Add quark script for CWE-23

[LiangPPP]

CWE-23
Detect CWE-23 in Android Application (ovaa.apk and InsecureBankv2.apk )

This scenario aims to demonstrate the detection of the Relative Path Traversal vulnerability using ovaa.apk and InsecureBankv2.apk. See CWE-23 for more details.

To begin with, we will create a detection rule named accessFileInExternalDir.json to identify behavior that accesses a file in an external directory.

Next, we will use methodInstance.getArguments() to retrieve the file path argument and check whether it belongs to the APK or not. If it does not belong to the APK, the argument is likely from external input.

Finally, we will use the Quark API quarkResultInstance.findMethodInCaller(callerMethod, targetMethod) to search for any APIs in the caller method that match the string. If no matching API is found, the APK does not neutralize special elements within the argument, which may result in the CWE-23 vulnerability. If a matching API is found, we will verify whether it neutralizes the Relative Path string or not. If it does not neutralize it, the APK may still be vulnerable to CWE-23.

Quark Script CWE-23.py

The Quark Script below uses ovaa.apk to demonstrate. You can change the SAMPLE_PATH to the sample you want to detect. For example, SAMPLE_PATH = "InsecureBankv2.apk".

  from quark.script import runQuarkAnalysis, Rule

  SAMPLE_PATH = "ovaa.apk"
  RULE_PATH = "accessFileInExternalDir.json"
  
  
  STRING_MATCHING_API = [
      ["Ljava/lang/String;", "contains", "(Ljava/lang/CharSequence)Z"],
      ["Ljava/lang/String;", "indexOf", "(I)I"],
      ["Ljava/lang/String;", "indexOf", "(Ljava/lang/String;)I"],
      ["Ljava/lang/String;", "matches", "(Ljava/lang/String;)Z"],
      ["Ljava/lang/String;", "replaceAll",
          "(Ljava/lang/String; Ljava/lang/String;)Ljava/lang/String;"],
  ]
  
  ruleInstance = Rule(RULE_PATH)
  quarkResult = runQuarkAnalysis(SAMPLE_PATH, ruleInstance)
  
  for accessExternalDir in quarkResult.behaviorOccurList:
  
      filePath = accessExternalDir.secondAPI.getArguments()[2]
  
      if quarkResult.isHardcoded(filePath):
          continue
  
      caller = accessExternalDir.methodCaller
      strMatchingAPIs = [
          api for api in STRING_MATCHING_API if quarkResult.findMethodInCaller(
              caller, api)
      ]
  
      if not strMatchingAPIs:
          print(f"CWE-23 is detected in method, {caller.fullName}")
      elif strMatchingAPIs.find("..") == -1:
          print(f"CWE-23 is detected in method, {caller.fullName}")

Quark Rule: accessFileInExternalDir.json

    {
        "crime": "Access a file in an external directory",
        "permission": [],
        "api": [
            {
                "class": "Landroid/os/Environment;",
                "method": "getExternalStorageDirectory",
                "descriptor": "()Ljava/io/File;"
            },
            {
                "class": "Ljava/io/File;",
                "method": "<init>",
                "descriptor": "(Ljava/io/File;Ljava/lang/String;)V"
            }
        ],
        "score": 1,
        "label": []
    }

Quark Script Result

• ovaa.apk

    $ python3 CWE-23.py
    CWE-23 is detected in method, Loversecured/ovaa/providers/TheftOverwriteProvider; openFile (Landroid/net/Uri; Ljava/lang/String;)Landroid/os/ParcelFileDescriptor;

• InsecureBankv2.apk

    $ python3 CWE-23.py
    CWE-23 is detected in method, Lcom/android/insecurebankv2/ViewStatement; onCreate (Landroid/os/Bundle;)V

[codecov-commenter]

Codecov Report

Patch and project coverage have no change.

Comparison is base (b3d8b0b) 78.76% compared to head (f84f151) 78.76%.

📣 This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #476   +/-   ##
=======================================
  Coverage   78.76%   78.76%           
=======================================
  Files          63       63           
  Lines        4850     4850           
=======================================
  Hits         3820     3820           
  Misses       1030     1030           

Flag	Coverage Δ
unittests	78.76% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

[pulorsok]

LGTM

[zinwang]

LGTM!

[zinwang]

@LiangPPP Thanks for the work!