Skip to content

Commit 4de585b

Browse files
JerryTasiJerryTasi
authored
Optimize the document of Quark Script CWE-89, 117, and 295 (#58)
1 parent 586a6cd commit 4de585b

File tree

8 files changed

+58
-42
lines changed

8 files changed

+58
-42
lines changed

‎CWE-117/CWE-117.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,4 +19,4 @@
1919

2020
if not isKeywordFound:
2121
caller = logOutputBehavior.methodCaller.fullName
22-
print(f"CWE-117 is detected in method, {caller}")
22+
print(f"CWE-117 is detected in method, {caller}")

‎CWE-117/README.md‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,22 +8,28 @@ We analyze the definition of CWE-117 and identify its characteristics.
88

99
See [CWE-117](https://cwe.mitre.org/data/definitions/117.html) for more details.
1010

11-
![image](https://imgur.com/poFP2Py.jpg)
11+
![image](https://imgur.com/JEAyEsU.jpg)
1212

1313
## Code of CWE-117 in allsafe.apk
1414

1515
We use the [allsafe.apk](https://github.com/t0thkr1s/allsafe) sample to explain the vulnerability code of CWE-117.
1616

17-
![image](https://imgur.com/AgCpFzr.jpg)
17+
![image](https://imgur.com/ueePFNu.jpg)
1818

19-
## Quark Script CWE-117.py
19+
## CWE-117 Detection Process Using Quark Script API
20+
21+
![image](https://imgur.com/Y5hd4Uc.jpg)
2022

2123
First, we design a detection rule ``writeContentToLog.json`` to spot on behavior using the method that writes contents to the log file.
2224

2325
Then, we use ``methodInstance.getArguments()`` to get all parameter values of this method. And we check if these parameters contain keywords of APIs for neutralization, such as ``escape``, ``replace``, ``format``, and ``setFilter``.
2426

2527
If the answer is **YES**, that may result in secret context leakage into the log file, or the attacker may perform log forging attacks.
2628

