Skip to content

Commit 5019761

Browse files
JerryTasiJerryTasi
authored
Optimize the document of Quark Script CWE-23 (#733)
* Optimize the document of Quark Script CWE-23 * Optimize the document of Quark Script CWE-23
1 parent 8e5d68c commit 5019761

File tree

1 file changed

+71
-60
lines changed

1 file changed

+71
-60
lines changed

‎docs/source/quark_script.rst‎

Lines changed: 71 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -1891,7 +1891,7 @@ Quark Script Result
18911891
18921892
18931893
Detect CWE-23 in Android Application
1894-
--------------------------------------
1894+
-------------------------------------
18951895

18961896
This scenario aims to demonstrate the detection of the **Relative Path Traversal** vulnerability.
18971897

@@ -1902,99 +1902,110 @@ We analyze the definition of CWE-23 and identify its characteristics.
19021902

19031903
See `CWE-23 <https://cwe.mitre.org/data/definitions/23.html>`_ for more details.
19041904

1905-
.. image:: https://imgur.com/YS9umQp.png
1905+
.. image:: https://imgur.com/k4UPsKO.png
19061906

19071907
Code of CWE-23 in ovaa.apk
1908-
============================
1908+
===========================
19091909

19101910
We use the `ovaa.apk <https://github.com/oversecured/ovaa>`_ sample to explain the vulnerability code of CWE-23.
19111911

1912-
.. image:: https://imgur.com/GosANyj.png
1912+
.. image:: https://imgur.com/KT277GG.png
19131913

1914-
Quark Script: CWE-23.py
1915-
========================
1914+
CWE-23 Detection Process Using Quark Script API
1915+
================================================
1916+
1917+
.. image:: https://imgur.com/D852ZLV.png
19161918

19171919
Let’s use the above APIs to show how the Quark script finds this vulnerability.
19181920

1919-
To begin with, we will create a detection rule named ``accessFileInExternalDir.json`` to identify behavior that accesses a file in an external directory.
1921+
To begin with, we create a detection rule named ``accessFileInExternalDir.json`` to identify behavior that accesses a file in an external directory.
19201922

1921-
Next, we will use ``methodInstance.getArguments()`` to retrieve the file path argument and check whether it belongs to the APK or not. If it does not belong to the APK, the argument is likely from external input.
1923+
Next, we use ``methodInstance.getArguments()`` to retrieve the file path argument and check whether it belongs to the APK. If it does not belong to the APK, the argument is likely from external input.
19221924

1923-
Finally, we will use the Quark API ``quarkResultInstance.findMethodInCaller(callerMethod, targetMethod)`` to search for any APIs in the caller method that match the string. If no matching API is found, the APK does not neutralize special elements within the argument, which may result in the CWE-23 vulnerability. If a matching API is found, we will verify whether it neutralizes the Relative Path string or not. If it does not neutralize it, the APK may still be vulnerable to CWE-23.
1925+
Then, we use the Quark Script API ``quarkResultInstance.findMethodInCaller(callerMethod, targetMethod)`` to search for any APIs in the caller method that are used to match strings. If no API is found, that implies the APK does not neutralize special elements within the argument, possibly resulting in CWE-23 vulnerability.
1926+
1927+
Quark Script: CWE-23.py
1928+
========================
1929+
1930+
.. image:: https://imgur.com/lk1C4CX.jpg
19241931

