You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This scenario seeks to find **External Control of File Name or Path** in
4
-
the APK file.
3
+
This scenario seeks to find **External Control of File Name or Path** in the APK file.
5
4
6
5
## CWE-73 External Control of File Name or Path
7
6
8
7
We analyze the definition of CWE-73 and identify its characteristics.
9
8
10
-
See [CWE-73](https://cwe.mitre.org/data/definitions/73.html) for more
11
-
details.
9
+
See [CWE-73](https://cwe.mitre.org/data/definitions/73.html) for more details.
12
10
13
-
11
+
14
12
15
13
## Code of CWE-73 in ovaa.apk
16
14
17
-
We use the [ovaa.apk](https://github.com/oversecured/ovaa) sample to
18
-
explain the vulnerability code of CWE-73.
15
+
We use the [ovaa.apk](https://github.com/oversecured/ovaa) sample to explain the vulnerability code of CWE-73.
19
16
20
-
17
+
21
18
22
-
## Quark Script: CWE-73.py
19
+
## CWE-73 Detection Process Using Quark Script API
20
+
21
+
23
22
24
-
Let's use the above APIs to show how Quark script find this
25
-
vulnerability.
23
+
Let’s use the above APIs to show how Quark script finds this vulnerability.
26
24
27
-
First, we design a detection rule `accessFileInExternalDir.json` to spot
28
-
behavior accessing a file in an external directory.
25
+
First, we design a detection rule ``useLastPathSegmentAsFileName.json`` to spot behavior that uses the last path segment as the file name.
29
26
30
-
Second, we use API `methodInstance.getArguments()` to get the argument
31
-
for the file path and use `quarkResultInstance.isHardcoded(argument)` to
32
-
check if the argument is hardcoded into the APK. If **No**, the argument
33
-
is from external input.
27
+
Second, we use the API ``methodInstance.getArguments()`` to get the argument for the file path and use ``quarkResultInstance.isHardcoded(argument)`` to check if the argument is hardcoded into the APK. If **No**, the argument is from external input.
34
28
35
-
Finally, we use Quark API
36
-
`quarkResultInstance.findMethodInCaller(callerMethod, targetMethod)` to
37
-
check if any APIs in the caller method for opening files. If **YES**,
38
-
the APK performs file operations using external input as a path, which
39
-
may cause CWE-73 vulnerability.
29
+
Finally, we use Quark API ``quarkResultInstance.findMethodInCaller(callerMethod, targetMethod)`` to check if there are any APIs in the caller method for opening files. If **YES**, the APK performs file operations using external input as a path, which may cause CWE-73 vulnerability.
30
+
31
+
## Quark Script: CWE-73.py
40
32
41
-
```python
33
+
34
+
35
+
```python
42
36
from quark.script import runQuarkAnalysis, Rule
43
37
44
38
SAMPLE_PATH="ovaa.apk"
45
-
RULE_PATH="accessFileInExternalDir.json"
39
+
RULE_PATH="useLastPathSegmentAsFileName.json"
46
40
47
41
OPEN_FILE_API= [
48
42
"Landroid/os/ParcelFileDescriptor;", # Class name
@@ -66,17 +60,19 @@ for accessExternalDir in quarkResult.behaviorOccurList:
66
60
print("CWE-73 is detected in method, ", caller.fullName)
67
61
```
68
62
69
-
## Quark Rule: accessFileInExternalDir.json
63
+
## Quark Rule: useLastPathSegmentAsFileName.json
64
+
65
+
70
66
71
-
```json
67
+
```json
72
68
{
73
-
"crime": "Access a file in an external directory",
69
+
"crime": "Use the last path segment as the file name",
74
70
"permission": [],
75
71
"api": [
76
72
{
77
-
"class": "Landroid/os/Environment;",
78
-
"method": "getExternalStorageDirectory",
79
-
"descriptor": "()Ljava/io/File;"
73
+
"class": "Landroid/net/Uri;",
74
+
"method": "getLastPathSegment",
75
+
"descriptor": "()Ljava/lang/String;"
80
76
},
81
77
{
82
78
"class": "Ljava/io/File;",
@@ -91,7 +87,7 @@ for accessExternalDir in quarkResult.behaviorOccurList:
91
87
92
88
## Quark Script Result
93
89
94
-
```TEXT
90
+
```
95
91
$ python CWE-73.py
96
92
CWE-73 is detected in method, Loversecured/ovaa/providers/TheftOverwriteProvider; openFile (Landroid/net/Uri; Ljava/lang/String;)Landroid/os/ParcelFileDescriptor;
Copy file name to clipboardExpand all lines: CWE-79/README.md
+22-23Lines changed: 22 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,39 +1,36 @@
1
1
# Detect CWE-79 in Android Application
2
2
3
-
This scenario seeks to find **Improper Neutralization of Input During
4
-
Web Page Generation ('Cross-site Scripting')** in the APK file.