29+
## Quark Script CWE-117.py
30+
31+
![image](https://imgur.com/F1X3qg3.jpg)
32+
2733
```python
2834
from quark.script import Rule, runQuarkAnalysis
2935

@@ -51,9 +57,11 @@ for logOutputBehavior in quarkResult.behaviorOccurList:
5157

5258
## Quark Rule: writeContentToLog.json
5359

60+
![image](https://imgur.com/hC4zGgT.jpg)
61+
5462
```json
5563
{
56-
"crime": "Write contents to the log.",
64+
"crime": "Write contents to the log",
5765
"permission": [],
5866
"api": [
5967
{
@@ -77,4 +85,4 @@ for logOutputBehavior in quarkResult.behaviorOccurList:
7785
```TEXT
7886
$ python CWE-117.py
7987
CWE-117 is detected in method, Linfosecadventures/allsafe/challenges/InsecureLogging; lambda$onCreateView$0 (Lcom/google/android/material/textfield/TextInputEditText; Landroid/widget/TextView; I Landroid/view/KeyEvent;)Z
80-
```
88+
```

‎CWE-117/writeContentToLog.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"crime": "Write contents to the log.",
2+
"crime": "Write contents to the log",
33
"permission": [],
44
"api": [
55
{

‎CWE-295/CWE-295.py‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,14 @@
44
TARGET_METHOD = [
55
"Landroid/webkit/SslErrorHandler;", # class name
66
"proceed", # method name
7-
"()V" # descriptor
7+
"()V", # descriptor
88
]
99
OVERRIDDEN_METHOD = [
1010
"Landroid/webkit/WebViewClient;", # class name
1111
"onReceivedSslError", # method name
12-
"(Landroid/webkit/WebView;" + " Landroid/webkit/SslErrorHandler;" + \
13-
" Landroid/net/http/SslError;)V" # descriptor
12+
"(Landroid/webkit/WebView;"
13+
+ " Landroid/webkit/SslErrorHandler;"
14+
+ " Landroid/net/http/SslError;)V", # descriptor
1415
]
1516

1617
for sslProceedCaller in findMethodInAPK(SAMPLE_PATH, TARGET_METHOD):

‎CWE-295/README.md‎

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,23 +8,29 @@ We analyze the definition of CWE-295 and identify its characteristics.
88

99
See [CWE-295](https://cwe.mitre.org/data/definitions/295.html) for more details.
1010

11-
![image](https://imgur.com/cuZ5qPp.jpg)
11+
![image](https://imgur.com/w6yx17J.jpg)
1212

1313
## Code of CWE-295 in InsecureShop.apk
1414

1515
We use the [InsecureShop.apk](https://github.com/hax0rgb/InsecureShop) sample to explain the vulnerability code of CWE-295.
1616

17-
![image](https://imgur.com/t7Y5clb.jpg)
17+
![image](https://imgur.com/iBt3mzh.jpg)
1818

19-
## Quark Script CWE-295.py
19+
## CWE-295 Detection Process Using Quark Script API
20+
21+
![image](https://imgur.com/HBBurwx.jpg)
2022

2123
To begin with, we use the API ``findMethodInAPK(samplePath, targetMethod)`` to locate all callers of method ``SslErrorHandler.proceed``.
2224

23-
Next, we must verify whether the caller overrides the method ``WebViewClient.onReceivedSslErroris``.
25+
Next, we must verify whether the caller overrides the method ``WebViewClient.onReceivedSslError``.
26+
27+
Therefore, we check if the caller has the same method name and descriptor as ``WebViewClient.onReceivedSslError``, then use ``findSuperclassHierarchy()`` to see if its class extends ``Landroid/webkit/WebViewClient``.
2428

25-
Therefore, we check if the method name and descriptor of the caller match those of ``WebViewClient.onReceivedSslErroris``. After that, we use the API ``methodInstance.findSuperclassHierarchy()`` to check if the superclasses of the caller include ``Landroid/webkit/WebViewClient``.
29+
If both are **YES**, the APK will proceed with HTTPS connections without certificate validation when an SSL error occurs, which may cause CWE-295 vulnerability.
2630

27-
If both are **YES**, the APK will call ``SslErrorHandler.procees`` without certificate validation when an SSL error occurs, which may cause CWE-295 vulnerability.
31+
## Quark Script CWE-295.py
32+
33+
![image](https://imgur.com/h9ydW0Y.jpg)
2834

2935
```python
3036
from quark.script import findMethodInAPK
@@ -33,13 +39,14 @@ SAMPLE_PATH = "insecureShop.apk"
3339
TARGET_METHOD = [
3440
"Landroid/webkit/SslErrorHandler;", # class name
3541
"proceed", # method name
36-
"()V" # descriptor
42+
"()V", # descriptor
3743
]
3844
OVERRIDDEN_METHOD = [
3945
"Landroid/webkit/WebViewClient;", # class name
4046
"onReceivedSslError", # method name
41-
"(Landroid/webkit/WebView;" + " Landroid/webkit/SslErrorHandler;" + \
42-
" Landroid/net/http/SslError;)V" # descriptor
47+
"(Landroid/webkit/WebView;"
48+
+ " Landroid/webkit/SslErrorHandler;"
49+
+ " Landroid/net/http/SslError;)V", # descriptor
4350
]
4451

