Optimize the document of Quark Script CWE-73, 79, and 88

[JerryTasi]

Detect CWE-73 in Android Application

This scenario seeks to find External Control of File Name or Path in the APK file.

CWE-73 External Control of File Name or Path

We analyze the definition of CWE-73 and identify its characteristics.

See CWE-73 for more details.

Code of CWE-73 in ovaa.apk

We use the ovaa.apk sample to explain the vulnerability code of CWE-73.

CWE-73 Detection Process Using Quark Script API

Let’s use the above APIs to show how Quark script finds this vulnerability.

First, we design a detection rule useLastPathSegmentAsFileName.json to spot behavior that uses the last path segment as the file name.

Second, we use the API methodInstance.getArguments() to get the argument for the file path and use quarkResultInstance.isHardcoded(argument) to check if the argument is hardcoded into the APK. If No, the argument is from external input.

Finally, we use Quark API quarkResultInstance.findMethodInCaller(callerMethod, targetMethod) to check if there are any APIs in the caller method for opening files. If YES, the APK performs file operations using external input as a path, which may cause CWE-73 vulnerability.

Quark Script: CWE-73.py

from quark.script import runQuarkAnalysis, Rule

SAMPLE_PATH = "ovaa.apk"
RULE_PATH = "useLastPathSegmentAsFileName.json"

OPEN_FILE_API = [
    "Landroid/os/ParcelFileDescriptor;",                   # Class name
    "open",                                                # Method name
    "(Ljava/io/File; I)Landroid/os/ParcelFileDescriptor;"  # Descriptor
]

ruleInstance = Rule(RULE_PATH)
quarkResult = runQuarkAnalysis(SAMPLE_PATH, ruleInstance)

for accessExternalDir in quarkResult.behaviorOccurList:
    filePath = accessExternalDir.secondAPI.getArguments()[2]

    if quarkResult.isHardcoded(filePath):
        continue

    caller = accessExternalDir.methodCaller
    result = quarkResult.findMethodInCaller(caller, OPEN_FILE_API)

    if result:
        print("CWE-73 is detected in method, ", caller.fullName)

Quark Rule: useLastPathSegmentAsFileName.json

{
    "crime": "Use the last path segment as the file name",
    "permission": [],
    "api": [
        {
            "class": "Landroid/net/Uri;",
            "method": "getLastPathSegment",
            "descriptor": "()Ljava/lang/String;"
        },
        {
            "class": "Ljava/io/File;",
            "method": "<init>",
            "descriptor": "(Ljava/io/File;Ljava/lang/String;)V"
        }
    ],
    "score": 1,
    "label": []
}

Quark Script Result

$ python CWE-73.py
CWE-73 is detected in method, Loversecured/ovaa/providers/TheftOverwriteProvider; openFile (Landroid/net/Uri; Ljava/lang/String;)Landroid/os/ParcelFileDescriptor;

Detect CWE-79 in Android Application

This scenario seeks to find Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) in the APK file.

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

We analyze the definition of CWE-79 and identify its characteristics.

See CWE-79 for more details.

Code of CWE-79 in Vuldroid.apk

We use the Vuldroid.apk sample to explain the vulnerability code of CWE-79.

CWE-79 Detection Process Using Quark Script API

Let’s use the above APIs to show how the Quark script finds this vulnerability.

First, we design a detection rule loadUrlFromIntent.json to spot the behavior loading URL from intent data to the WebView instance.

Next, we use API quarkResultInstance.findMethodInCaller(callerMethod, targetMethod) and methodInstance.getArguments() to check if the Javascript execution is enabled in the WebView. Finally, we check if there are any famous XSS filters. If NO, that may cause CWE-79 vulnerability.

Quark Script CWE-79.py

from quark.script import runQuarkAnalysis, Rule

SAMPLE_PATH = "Vuldroid.apk"
RULE_PATH = "loadUrlFromIntent.json"