3
+
This scenario seeks to find **Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)** in the APK file.
5
4
6
-
## CWE-79 Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
5
+
## CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
7
6
8
7
We analyze the definition of CWE-79 and identify its characteristics.
9
8
10
-
See [CWE-79](https://cwe.mitre.org/data/definitions/79.html) for more
11
-
details.
9
+
See [CWE-79](https://cwe.mitre.org/data/definitions/79.html) for more details.
12
10
13
-
11
+
14
12
15
13
## Code of CWE-79 in Vuldroid.apk
16
14
17
-
We use the [Vuldroid.apk](https://github.com/jaiswalakshansh/Vuldroid)
18
-
sample to explain the vulnerability code of CWE-79.
15
+
We use the [Vuldroid.apk](https://github.com/jaiswalakshansh/Vuldroid) sample to explain the vulnerability code of CWE-79.
19
16
20
-
17
+
21
18
22
-
## Quark Script CWE-79.py
19
+
## CWE-79 Detection Process Using Quark Script API
20
+
21
+
23
22
24
-
Let's use the above APIs to show how the Quark script finds this
25
-
vulnerability.
23
+
Let’s use the above APIs to show how the Quark script finds this vulnerability.
26
24
27
-
First, we design a detection rule `loadUrlFromIntent.json` to spot the
28
-
behavior loading URL from intent data to the WebView instance.
25
+
First, we design a detection rule ``loadUrlFromIntent.json`` to spot the behavior loading URL from intent data to the WebView instance.
29
26
30
-
Next, we use API
31
-
`quarkResultInstance.findMethodInCaller(callerMethod, targetMethod)` and
32
-
`methodInstance.getArguments()` to check if the Javascript execution is
33
-
enabled in the WebView. Finally, we check if there are any famous XSS
34
-
filters. If NO, that may cause CWE-79 vulnerability.
27
+
Next, we use API ``quarkResultInstance.findMethodInCaller(callerMethod, targetMethod)`` and ``methodInstance.getArguments()`` to check if the Javascript execution is enabled in the WebView. Finally, we check if there are any famous XSS filters. If **NO**, that may cause CWE-79 vulnerability.
28
+
29
+
## Quark Script CWE-79.py
35
30
36
-
```python
31
+
32
+
33
+
```python
37
34
from quark.script import runQuarkAnalysis, Rule
38
35
39
36
SAMPLE_PATH="Vuldroid.apk"
@@ -88,7 +85,9 @@ for loadUrl in quarkResult.behaviorOccurList:
88
85
89
86
## Quark Rule: loadUrlFromIntent.json
90
87
91
-
```json
88
+
89
+
90
+
```json
92
91
{
93
92
"crime": "Load URL from intent to WebView",
94
93
"permission": [],
@@ -111,7 +110,7 @@ for loadUrl in quarkResult.behaviorOccurList:
111
110
112
111
## Quark Script Result
113
112
114
-
```TEXT
113
+
```TEXT
115
114
$ python CWE-79.py
116
115
CWE-79 is detected in method, Lcom/vuldroid/application/ForgetPassword; onCreate (Landroid/os/Bundle;)V
0 commit comments