Skip to content

Commit 4eb92af

Browse files
bdrodesbdrodes
committed
Banned Modes ql and qhelp
1 parent 9f09e67 commit 4eb92af

File tree

4 files changed

+123
-0
lines changed

4 files changed

+123
-0
lines changed

‎cpp/ql/src/Microsoft/Security/Cryptography/BannedModesCAPI.qhelp

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
6+
<overview>
7+
<p> Violation - Use of one of the following unsafe encryption modes that is not approved: ECB, OFB, CFB, CTR, CCM, or GCM.</p>
8+
<p> These modes are vulnerable to attacks and may cause exposure of sensitive information. For example, using <code> ECB </code> to encrypt a plaintext block always produces a same cipher text, so it can easily tell if two encrypted messages are identical. Using approved modes can avoid these unnecessary risks.</p>
9+
</overview>
10+
11+
<recommendation>
12+
<p> - Use only approved modes CBC, CTS and XTS.</p>
13+
</recommendation>
14+
15+
<example>
16+
<p>Violation:</p>
17+
18+
<sample src="examples/BannedModesCAPI/BannedModesCAPI1.cpp" />
19+
20+
<p>Solution:</p>
21+
22+
<sample src="examples/BannedModesCAPI/BannedModesCAPI2.cpp" />
23+
</example>
24+
25+
<references>
26+
<li>Microsoft Docs: <a href="https://learn.microsoft.com/en-us/security/engineering/cryptographic-recommendations">Microsoft SDL Cryptographic Recommendations</a>.</li>
27+
</references>
28+
29+
</qhelp>

‎cpp/ql/src/Microsoft/Security/Cryptography/BannedModesCAPI.ql

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
/**
2+
* @name Weak cryptography
3+
* @description Finds explicit uses of block cipher chaining mode algorithms that are not approved. (CAPI)
4+
* @kind problem
5+
* @id cpp/weak-crypto/capi/banned-modes
6+
* @problem.severity error
7+
* @precision high
8+
* @tags security
9+
* external/cwe/cwe-327
10+
*/
11+
12+
import cpp
13+
import semmle.code.cpp.dataflow.new.DataFlow
14+
import CryptoDataflowCapi
15+
16+
module CapiSetBlockCipherConfiguration implements DataFlow::ConfigSig {
17+
predicate isSource(DataFlow::Node source) {
18+
source.asExpr().isConstant() and
19+
// KP_MODE
20+
// CRYPT_MODE_CBC 1 - Cipher block chaining - Microsoft-Only: Only mode allowed by Crypto Board from this list (CBC-MAC)
21+
// CRYPT_MODE_ECB 2 - Electronic code book - Generally not recommended for usage in cryptographic protocols at all
22+
// CRYPT_MODE_OFB 3 - Output feedback mode - Microsoft-Only: Banned, usage requires Crypto Board review
23+
// CRYPT_MODE_CFB 4 - Cipher feedback mode - Microsoft-Only: Banned, usage requires Crypto Board review
24+
// CRYPT_MODE_CTS 5 - Ciphertext stealing mode - Microsoft-Only: CTS is approved by Crypto Board, but should probably use CNG and not CAPI
25+
source.asExpr().getValue().toInt() != 1
26+
}
27+
28+
predicate isSink(DataFlow::Node sink) {
29+
exists(CapiCryptCryptSetKeyParamtoKPMODE call | sink.asIndirectExpr() = call.getArgument(2))
30+
}
31+
}
32+
33+
module CapiSetBlockCipherTrace = DataFlow::Global<CapiSetBlockCipherConfiguration>;
34+
35+
from CapiCryptCryptSetKeyParamtoKPMODE call, DataFlow::Node src, DataFlow::Node sink
36+
where
37+
sink.asIndirectExpr() = call.getArgument(2) and
38+
CapiSetBlockCipherTrace::flow(src, sink)
39+
select call,
40+
"Call to 'CryptSetKeyParam' function with argument dwParam = KP_MODE is setting up a banned block cipher mode."

‎cpp/ql/src/Microsoft/Security/Cryptography/BannedModesCNG.qhelp

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
6+
<overview>
7+
<p> Violation - Use of one of the following unsafe encryption modes that is not approved: ECB, OFB, CFB, CTR, CCM, or GCM.</p>
8+
<p> These modes are vulnerable to attacks and may cause exposure of sensitive information. For example, using <code> ECB </code> to encrypt a plaintext block always produces a same cipher text, so it can easily tell if two encrypted messages are identical. Using approved modes can avoid these unnecessary risks.</p>
9+
</overview>
10+
11+
<recommendation>
12+
<p> - Use only approved modes CBC, CTS and XTS.</p>
13+
</recommendation>
14+
15+
<example>
16+
<p>Violation:</p>
17+
18+
<sample src="examples/BannedModesCNG/BannedModesCNG1.cpp" />
19+
20+
<p>Solution:</p>
21+
22+
<sample src="examples/BannedModesCNG/BannedModesCNG2.cpp" />
23+
</example>
24+
25+
26+
<references>
27+
<li>Microsoft Docs: <a href="https://learn.microsoft.com/en-us/security/engineering/cryptographic-recommendations">Microsoft SDL Cryptographic Recommendations</a>.</li>
28+
</references>
29+
30+
31+
</qhelp>

‎cpp/ql/src/Microsoft/Security/Cryptography/BannedModesCNG.ql

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/**
2+
* @name Weak cryptography
3+
* @description Finds explicit uses of block cipher chaining mode algorithms that are not approved. (CNG)
4+
* @kind problem
5+
* @id cpp/weak-crypto/cng/banned-modes
6+
* @problem.severity error
7+
* @precision high
8+
* @tags security
9+
* external/cwe/cwe-327
10+
*/
11+
12+
import cpp
13+
import semmle.code.cpp.dataflow.new.DataFlow
14+
import CryptoDataflowCng
15+
16+
from CngBCryptSetPropertyParamtoKChainingMode call, DataFlow::Node src, DataFlow::Node sink
17+
where
18+
sink.asIndirectArgument() = call.getArgument(2) and
19+
CngBCryptSetPropertyChainingBannedModeIndirectParameter::flow(src, sink)
20+
or
21+
sink.asExpr() = call.getArgument(2) and CngBCryptSetPropertyChainingBannedMode::flow(src, sink)
22+
select call,
23+
"Call to 'BCryptSetProperty' function with argument pszProperty = \"ChainingMode\" is setting up a banned block cipher mode."

0 commit comments

Comments
 (0)