XSS_FILTERS = [
    [
        "Lorg/owasp/esapi/Validator;",
        "getValidSafeHTML",
        "(Ljava/lang/String; Ljava/lang/String; I Z)Ljava/lang/String;",
    ],
    [
        "Lorg/owasp/esapi/Encoder;",
        "encodeForHTML",
        "(Ljava/lang/String;)Ljava/lang/String;",
    ],
    [
        "Lorg/owasp/esapi/Encoder;",
        "encodeForJavaScript",
        "(Ljava/lang/String;)Ljava/lang/String;",
    ],
    [
        "Lorg/owasp/html/PolicyFactory;",
        "sanitize",
        "(Ljava/lang/String;)Ljava/lang/String;",
    ],
]

targetMethod = ["Landroid/webkit/WebSettings;", "setJavaScriptEnabled", "(Z)V"]

ruleInstance = Rule(RULE_PATH)
quarkResult = runQuarkAnalysis(SAMPLE_PATH, ruleInstance)

for loadUrl in quarkResult.behaviorOccurList:
    caller = loadUrl.methodCaller
    setJS = quarkResult.findMethodInCaller(caller, targetMethod)
    enableJS = []

    if setJS:
        enableJS = setJS[0].getArguments()[1]

    if enableJS:
        XSSFiltersInCaller = [
            filterAPI
            for filterAPI in XSS_FILTERS
            if quarkResult.findMethodInCaller(caller, filterAPI)
        ]

        if not XSSFiltersInCaller:
            print(f"CWE-79 is detected in method, {caller.fullName}")

Quark Rule: loadUrlFromIntent.json

{
    "crime": "Load URL from intent to WebView",
    "permission": [],
    "api": [
        {
            "descriptor": "()Landroid/net/Uri;",
            "class": "Landroid/content/Intent;",
            "method": "getData"
        },
        {
            "descriptor": "(Ljava/lang/String;)V",
            "class": "Landroid/webkit/WebView;",
            "method": "loadUrl"
        }
    ],
    "score": 1,
    "label": []
}

Quark Script Result

$ python CWE-79.py
CWE-79 is detected in method, Lcom/vuldroid/application/ForgetPassword; onCreate (Landroid/os/Bundle;)V

Detect CWE-88 in Android Application

This scenario seeks to find Argument Injection in the APK file.

CWE-88 Improper Neutralization of Argument Delimiters in a Command

We analyze the definition of CWE-88 and identify its characteristics.

See CWE-88 for more details.

Code of CWE-88 in vuldroid.apk

We use the vuldroid.apk sample to explain the vulnerability code of CWE-88.

CWE-88 Detection Process Using Quark Script API

Let‘s use the above APIs to show how the Quark script finds this vulnerability.

First, we design a detection rule ExternalStringsCommands.json to spot on behavior using external strings as commands.

Next, we use Quark API behaviorInstance.getMethodsInArgs() to get the methods that passed the external command.

Then we check if the method neutralizes any special elements in the argument.

If the neutralization is not complete, then it may cause CWE-88 vulnerability.

Quark Script: CWE-88.py

from quark.script import runQuarkAnalysis, Rule, findMethodInAPK

SAMPLE_PATH = "Vuldroid.apk"
RULE_PATH = "ExternalStringCommand.json"


STRING_MATCHING_API = set([
    ("Ljava/lang/String;", "contains", "(Ljava/lang/CharSequence)Z"),
    ("Ljava/lang/String;", "indexOf", "(I)I"),
    ("Ljava/lang/String;", "indexOf", "(Ljava/lang/String;)I"),
    ("Ljava/lang/String;", "matches", "(Ljava/lang/String;)Z"),
    ("Ljava/lang/String;", "replaceAll", "(Ljava/lang/String; Ljava/lang/String;)Ljava/lang/String;")
])

delimeter = "-"

ruleInstance = Rule(RULE_PATH)
quarkResult = runQuarkAnalysis(SAMPLE_PATH, ruleInstance)

for ExternalStringCommand in quarkResult.behaviorOccurList:

    methodCalled = set()
    caller = ExternalStringCommand.methodCaller

    for method in ExternalStringCommand.getMethodsInArgs():
        methodCalled.add(method.fullName)

    if methodCalled.intersection(STRING_MATCHING_API) and not ExternalStringCommand.hasString(delimeter):
        continue
    else:
        print(f"CWE-88 is detected in method, {caller.fullName}")

Quark Rule: ExternalStringCommand.json

{
    "crime": "Using external strings as commands",
    "permission": [],
    "api": [
        {
            "class": "Landroid/content/Intent;",
            "method": "getStringExtra",
            "descriptor": "(Ljava/lang/String;)Ljava/lang/String"
        },
        {
            "class": "Ljava/lang/Runtime;",
            "method": "exec",
            "descriptor": "(Ljava/lang/String;)Ljava/lang/Process"
        }
    ],
    "score": 1,
    "label": []
}

Quark Script Result

$ python3 CWE-88.py
CWE-88 is detected in method, Lcom/vuldroid/application/RootDetection; onCreate (Landroid/os/Bundle;)V

[zinwang]

LGTM!

[zinwang]

Refer to #64