Skip to content

Commit 7c83d9d

Browse files
MathiasVPMathiasVP
authored
Merge pull request #262 from microsoft/powershell-smb-settings
Powershell SMB settings
2 parents c961340 + a0dbf93 commit 7c83d9d

File tree

5 files changed

+161
-0
lines changed

5 files changed

+161
-0
lines changed

‎powershell/ql/src/queries/security/cwe-319/UnsafeSMBSettings.qhelp

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
<p>The commands<code>Set-SmbClientConfiguration</code> and <code>Set-SmbServerConfiguration</code> are used to set configurations for SMB traffic.
7+
Insecure configurations such as outdated versions, or turning off encryption, can make connections susceptible to attackers.
8+
</p>
9+
</overview>
10+
11+
<recommendation>
12+
<p>The minimum version of SMB is 3.0, but it is recommended to use the latest version. For example, use:
13+
<code>Set-SmbServerConfiguration -Smb2DialectMin SMB300</code> or <code>Set-SmbClientConfiguration -Smb2DialectMin SMB300</code>
14+
</p>
15+
<p>
16+
SMB encryption should be enabled. For example, use:
17+
<code> Set-SmbServerConfiguration -encryptdata $true -rejectunencryptedaccess $true </code> or <code> Set-SmbClientConfiguration -RequireEncryption $true </code>
18+
</p>
19+
20+
<p>
21+
SMB NTLM blocking should be enabled. For example: <code>Set-SMbClientConfiguration -BlockNTLM $true </code>
22+
</p>
23+
</recommendation>
24+
25+
<references>
26+
<li>MSDN: <a href="https://learn.microsoft.com/en-us/powershell/module/smbshare/set-smbserverconfiguration">Set-SmbServerConfiguration</a>.</li>
27+
<li>MSDN: <a href="https://learn.microsoft.com/en-us/powershell/module/smbshare/set-smbclientconfiguration">Set-SmbClientConfiguration</a>.</li>
28+
29+
</references>
30+
</qhelp>

‎powershell/ql/src/queries/security/cwe-319/UnsafeSMBSettings.ql

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
/**
2+
* @name Insecure SMB settings
3+
* @description Use of insecure SMB configurations allow attackers to access connections
4+
* @kind problem
5+
* @problem.severity error
6+
* @security-severity 8.8
7+
* @precision high
8+
* @id powershell/microsoft/public/insecure-smb-setting
9+
* @tags correctness
10+
* security
11+
* external/cwe/cwe-315
12+
*/
13+
14+
import powershell
15+
16+
abstract class SMBConfiguration extends CmdCall {
17+
abstract Expr getAMisconfiguredSetting();
18+
19+
/** Gets the minimum version of the SMB protocol to be used */
20+
Expr getMisconfiguredSmb2DialectMin() {
21+
exists(Expr dialectMin |
22+
dialectMin = this.getNamedArgument("smb2dialectmin") and
23+
dialectMin.getValue().stringMatches(["none", "smb202", "smb210"]) and
24+
result = dialectMin
25+
)
26+
}
27+
}
28+
29+
/** A call to `Set-SmbServerConfiguration`. */
30+
class SetSMBClientConfiguration extends SMBConfiguration {
31+
SetSMBClientConfiguration() { this.getAName() = "Set-SmbClientConfiguration" }
32+
33+
/** holds if the argument `requireencryption` is supplied with a `$false` value. */
34+
Expr getMisconfiguredRequireEncryption() {
35+
exists(Expr requireEncryption |
36+
requireEncryption = this.getNamedArgument("requireencryption") and
37+
requireEncryption.getValue().asBoolean() = false and
38+
result = requireEncryption
39+
)
40+
}
41+
42+
/** Holds if the argument `blockntlm` is supplied with a `$false` value. */
43+
Expr getMisconfiguredBlocksNTLM() {
44+
exists(Expr blocksNTLM |
45+
blocksNTLM = this.getNamedArgument("blockntlm") and
46+
blocksNTLM.getValue().asBoolean() = false and
47+
result = blocksNTLM
48+
)
49+
}
50+
51+
override Expr getAMisconfiguredSetting() {
52+
result = this.getMisconfiguredRequireEncryption() or
53+
result = this.getMisconfiguredBlocksNTLM() or
54+
result = this.getMisconfiguredSmb2DialectMin()
55+
}
56+
}
57+
58+
/** A call to `Set-SmbServerConfiguration`. */
59+
class SetSMBServerConfiguration extends SMBConfiguration {
60+
SetSMBServerConfiguration() { this.getAName() = "Set-SmbServerConfiguration" }
61+
62+
/** holds if the argument `encryptdata` is supplied with a `$false` value. */
63+
Expr getMisconfiguredEncryptData() {
64+
exists(Expr encryptData |
65+
encryptData = this.getNamedArgument("encryptdata") and
66+
encryptData.getValue().asBoolean() = false and
67+
result = encryptData
68+
)
69+
}
70+
71+
/** holds if the argument `encryptdata` is supplied with a `$false` value. */
72+
Expr getMisconfiguredRejectUnencryptedAccess() {
73+
exists(Expr rejectUnencryptedAccess |
74+
rejectUnencryptedAccess = this.getNamedArgument("rejectunencryptedaccess") and
75+
rejectUnencryptedAccess.getValue().asBoolean() = false and
76+
result = rejectUnencryptedAccess
77+
)
78+
}
79+
80+
override Expr getAMisconfiguredSetting() {
81+
result = this.getMisconfiguredEncryptData() or
82+
result = this.getMisconfiguredRejectUnencryptedAccess() or
83+
result = this.getMisconfiguredSmb2DialectMin()
84+
}
85+
}
86+
87+
from SMBConfiguration config
88+
select config.getAMisconfiguredSetting(), "Unsafe SMB setting"

