Skip to content

Commit f6dc423

Browse files
JerryTasiJerryTasi
authored
Optimize the document of Quark Script CWE-502, 297, 1204, and 24 (#61)
* Optimize the document of Quark Script CWE-502, 1204, 24 * Optimize the document of Quark Script CWE-297 * Optimize the document of Quark Script CWE-297 * Optimize the document of Quark Script CWE-24
1 parent 6cd00f4 commit f6dc423

File tree

11 files changed

+390
-27
lines changed

11 files changed

+390
-27
lines changed

‎CWE-1204/CWE-1204.py‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
from quark.script import runQuarkAnalysis, Rule
2+
3+
SAMPLE_PATH = "InsecureBankv2.apk"
4+
RULE_PATH = "initializeCipherWithIV.json"
5+
6+
randomAPIs = [
7+
["Ljava/security/SecureRandom", "next", "(I)I"],
8+
["Ljava/security/SecureRandom", "nextBytes", "([B)V"],
9+
]
10+
11+
ruleInstance = Rule(RULE_PATH)
12+
quarkResult = runQuarkAnalysis(SAMPLE_PATH, ruleInstance)
13+
14+
for initCipherWithIV in quarkResult.behaviorOccurList:
15+
methodcaller = initCipherWithIV.methodCaller
16+
17+
if not any(
18+
initCipherWithIV.isArgFromMethod(api) for api in randomAPIs
19+
):
20+
print(f"CWE-1204 is detected in method, {methodcaller.fullName}")

‎CWE-1204/README.md‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
# Detect CWE-1204 in Android Application
2+
3+
This scenario seeks to find **Generation of Weak Initialization Vector (IV)**.
4+
5+
## CWE-1204: Generation of Weak Initialization Vector (IV)
6+
7+
We analyze the definition of CWE-1204 and identify its characteristics.
8+
9+
See [CWE-1204](https://cwe.mitre.org/data/definitions/1204.html) for more details.
10+
11+
![image](https://i.postimg.cc/3NNmYz6J/image.png)
12+
13+
## Code of CWE-1204 in InsecureBankv2.apk
14+
15+
We use the [InsecureBankv2.apk](https://github.com/dineshshetty/Android-InsecureBankv2) sample to explain the vulnerability code of CWE-1204.
16+
17+
![image](https://i.postimg.cc/rsHWmQXG/image.png)
18+
19+
20+
## CWE-1204 Detection Process Using Quark Script API
21+
22+
![image](https://i.postimg.cc/jq3yZdwW/image.png)
23+
24+
Let’s use the above APIs to show how the Quark script finds this vulnerability.
25+
26+
First, we created a detection rule named `initializeCipherWithIV.json` to identify behaviors that initialize a cipher object with IV.
27+
28+
Then, we use API `behaviorInstance.isArgFromMethod(targetMethod)` to check if any random API is applied on the IV used in the cipher object. If **NO**, it could imply that the APK uses a weak IV, potentially leading to a CWE-1204 vulnerability.
29+
30+
## Quark Scipt: CWE-1204.py
31+
32+
![image](https://i.postimg.cc/Hxs79fT4/image.png)
33+
34+
```python
35+
from quark.script import runQuarkAnalysis, Rule
36+
37+
SAMPLE_PATH = "InsecureBankv2.apk"
38+
RULE_PATH = "initializeCipherWithIV.json"
39+
40+
randomAPIs = [
41+
["Ljava/security/SecureRandom", "next", "(I)I"],
42+
["Ljava/security/SecureRandom", "nextBytes", "([B)V"],
43+
]
44+
45+
ruleInstance = Rule(RULE_PATH)
46+
quarkResult = runQuarkAnalysis(SAMPLE_PATH, ruleInstance)
47+
48+
for initCipherWithIV in quarkResult.behaviorOccurList:
49+
methodcaller = initCipherWithIV.methodCaller
50+
51+
if not any(
52+
initCipherWithIV.isArgFromMethod(api) for api in randomAPIs
53+
):
54+
print(f"CWE-1204 is detected in method, {methodcaller.fullName}")
55+
```
56+
57+
## Quark Rule: initializeCipherWithIV.json
58+
59+
![image](https://i.postimg.cc/kGL69GKf/image.png)
60+
61+
```json
62+
{
63+
"crime": "Initialize a cipher object with IV",
64+
"permission": [],
65+
"api": [
66+
{
67+
"class": "Ljavax/crypto/spec/IvParameterSpec;",
68+
"method": "<init>",
69+
"descriptor": "([B)V"
70+
},
71+
{
72+
"class": "Ljavax/crypto/Cipher;",
73+
"method": "init",
74+
"descriptor": "(ILjava/security/Key;Ljava/security/spec/AlgorithmParameterSpec;)V"
75+
}
76+
],
77+
"score": 1,
78+
"label": []
79+
}
80+
```
81+
82+
## Quark Script Result
83+
84+
```TEXT
85+
$ python CWE-1204.py
86+
CWE-1204 is detected in method, Lcom/android/insecurebankv2/CryptoClass; aes256encrypt ([B [B [B)[B
87+
CWE-1204 is detected in method, Lcom/android/insecurebankv2/CryptoClass; aes256decrypt ([B [B [B)[B
88+
CWE-1204 is detected in method, Lcom/google/android/gms/internal/zzar; zzc ([B Ljava/lang/String;)[B
89+
```

