes any special elements found in the argument.
1312

14-
If YES, check if there are any delimiters used in string matching for a filter. If NO, the APK does not neutralize special elements within the argument, which may cause CWE-88 vulnerability.
13+
If the neutralization is not complete, then it may cause CWE-88 vulnerability.
1514

1615

1716
Quark Script CWE-88.py
@@ -20,37 +19,36 @@ Quark Script CWE-88.py
2019
The Quark Script below uses Vuldroid.apk to demonstrate.
2120

2221
``` python
23-
from quark.script import runQuarkAnalysis, Rule
22+
from quark.script import runQuarkAnalysis, Rule, findMethodInAPK
2423

2524
SAMPLE_PATH = "Vuldroid.apk"
2625
RULE_PATH = "ExternalStringCommand.json"
2726

2827

29-
STRING_MATCHING_API = [
30-
["Ljava/lang/String;", "contains", "(Ljava/lang/CharSequence)Z"],
31-
["Ljava/lang/String;", "indexOf", "(I)I"],
32-
["Ljava/lang/String;", "indexOf", "(Ljava/lang/String;)I"],
33-
["Ljava/lang/String;", "matches", "(Ljava/lang/String;)Z"],
34-
["Ljava/lang/String;", "replaceAll",
35-
"(Ljava/lang/String; Ljava/lang/String;)Ljava/lang/String;"],
36-
]
28+
STRING_MATCHING_API = set([
29+
("Ljava/lang/String;", "contains", "(Ljava/lang/CharSequence)Z"),
30+
("Ljava/lang/String;", "indexOf", "(I)I"),
31+
("Ljava/lang/String;", "indexOf", "(Ljava/lang/String;)I"),
32+
("Ljava/lang/String;", "matches", "(Ljava/lang/String;)Z"),
33+
("Ljava/lang/String;", "replaceAll", "(Ljava/lang/String; Ljava/lang/String;)Ljava/lang/String;")
34+
])
3735

38-
delimiters = [' ', ';', '||', '|', ',', '>', '>>', '`']
36+
delimeter = "-"
3937

4038
ruleInstance = Rule(RULE_PATH)
4139
quarkResult = runQuarkAnalysis(SAMPLE_PATH, ruleInstance)
4240

4341
for ExternalStringCommand in quarkResult.behaviorOccurList:
4442

43+
methodCalled = set()
4544
caller = ExternalStringCommand.methodCaller
4645

47-
strMatchingAPIs = [
48-
api for api in STRING_MATCHING_API if
49-
quarkResult.findMethodInCaller(caller, api)
50-
]
46+
for method in ExternalStringCommand.getMethodsInArgs():
47+
methodCalled.add(method.fullName)
5148

52-
if not strMatchingAPIs or \
53-
any(dlm not in strMatchingAPIs for dlm in delimiters):
49+
if methodCalled.intersection(STRING_MATCHING_API) and not ExternalStringCommand.hasString(delimeter):
50+
continue
51+
else:
5452
print(f"CWE-88 is detected in method, {caller.fullName}")
5553

5654
```

0 commit comments

Comments
 (0)