‎powershell/ql/test/query-tests/security/cwe-319/UnsafeSMBSettings.expected

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
| test.ps1:5:44:5:47 | None | Unsafe SMB setting |
2+
| test.ps1:7:44:7:49 | SMB210 | Unsafe SMB setting |
3+
| test.ps1:9:41:9:46 | false | Unsafe SMB setting |
4+
| test.ps1:9:73:9:78 | false | Unsafe SMB setting |
5+
| test.ps1:11:47:11:52 | false | Unsafe SMB setting |
6+
| test.ps1:13:39:13:44 | false | Unsafe SMB setting |
7+
| test.ps1:15:39:15:44 | false | Unsafe SMB setting |
8+
| test.ps1:15:65:15:70 | false | Unsafe SMB setting |
9+
| test.ps1:15:88:15:93 | SMB210 | Unsafe SMB setting |
10+
| test.ps1:17:44:17:47 | None | Unsafe SMB setting |
11+
| test.ps1:17:62:17:67 | false | Unsafe SMB setting |
12+
| test.ps1:17:94:17:99 | false | Unsafe SMB setting |

‎powershell/ql/test/query-tests/security/cwe-319/UnsafeSMBSettings.qlref

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
queries/security/cwe-319/UnsafeSMBSettings.ql

‎powershell/ql/test/query-tests/security/cwe-319/test.ps1

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-ntlm-blocking?tabs=powershell
2+
3+
#Bad Examples
4+
5+
Set-SmbServerConfiguration -Smb2DialectMin None
6+
7+
Set-SmbClientConfiguration -Smb2DialectMin SMB210
8+
9+
Set-SmbServerConfiguration -encryptdata $false -rejectunencryptedaccess $false
10+
11+
Set-SmbClientConfiguration -RequireEncryption $false
12+
13+
Set-SMbClientConfiguration -BlockNTLM $false
14+
15+
Set-SMbClientConfiguration -BlockNTLM $false -RequireEncryption $false -Smb2DialectMin SMB210
16+
17+
Set-SmbServerConfiguration -Smb2DialectMin None -encryptdata $false -rejectunencryptedaccess $false
18+
19+
#Good Examples
20+
21+
Set-SmbServerConfiguration -Smb2DialectMin SMB300
22+
23+
Set-SmbClientConfiguration -Smb2DialectMin SMB300
24+
25+
Set-SmbServerConfiguration -encryptdata $true -rejectunencryptedaccess $true
26+
27+
Set-SmbClientConfiguration -RequireEncryption $true
28+
29+
Set-SMbClientConfiguration -BlockNTLM $true
30+

0 commit comments

Comments
 (0)