‎CWE-1204/initializeCipherWithIV.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"crime": "Initialize a cipher object with IV",
3+
"permission": [],
4+
"api": [
5+
{
6+
"class": "Ljavax/crypto/spec/IvParameterSpec;",
7+
"method": "<init>",
8+
"descriptor": "([B)V"
9+
},
10+
{
11+
"class": "Ljavax/crypto/Cipher;",
12+
"method": "init",
13+
"descriptor": "(ILjava/security/Key;Ljava/security/spec/AlgorithmParameterSpec;)V"
14+
}
15+
],
16+
"score": 1,
17+
"label": []
18+
}

‎CWE-24/CWE-24.py‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
from quark.script import runQuarkAnalysis, Rule
2+
3+
SAMPLE_PATH = "ovaa.apk"
4+
RULE_PATH = "accessFileInExternalDir.json"
5+
6+
7+
STRING_MATCHING_API = [
8+
["Ljava/lang/String;", "contains", "(Ljava/lang/CharSequence)Z"],
9+
["Ljava/lang/String;", "indexOf", "(I)I"],
10+
["Ljava/lang/String;", "indexOf", "(Ljava/lang/String;)I"],
11+
["Ljava/lang/String;", "matches", "(Ljava/lang/String;)Z"],
12+
[
13+
"Ljava/lang/String;",
14+
"replaceAll",
15+
"(Ljava/lang/String; Ljava/lang/String;)Ljava/lang/String;",
16+
],
17+
]
18+
19+
ruleInstance = Rule(RULE_PATH)
20+
quarkResult = runQuarkAnalysis(SAMPLE_PATH, ruleInstance)
21+
22+
for accessExternalDir in quarkResult.behaviorOccurList:
23+
24+
filePath = accessExternalDir.secondAPI.getArguments()[2]
25+
26+
if quarkResult.isHardcoded(filePath):
27+
continue
28+
29+
caller = accessExternalDir.methodCaller
30+
strMatchingAPIs = [
31+
api
32+
for api in STRING_MATCHING_API
33+
if quarkResult.findMethodInCaller(caller, api)
34+
]
35+
36+
if not strMatchingAPIs or "../" not in accessExternalDir.getParamValues():
37+
print(f"CWE-24 is detected in method, {caller.fullName}")

