You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This scenario seeks to find **the improper limitation of a pathname to a
4
-
restricted directory ('Path Traversal')**.
3
+
This scenario seeks to find **the improper limitation of a pathname to a restricted directory ('Path Traversal')**.
5
4
6
-
## CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')
5
+
## CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
7
6
8
7
We analyze the definition of CWE-22 and identify its characteristics.
9
8
10
-
See [CWE-22](https://cwe.mitre.org/data/definitions/22.html) for more
11
-
details.
9
+
See [CWE-22](https://cwe.mitre.org/data/definitions/22.html) for more details.
12
10
13
-
11
+
14
12
15
13
## Code of CWE-22 in ovaa.apk
16
14
17
-
We use the [ovaa.apk](https://github.com/oversecured/ovaa) sample to
18
-
explain the vulnerability code of CWE-22.
15
+
We use the [ovaa.apk](https://github.com/oversecured/ovaa) sample to explain the vulnerability code of CWE-22.
19
16
20
-
17
+
21
18
22
-
## Quark Script: CWE-22.py
19
+
## CWE-22 Detection Process Using Quark Script API
20
+
21
+
22
+
23
+
Let's use the above APIs to show how the Quark script finds this vulnerability.
23
24
24
-
Let's use the above APIs to show how the Quark script finds this
25
-
vulnerability.
25
+
First, we design a detection rule `accessFileInExternalDir.json` to spot behavior accessing a file in an external directory.
26
26
27
-
First, we design a detection rule `accessFileInExternalDir.json` to spot
28
-
behavior accessing a file in an external directory.
27
+
Next, we use API `methodInstance.getArguments()` to get the argument for the file path and use `quarkResultInstance.isHardcoded(argument)` to check if the argument is hardcoded into the APK. If **No**, the argument is from external input.
29
28
30
-
Next, we use API `methodInstance.getArguments()` to get the argument for
31
-
the file path and use `quarkResultInstance.isHardcoded(argument)` to
32
-
check if the argument is hardcoded into the APK. If No, the argument is
33
-
from external input.
29
+
Finally, we use Quark API `quarkResultInstance.findMethodInCaller(callerMethod, targetMethod)` to check if there are any APIs in the caller method for string matching. If **NO**, the APK does not neutralize special elements within the argument, which may cause CWE-22 vulnerability.
30
+
31
+
## Quark Script: CWE-22.py
34
32
35
-
Finally, we use Quark API
36
-
`quarkResultInstance.findMethodInCaller(callerMethod, targetMethod)` to
37
-
check if there are any APIs in the caller method for string matching. If
38
-
NO, the APK does not neutralize special elements within the argument,
api for api inSTRING_MATCHING_APIif quarkResult.findMethodInCaller(
63
+
caller, api)
70
64
]
71
65
72
66
ifnot strMatchingAPIs:
73
67
print(f"CWE-22 is detected in method, {caller.fullName}")
74
68
```
75
-
76
69
## Quark Rule: accessFileInExternalDir.json
77
70
78
-
```json
71
+
72
+
73
+
```json
79
74
{
80
75
"crime": "Access a file in an external directory",
81
76
"permission": [],
@@ -98,7 +93,7 @@ for accessExternalDir in quarkResult.behaviorOccurList:
98
93
99
94
## Quark Script Result
100
95
101
-
```TEXT
96
+
```
102
97
$ python3 CWE-22.py
103
98
CWE-22 is detected in method, Loversecured/ovaa/providers/TheftOverwriteProvider; openFile (Landroid/net/Uri; Ljava/lang/String;)Landroid/os/ParcelFileDescriptor;
This scenario aims to demonstrate the detection of the **Relative Path
4
-
Traversal** vulnerability.
3
+
This scenario aims to demonstrate the detection of the **Relative Path Traversal** vulnerability.
5
4
6
5
## CWE-23: Relative Path Traversal
7
6
8
7
We analyze the definition of CWE-23 and identify its characteristics.
9
8
10
-
See [CWE-23](https://cwe.mitre.org/data/definitions/23.html) for more
11
-
details.
9
+
See [CWE-23](https://cwe.mitre.org/data/definitions/23.html) for more details.
12
10
13
-
11
+
14
12
15
13
## Code of CWE-23 in ovaa.apk
16
14
17
-
We use the [ovaa.apk](https://github.com/oversecured/ovaa) sample to
18
-
explain the vulnerability code of CWE-23.
15
+
We use the [ovaa.apk](https://github.com/oversecured/ovaa) sample to explain the vulnerability code of CWE-23.
19
16
20
-
17
+
21
18
22
-
## Quark Script: CWE-23.py
19
+
## CWE-23 Detection Process Using Quark Script API
20
+
21
+
22
+
23
+
Let’s use the above APIs to show how the Quark script finds this vulnerability.
23
24
24
-
Let's use the above APIs to show how the Quark script finds this
25
-
vulnerability.
25
+
To begin with, we create a detection rule named ``accessFileInExternalDir.json`` to identify behavior that accesses a file in an external directory.
26
26
27
-
To begin with, we will create a detection rule named
28
-
`accessFileInExternalDir.json` to identify behavior that accesses a file
29
-
in an external directory.
27
+
Next, we use ``methodInstance.getArguments()`` to retrieve the file path argument and check whether it belongs to the APK. If it does not belong to the APK, the argument is likely from external input.
30
28
31
-
Next, we will use `methodInstance.getArguments()` to retrieve the file
32
-
path argument and check whether it belongs to the APK or not. If it does
33
-
not belong to the APK, the argument is likely from external input.
29
+
Then, we use the Quark Script API ``quarkResultInstance.findMethodInCaller(callerMethod, targetMethod)`` to search for any APIs in the caller method that are used to match strings. If no API is found, that implies the APK does not neutralize special elements within the argument, possibly resulting in CWE-23 vulnerability.
30
+
31
+
## Quark Script: CWE-23.py
34
32
35
-
Finally, we will use the Quark API
36
-
`quarkResultInstance.findMethodInCaller(callerMethod, targetMethod)` to
37
-
search for any APIs in the caller method that match the string. If no
38
-
matching API is found, the APK does not neutralize special elements
39
-
within the argument, which may result in the CWE-23 vulnerability. If a
40
-
matching API is found, we will verify whether it neutralizes the
41
-
Relative Path string or not. If it does not neutralize it, the APK may
42
-
still be vulnerable to CWE-23.
33
+
43
34
44
-
```python
35
+
```python
45
36
from quark.script import runQuarkAnalysis, Rule
46
37
47
38
SAMPLE_PATH="ovaa.apk"
@@ -79,27 +70,27 @@ for accessExternalDir in quarkResult.behaviorOccurList:
79
70
80
71
ifnot strMatchingAPIs:
81
72
print(f"CWE-23 is detected in method, {caller.fullName}")
82
-
elif strMatchingAPIs.find("..") ==-1:
83
-
print(f"CWE-23 is detected in method, {caller.fullName}")
84
73
```
85
74
86
75
## Quark Rule: accessFileInExternalDir.json
87
76
88
-
```json
77
+
78
+
79
+
```json
89
80
{
90
81
"crime": "Access a file in an external directory",
@@ -108,7 +99,7 @@ for accessExternalDir in quarkResult.behaviorOccurList:
108
99
109
100
## Quark Script Result
110
101
111
-
```TEXT
102
+
```
112
103
$ python3 CWE-23.py
113
104
CWE-23 is detected in method, Loversecured/ovaa/providers/TheftOverwriteProvider; openFile (Landroid/net/Uri; Ljava/lang/String;)Landroid/os/ParcelFileDescriptor;
0 commit comments