Skip to content

Commit 4e0ea04

Browse files
chanel-ychanel-y
committed
add query, tests
1 parent c961340 commit 4e0ea04

File tree

5 files changed

+161
-0
lines changed

5 files changed

+161
-0
lines changed

‎powershell/ql/src/queries/security/cwe-319/UnsafeSMBSettings.qhelp

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
<p>The commands<code>Set-SmbClientConfiguration</code> and <code>Set-SmbServerConfiguration</code> are used to set configurations for SMB traffic.
7+
Insecure configurations such as outdated versions, or turning off encryption, can make connections susceptible to attackers.
8+
</overview>
9+
10+
<recommendation>
11+
<p>The minimum version of SMB is 3.0, but it is recommended to use the latest version. For SMB server service (inbound connections). For example: <code>Set-SmbServerConfiguration -Smb2DialectMin SMB300</code>
12+
For SMB client service (outbound connections). For example: <code>Set-SmbClientConfiguration -Smb2DialectMin SMB300</code>
13+
14+
<p>
15+
SMB encryption should be enabled
16+
For SMB server service (inbound connections). For example: <code> Set-SmbServerConfiguration -encryptdata $true -rejectunencryptedaccess $true </code>
17+
For SMB client service (outbound connections). For example: <code> Set-SmbClientConfiguration -RequireEncryption $true </code>
18+
</p>
19+
20+
<p>
21+
SMB NTLM blocking should be enabled. For example: <code>Set-SMbClientConfiguration -BlockNTLM $true </code>
22+
</p>
23+
</recommendation>
24+
25+
<references>
26+
<li>MSDN: <a href="https://learn.microsoft.com/en-us/powershell/module/smbshare/set-smbserverconfiguration">Set-SmbServerConfiguration</a>.</li>
27+
<li>MSDN: <a href="https://learn.microsoft.com/en-us/powershell/module/smbshare/set-smbclientconfiguration">Set-SmbClientConfiguration</a>.</li>
28+
29+
</references>
30+
</qhelp>

‎powershell/ql/src/queries/security/cwe-319/UnsafeSMBSettings.ql

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
/**
2+
* @name Insecure SMB settings
3+
* @description Use of insecure SMB configurations allow attackers to access connections
4+
* @kind problem
5+
* @problem.severity error
6+
* @security-severity 8.8
7+
* @precision high
8+
* @id powershell/microsoft/public/insecure-smb-setting
9+
* @tags correctness
10+
* security
11+
* external/cwe/cwe-315
12+
*/
13+
import powershell
14+
15+
abstract class SMBConfiguration extends CmdCall {
16+
abstract Expr getAMisconfiguredSetting();
17+
18+
/** Gets the minimum version of the SMB protocol to be used */
19+
Expr getMisconfiguredSmb2DialectMin() {
20+
exists(Expr dialectMin |
21+
dialectMin = this.getNamedArgument("smb2dialectmin") and
22+
dialectMin.getValue().toString().toLowerCase() in ["none", "smb202", "smb210"] and
23+
result = dialectMin
24+
)
25+
}
26+
}
27+
28+
/** A call to `Set-SmbServerConfiguration`. */
29+
class SetSMBClientConfiguration extends SMBConfiguration {
30+
SetSMBClientConfiguration() { this.getAName() = "Set-SmbClientConfiguration" }
31+
32+
/** holds if the argument `requireencryption` is supplied with a `$false` value. */
33+
Expr getMisconfiguredRequireEncryption() {
34+
exists(Expr requireEncryption |
35+
requireEncryption = this.getNamedArgument("requireencryption") and
36+
requireEncryption.getValue().asBoolean() = false and
37+
result = requireEncryption
38+
)
39+
}
40+
41+
/** Holds if the argument `blockntlm` is supplied with a `$false` value. */
42+
Expr getMisconfiguredBlocksNTLM() {
43+
exists(Expr blocksNTLM |
44+
blocksNTLM = this.getNamedArgument("blockntlm") and
45+
blocksNTLM.getValue().asBoolean() = false and
46+
result = blocksNTLM
47+
)
48+
}
49+
50+
override Expr getAMisconfiguredSetting(){
51+
result = this.getMisconfiguredRequireEncryption() or
52+
result = this.getMisconfiguredBlocksNTLM() or
53+
result = this.getMisconfiguredSmb2DialectMin()
54+
}
55+
}
56+
57+
/** A call to `Set-SmbServerConfiguration`. */
58+
class SetSMBServerConfiguration extends SMBConfiguration {
59+
SetSMBServerConfiguration() {
60+
this.getAName() = "Set-SmbServerConfiguration"
61+
}
62+
/** holds if the argument `encryptdata` is supplied with a `$false` value. */
63+
Expr getMisconfiguredEncryptData() {
64+
exists(Expr encryptData |
65+
encryptData = this.getNamedArgument("encryptdata") and
66+
encryptData.getValue().asBoolean() = false and
67+
result = encryptData
68+
)
69+
}
70+
/** holds if the argument `encryptdata` is supplied with a `$false` value. */
71+
Expr getMisconfiguredRejectUnencryptedAccess(){
72+
exists(Expr rejectUnencryptedAccess |
73+
rejectUnencryptedAccess = this.getNamedArgument("rejectunencryptedaccess") and
74+
rejectUnencryptedAccess.getValue().asBoolean() = false and
75+
result = rejectUnencryptedAccess
76+
)
77+
}
78+
79+
override Expr getAMisconfiguredSetting(){
80+
result = this.getMisconfiguredEncryptData() or
81+
result = this.getMisconfiguredRejectUnencryptedAccess() or
82+
result = this.getMisconfiguredSmb2DialectMin()
83+
}
84+
85+
}
86+
87+
from SMBConfiguration config
88+
select config.getAMisconfiguredSetting(), "Unsafe SMB setting"