‎CWE-24/README.md‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
# Detect CWE-24 in Android Application
2+
3+
This scenario aims to demonstrate the detection of the **Relative Path Traversal** vulnerability.
4+
5+
## CWE-24: Path Traversal: '../filedir'
6+
7+
We analyze the definition of CWE-24 and identify its characteristics.
8+
9+
See [CWE-24](https://cwe.mitre.org/data/definitions/24.html) for more details.
10+
11+
![image](https://i.postimg.cc/xdQjd3M2/image.png)
12+
13+
## Code of CWE-24 in ovaa.apk
14+
15+
We use the [ovaa.apk](https://github.com/oversecured/ovaa) sample to explain the vulnerability code of CWE-24.
16+
17+
![image](https://imgur.com/KT277GG.png)
18+
19+
## CWE-24 Detection Process Using Quark Script API
20+
21+
![image](https://i.postimg.cc/YCz0YPp9/image.png)
22+
23+
Let’s use the above APIs to show how the Quark script finds this vulnerability.
24+
25+
To begin with, we create a detection rule named ``accessFileInExternalDir.json`` to identify behavior that accesses a file in an external directory.
26+
27+
Next, we use ``methodInstance.getArguments()`` to retrieve the file path argument and check whether it belongs to the APK. If it does not belong to the APK, the argument is likely from external input.
28+
29+
Finally, we use the Quark Script API ``quarkResultInstance.findMethodInCaller(callerMethod, targetMethod)`` to search for any APIs in the caller method that are used to match strings, and `getParamValues(none)` to retrieve the parameters.
30+
31+
If no API is found or `"../"` is not in parameters, that implies the APK does not neutralize the special element `../` within the argument, possibly resulting in CWE-24 vulnerability.
32+
33+
## Quark Script: CWE-24.py
34+
35+
![image](https://i.postimg.cc/rwfc82VS/image.png)
36+
37+
```python
38+
from quark.script import runQuarkAnalysis, Rule
39+
40+
SAMPLE_PATH = "ovaa.apk"
41+
RULE_PATH = "accessFileInExternalDir.json"
42+
43+
44+
STRING_MATCHING_API = [
45+
["Ljava/lang/String;", "contains", "(Ljava/lang/CharSequence)Z"],
46+
["Ljava/lang/String;", "indexOf", "(I)I"],
47+
["Ljava/lang/String;", "indexOf", "(Ljava/lang/String;)I"],
48+
["Ljava/lang/String;", "matches", "(Ljava/lang/String;)Z"],
49+
[
50+
"Ljava/lang/String;",
51+
"replaceAll",
52+
"(Ljava/lang/String; Ljava/lang/String;)Ljava/lang/String;",
53+
],
54+
]
55+
56+
ruleInstance = Rule(RULE_PATH)
57+
quarkResult = runQuarkAnalysis(SAMPLE_PATH, ruleInstance)
58+
59+
for accessExternalDir in quarkResult.behaviorOccurList:
60+
61+
filePath = accessExternalDir.secondAPI.getArguments()[2]
62+
63+
if quarkResult.isHardcoded(filePath):
64+
continue
65+
66+
caller = accessExternalDir.methodCaller
67+
strMatchingAPIs = [
68+
api
69+
for api in STRING_MATCHING_API
70+
if quarkResult.findMethodInCaller(caller, api)
71+
]
72+
73+
if not strMatchingAPIs or "../" not in accessExternalDir.getParamValues():
74+
print(f"CWE-24 is detected in method, {caller.fullName}")
75+
```
76+
77+
## Quark Rule: accessFileInExternalDir.json
78+
79+
![image](https://i.postimg.cc/1RDQ8qRR/image.png)
80+
81+
```json
82+
{
83+
"crime": "Access a file in an external directory",
84+
"permission": [],
85+
"api": [
86+
{
87+
"class": "Landroid/os/Environment;",
88+
"method": "getExternalStorageDirectory",
89+
"descriptor": "()Ljava/io/File;"
90+
},
91+
{
92+
"class": "Ljava/io/File;",
93+
"method": "<init>",
94+
"descriptor": "(Ljava/io/File;Ljava/lang/String;)V"
95+
}
96+
],
97+
"score": 1,
98+
"label": []
99+
}
100+
```
101+
102+
## Quark Script Result
103+
104+
```
105+
$ python3 CWE-24.py
106+
CWE-24 is detected in method, Loversecured/ovaa/providers/TheftOverwriteProvider; openFile (Landroid/net/Uri; Ljava/lang/String;)Landroid/os/ParcelFileDescriptor;
107+
```

‎CWE-24/accessFileInExternalDir.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"crime": "Access a file in an external directory",
3+
"permission": [],
4+
"api": [
5+
{
6+
"class": "Landroid/os/Environment;",
7+
"method": "getExternalStorageDirectory",
8+
"descriptor": "()Ljava/io/File;"
9+
},
10+
{
11+
"class": "Ljava/io/File;",
12+
"method": "<init>",
13+
"descriptor": "(Ljava/io/File;Ljava/lang/String;)V"
14+
}
15+
],
16+
"score": 1,
17+
"label": []
18+
}