19251932
.. code-block:: python
19261933
1927-
from quark.script import runQuarkAnalysis, Rule
1934+
from quark.script import runQuarkAnalysis, Rule
19281935
1929-
SAMPLE_PATH = "ovaa.apk"
1930-
RULE_PATH = "accessFileInExternalDir.json"
1936+
SAMPLE_PATH = "ovaa.apk"
1937+
RULE_PATH = "accessFileInExternalDir.json"
19311938
19321939
1933-
STRING_MATCHING_API = [
1934-
["Ljava/lang/String;", "contains", "(Ljava/lang/CharSequence)Z"],
1935-
["Ljava/lang/String;", "indexOf", "(I)I"],
1936-
["Ljava/lang/String;", "indexOf", "(Ljava/lang/String;)I"],
1937-
["Ljava/lang/String;", "matches", "(Ljava/lang/String;)Z"],
1938-
[
1939-
"Ljava/lang/String;",
1940-
"replaceAll",
1941-
"(Ljava/lang/String; Ljava/lang/String;)Ljava/lang/String;",
1942-
],
1943-
]
1940+
STRING_MATCHING_API = [
1941+
["Ljava/lang/String;", "contains", "(Ljava/lang/CharSequence)Z"],
1942+
["Ljava/lang/String;", "indexOf", "(I)I"],
1943+
["Ljava/lang/String;", "indexOf", "(Ljava/lang/String;)I"],
1944+
["Ljava/lang/String;", "matches", "(Ljava/lang/String;)Z"],
1945+
[
1946+
"Ljava/lang/String;",
1947+
"replaceAll",
1948+
"(Ljava/lang/String; Ljava/lang/String;)Ljava/lang/String;",
1949+
],
1950+
]
19441951
1945-
ruleInstance = Rule(RULE_PATH)
1946-
quarkResult = runQuarkAnalysis(SAMPLE_PATH, ruleInstance)
1952+
ruleInstance = Rule(RULE_PATH)
1953+
quarkResult = runQuarkAnalysis(SAMPLE_PATH, ruleInstance)
19471954
1948-
for accessExternalDir in quarkResult.behaviorOccurList:
1955+
for accessExternalDir in quarkResult.behaviorOccurList:
19491956
1950-
filePath = accessExternalDir.secondAPI.getArguments()[2]
1957+
filePath = accessExternalDir.secondAPI.getArguments()[2]
19511958
1952-
if quarkResult.isHardcoded(filePath):
1953-
continue
1959+
if quarkResult.isHardcoded(filePath):
1960+
continue
19541961
1955-
caller = accessExternalDir.methodCaller
1956-
strMatchingAPIs = [
1957-
api
1958-
for api in STRING_MATCHING_API
1959-
if quarkResult.findMethodInCaller(caller, api)
1960-
]
1962+
caller = accessExternalDir.methodCaller
1963+
strMatchingAPIs = [
1964+
api
1965+
for api in STRING_MATCHING_API
1966+
if quarkResult.findMethodInCaller(caller, api)
1967+
]
19611968
1962-
if not strMatchingAPIs:
1963-
print(f"CWE-23 is detected in method, {caller.fullName}")
1964-
elif strMatchingAPIs.find("..") == -1:
1965-
print(f"CWE-23 is detected in method, {caller.fullName}")
1969+
if not strMatchingAPIs:
1970+
print(f"CWE-23 is detected in method, {caller.fullName}")
19661971
19671972
Quark Rule: accessFileInExternalDir.json
19681973
=========================================
19691974

1975+
.. image:: https://imgur.com/N2uKsZj.png
1976+
19701977
.. code-block:: json
19711978
1972-
{
1973-
"crime": "Access a file in an external directory",
1974-
"permission": [],
1975-
"api": [
1976-
{
1977-
"class": "Landroid/os/Environment;",
1978-
"method": "getExternalStorageDirectory",
1979-
"descriptor": "()Ljava/io/File;"
1980-
},
1981-
{
1982-
"class": "Ljava/io/File;",
1983-
"method": "<init>",
1984-
"descriptor": "(Ljava/io/File;Ljava/lang/String;)V"
1985-
}
1986-
],
1987-
"score": 1,
1988-
"label": []
1989-
}
1979+
{
1980+
"crime": "Access a file in an external directory",
1981+
"permission": [],
1982+
"api": [
1983+
{
1984+
"class": "Landroid/os/Environment;",
1985+
"method": "getExternalStorageDirectory",
1986+
"descriptor": "()Ljava/io/File;"
1987+
},
1988+
{
1989+
"class": "Ljava/io/File;",
1990+
"method": "<init>",
1991+
"descriptor": "(Ljava/io/File;Ljava/lang/String;)V"
1992+
}
1993+
],
1994+
"score": 1,
1995+
"label": []
1996+
}
19901997
19911998
Quark Script Result
1992-
=====================
1999+
====================
19932000

19942001
.. code-block:: TEXT
19952002
1996-
$ python3 CWE-23.py
1997-
CWE-23 is detected in method, Loversecured/ovaa/providers/TheftOverwriteProvider; openFile (Landroid/net/Uri; Ljava/lang/String;)Landroid/os/ParcelFileDescriptor;
2003+
$ python3 CWE-23.py
2004+
CWE-23 is detected in method, Loversecured/ovaa/providers/TheftOverwriteProvider; openFile (Landroid/net/Uri; Ljava/lang/String;)Landroid/os/ParcelFileDescriptor;
2005+
2006+
2007+
2008+
19982009
19992010
Detect CWE-338 in Android Application
20002011
--------------------------------------

0 commit comments

Comments
 (0)