-
Notifications
You must be signed in to change notification settings - Fork 1.8k
Java: CWE-094 Rhino code injection #5802
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
318545e
to
2567979
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Maybe the following Scripting API methods might be interesting as well:
Compilable.compile
If a script is compiled, it is very likely that the application later executes it. Therefore this might allow remote code execution as well.ScriptEngineFactory.getProgram
If an application gets the program script, it is likely that it later executes that script as well.ScriptEngineFactory.getMethodCallSyntax
Not completely sure about this one, but maybe it can be misused for remote code execution as well (possibly by providing maliciousargs
values, or in case the other arguments are not properly validated and allow code injection); with the same rationale as above: If an application uses this method, it is likely that is executes its result later on.
For Rhino maybe the following is interesting as well:
ClassCompiler.compileToClassFiles
GeneratedClassLoader.defineClass
Not directly related to scripting, but maybe interesting nonetheless.Context
:
However, I am not a member of this project, so feel free to consider this only as suggestion. The maintainers will probably give you more in depth feedback.
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.qhelp
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.qhelp
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.qhelp
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.qhelp
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.qhelp
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql
Outdated
Show resolved
Hide resolved
Thanks @Marcono1234 for reviewing this PR. I just submitted another PR and will make requested changes to this one in the next two days. |
All requested changes have been made. Please review. |
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql
Outdated
Show resolved
Hide resolved
aa2925d
to
5d282d2
Compare
java/ql/src/experimental/Security/CWE/CWE-094/RhinoInjection.java
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql
Outdated
Show resolved
Hide resolved
Thanks @smowton for reviewing this PR. I've made all requested changes. Please review again. |
1480696
to
d85df6e
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes that's what I meant
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.qhelp
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.qhelp
Outdated
Show resolved
Hide resolved
java/ql/src/experimental/Security/CWE/CWE-094/ScriptInjection.ql
Outdated
Show resolved
Hide resolved
Needs rebase |
465a64c
to
02aa9c6
Compare
@smowton I've done the rebase. Please merge again. Thanks. |
Rhino is a JavaScript engine written fully in Java and managed by the Mozilla Foundation.
It serves as an embedded scripting engine inside Java applications which allows
Java-to-JavaScript interoperability and provides a seamless integration between the two
languages. If an expression is built using attacker-controlled data, and then evaluated in
a powerful context, it may allow the attacker to run arbitrary code.
Typically an expression is evaluated in the powerful context initialized with
initStandardObjects
that allows an expression of arbitrary Java code toexecute in the JVM.
The query detects unsafe usage of Rhino expressions. Please consider to merge the PR. Thanks.