4552
for sslProceedCaller in findMethodInAPK(SAMPLE_PATH, TARGET_METHOD):
@@ -56,4 +63,4 @@ for sslProceedCaller in findMethodInAPK(SAMPLE_PATH, TARGET_METHOD):
5663
```TEXT
5764
$　python3 CWE-295.py
5865
CWE-295 is detected in method, Lcom/insecureshop/util/CustomWebViewClient; onReceivedSslError (Landroid/webkit/WebView; Landroid/webkit/SslErrorHandler; Landroid/net/http/SslError;)V
59-
```
66+
```

‎CWE-89/CWE-89.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,6 @@
1414

1515
for sqlCommandExecution in quarkResult.behaviorOccurList:
1616
if sqlCommandExecution.isArgFromMethod(
17-
targetMethod
17+
targetMethod
1818
):
19-
print(f"CWE-89 is detected in {SAMPLE_PATH}")
19+
print(f"CWE-89 is detected in {SAMPLE_PATH}")

‎CWE-89/README.md‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -6,31 +6,29 @@ This scenario seeks to find **SQL injection** in the APK file.
66

77
We analyze the definition of CWE-89 and identify its characteristics.
88

9-
See [CWE-89](https://cwe.mitre.org/data/definitions/89.html) for more
10-
details.
9+
See [CWE-89](https://cwe.mitre.org/data/definitions/89.html) for more details.
1110

12-
![image](https://i.imgur.com/iJ1yIBb.jpg)
11+
![image](https://imgur.com/Yx9vIS2.jpg)
1312

14-
## Code of CWE-89 in androgoat.apk
13+
## Code of CWE-89 in AndroGoat.apk
1514

16-
We use the [androgoat.apk](https://github.com/satishpatnayak/AndroGoat)
17-
sample to explain the vulnerability code of CWE-89.
15+
We use the [AndroGoat.apk](https://github.com/satishpatnayak/AndroGoat) sample to explain the vulnerability code of CWE-89.
1816

19-
![image](https://i.imgur.com/bdQqWFb.jpg)
17+
![image](https://imgur.com/QWvu8te.jpg)
2018

21-
## Quark Script: CWE-89.py
19+
## CWE-89 Detection Process Using Quark Script API
20+
21+
![image](https://imgur.com/gvPBB3v.jpg)
22+
23+
Let’s use the above APIs to show how the Quark script finds this vulnerability.
2224

23-
Let\'s use the above APIs to show how the Quark script finds this
24-
vulnerability.
25+
First, we design a detection rule `executeSQLCommand.json` to spot on behavior using SQL command Execution. Then, we use API `behaviorInstance.isArgFromMethod(targetMethod)` to check if `append` uses the value of `getText` as the argument. If yes, we confirmed that the SQL command string is built from user input, which will cause CWE-89 vulnerability.
2526

26-
First, we design a detection rule `executeSQLCommand.json` to spot on
27-
behavior using SQL command Execution. Then, we use API
28-
`behaviorInstance.isArgFromMethod(targetMethod)` to check if `append`
29-
uses the value of `getText` as the argument. If yes, we confirmed that
30-
the SQL command string is built from user input, which will cause CWE-89
31-
vulnerability.
27+
## Quark Script: CWE-89.py
28+
29+
![image](https://imgur.com/B6Mfp2L.jpg)
3230

33-
``` python
31+
```python
3432
from quark.script import runQuarkAnalysis, Rule
3533

3634
SAMPLE_PATH = "AndroGoat.apk"
@@ -54,7 +52,9 @@ for sqlCommandExecution in quarkResult.behaviorOccurList:
5452

5553
## Quark Rule: executeSQLCommand.json
5654

57-
``` json
55+
![image](https://imgur.com/aYnt5oq.jpg)
56+
57+
```json
5858
{
5959
"crime": "Execute SQL Command",
6060
"permission": [],
@@ -77,7 +77,7 @@ for sqlCommandExecution in quarkResult.behaviorOccurList:
7777

7878
## Quark Script Result
7979

80-
``` text
80+
```TEXT
8181
$ python3 CWE-89.py
8282
8383
CWE-89 is detected in AndroGoat.apk

‎CWE-89/executeSQLCommand.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,4 @@
1515
],
1616
"score": 1,
1717
"label": []
18-
}
18+
}

0 commit comments

Comments
 (0)