‎powershell/ql/test/query-tests/security/cwe-319/UnsafeSMBSettings.expected

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
| test.ps1:5:44:5:47 | None | Unsafe SMB setting |
2+
| test.ps1:7:44:7:49 | SMB210 | Unsafe SMB setting |
3+
| test.ps1:9:41:9:46 | false | Unsafe SMB setting |
4+
| test.ps1:9:73:9:78 | false | Unsafe SMB setting |
5+
| test.ps1:11:47:11:52 | false | Unsafe SMB setting |
6+
| test.ps1:13:39:13:44 | false | Unsafe SMB setting |
7+
| test.ps1:15:39:15:44 | false | Unsafe SMB setting |
8+
| test.ps1:15:65:15:70 | false | Unsafe SMB setting |
9+
| test.ps1:15:88:15:93 | SMB210 | Unsafe SMB setting |
10+
| test.ps1:17:44:17:47 | None | Unsafe SMB setting |
11+
| test.ps1:17:62:17:67 | false | Unsafe SMB setting |
12+
| test.ps1:17:94:17:99 | false | Unsafe SMB setting |

‎powershell/ql/test/query-tests/security/cwe-319/UnsafeSMBSettings.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
queries/security/cwe-319/UnsafeSMBSettings.ql

‎powershell/ql/test/query-tests/security/cwe-319/test.ps1

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-ntlm-blocking?tabs=powershell
2+
3+
#Bad Examples
4+
5+
Set-SmbServerConfiguration -Smb2DialectMin None
6+
7+
Set-SmbClientConfiguration -Smb2DialectMin SMB210
8+
9+
Set-SmbServerConfiguration -encryptdata $false -rejectunencryptedaccess $false
10+
11+
Set-SmbClientConfiguration -RequireEncryption $false
12+
13+
Set-SMbClientConfiguration -BlockNTLM $false
14+
15+
Set-SMbClientConfiguration -BlockNTLM $false -RequireEncryption $false -Smb2DialectMin SMB210
16+
17+
Set-SmbServerConfiguration -Smb2DialectMin None -encryptdata $false -rejectunencryptedaccess $false
18+
19+
#Good Examples
20+
21+
Set-SmbServerConfiguration -Smb2DialectMin SMB300
22+
23+
Set-SmbClientConfiguration -Smb2DialectMin SMB300
24+
25+
Set-SmbServerConfiguration -encryptdata $true -rejectunencryptedaccess $true
26+
27+
Set-SmbClientConfiguration -RequireEncryption $true
28+
29+
Set-SMbClientConfiguration -BlockNTLM $true
30+

0 commit comments

Comments
 (0)