‎CWE-297/CWE-297.py‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
from quark.script import findMethodImpls, isMethodReturnAlwaysTrue
2+
3+
SAMPLE_PATH = "pivaa.apk"
4+
5+
ABSTRACT_METHOD = [
6+
"Ljavax/net/ssl/HostnameVerifier;",
7+
"verify",
8+
"(Ljava/lang/String; Ljavax/net/ssl/SSLSession;)Z"
9+
]
10+
11+
for hostVerification in findMethodImpls(SAMPLE_PATH, ABSTRACT_METHOD):
12+
methodImpls = [
13+
hostVerification.className,
14+
hostVerification.methodName,
15+
hostVerification.descriptor
16+
]
17+
if isMethodReturnAlwaysTrue(SAMPLE_PATH, methodImpls):
18+
print(f"CWE-297 is detected in method, {hostVerification.fullName}")

‎CWE-297/README.md‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Detect CWE-297 in Android Application
2+
3+
This scenario seeks to find **Improper Validation of Certificate with Host Mismatch**.
4+
5+
## CWE-297: Improper Validation of Certificate with Host Mismatch
6+
7+
We analyze the definition of CWE-297 and identify its characteristics.
8+
9+
See [CWE-297](https://cwe.mitre.org/data/definitions/297.html) for more details.
10+
11+
![image](https://i.postimg.cc/PrpC3vgy/image.png)
12+
13+
## Code of CWE-297 in pivaa.apk
14+
15+
We use the [pivaa.apk](https://github.com/htbridge/pivaa) sample to explain the vulnerability code of CWE-297.
16+
17+
![image](https://i.postimg.cc/wT29kqv2/image.png)
18+
19+
## CWE-297 Detection Process Using Quark Script API
20+
21+
![image](https://i.postimg.cc/ryYJRWGN/image.png)
22+
23+
First, we use API ``findMethodImpls(samplePath, targetMethod)`` to locate the method that implements the hostname verification, which verifies the hostname of a certificate.
24+
25+
Next, we use API ``isMethodReturnAlwaysTrue(samplePath, targetMethod)`` to check if the method always returns true.
26+
27+
If the answer is **YES**, the method does not check the certificate of the host properly, which may cause CWE-297 vulnerability.
28+
29+
## Quark Script CWE-297.py
30+
31+
![image](https://i.postimg.cc/Dw311cSL/image.png)
32+
33+
```python
34+
from quark.script import findMethodImpls, isMethodReturnAlwaysTrue
35+
36+
SAMPLE_PATH = "pivaa.apk"
37+
38+
ABSTRACT_METHOD = [
39+
"Ljavax/net/ssl/HostnameVerifier;",
40+
"verify",
41+
"(Ljava/lang/String; Ljavax/net/ssl/SSLSession;)Z"
42+
]
43+
44+
for hostVerification in findMethodImpls(SAMPLE_PATH, ABSTRACT_METHOD):
45+
methodImpls = [
46+
hostVerification.className,
47+
hostVerification.methodName,
48+
hostVerification.descriptor
49+
]
50+
if isMethodReturnAlwaysTrue(SAMPLE_PATH, methodImpls):
51+
print(f"CWE-297 is detected in method, {hostVerification.fullName}")
52+
```
53+
54+
## Quark Script Result
55+
56+
```TEXT
57+
$ python CWE-297.py
58+
CWE-297 is detected in method, Lcom/htbridge/pivaa/handlers/API$1; verify (Ljava/lang/String; Ljavax/net/ssl/SSLSession;)Z
59+
```

‎CWE-502/CWE-502.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,4 +18,4 @@
1818
apis = dataDeserialization.getMethodsInArgs()
1919
caller = dataDeserialization.methodCaller
2020
if not any(api in apis for api in verificationApis):
21-
print(f"CWE-502 is detected in method, {caller.fullName}")
21+
print(f"CWE-502 is detected in method, {caller.fullName}")

0 commit comments

Comments
 (0)