Optimize the document of Quark Script CWE-20, 94, 921

[JerryTasi]

Detect CWE-20 in Android Application

This scenario seeks to find Improper Input Validation in the APK file.

CWE-20: Improper Input Validation

We analyze the definition of CWE-20 and identify its characteristics.

See CWE-20 for more details.

Code of CWE-20 in diva.apk

We use the diva.apk sample to explain the vulnerability code of CWE-20.

CWE-20 Detection Process Using Quark Script API

Let’s use the above APIs to show how the Quark script finds this vulnerability.

First, we design a detection rule openUrlThatUserInput.json, to spot the behavior of opening the URL that the user inputs. Then, we use API behaviorInstance.getMethodsInArgs() to get a list of methods that the URL in loadUrl passes through. Finally, we check if any validation method is in the list. If No, the APK does not validate user input. That causes CWE-20 vulnerability.

Quark Script CWE-20.py

from quark.script import runQuarkAnalysis, Rule

SAMPLE_PATH = "diva.apk"
RULE_PATH = "openUrlThatUserInput.json"

rule = Rule(RULE_PATH)
result = runQuarkAnalysis(SAMPLE_PATH, rule)

VALIDATE_METHODS = ["contains", "indexOf", "matches", "replaceAll"]

for openUrl in result.behaviorOccurList:
    calledMethods = openUrl.getMethodsInArgs()

    if not any(
        method.methodName in VALIDATE_METHODS for method in calledMethods
    ):
        print(f"CWE-20 is detected in method, {openUrl.methodCaller.fullName}")

Quark Rule: openUrlThatUserInput.json

{
    "crime": "Open the Url that user input",
    "permission": [],
    "api": [
        {
            "class": "Landroid/widget/EditText;",
            "method": "getText",
            "descriptor": "()Landroid/text/Editable;"
        },
        {
            "class": "Landroid/webkit/WebView;",
            "method": "loadUrl",
            "descriptor": "(Ljava/lang/String;)V"
        }
    ],
    "score": 1,
    "label": []
}

Quark Script Result

$ python CWE-20.py
CWE-20 is detected in method, Ljakhar/aseem/diva/InputValidation2URISchemeActivity; get (Landroid/view/View;)V

Detect CWE-94 in Android Application

This scenario seeks to find code injection in the APK file.

CWE-94: Improper Control of Generation of Code

We analyze the definition of CWE-94 and identify its characteristics.

See CWE-94 for more details.

Code of CWE-94 in ovaa.apk

We use the ovaa.apk sample to explain the vulnerability code of CWE-94.

CWE-94 Detection Process Using Quark Script API

Let's use the above APIs to show how the Quark script finds this vulnerability.

First, we design a detection rule loadExternalCode.json to spot on behavior using the method createPackageContext. Then, we find the caller method that calls the createPackageContext. Finally, we check if the method checkSignatures is called in the caller method for verification.

Quark Script: CWE-94.py

from quark.script import runQuarkAnalysis, Rule

SAMPLE_PATH = "ovaa.apk"
RULE_PATH = "loadExternalCode.json"

targetMethod = [
        "Landroid/content/pm/PackageManager;",
        "checkSignatures",
        "(Ljava/lang/String;Ljava/lang/String;)I"
        ]

ruleInstance = Rule(RULE_PATH)
quarkResult = runQuarkAnalysis(SAMPLE_PATH, ruleInstance)

for ldExternalCode in quarkResult.behaviorOccurList:

    callerMethod = [
            ldExternalCode.methodCaller.className,
            ldExternalCode.methodCaller.methodName,
            ldExternalCode.methodCaller.descriptor
            ]

    if not quarkResult.findMethodInCaller(callerMethod, targetMethod):
        print(f"Method: {targetMethod[1]} not found!")
        print(f"CWE-94 is detected in {SAMPLE_PATH}")

Quark Rule: loadExternalCode.json

{
    "crime": "Load external code from other APK.",
    "permission": [],
    "api": [
        {
            "descriptor": "(Ljava/lang/String;I)Landroid/content/Context;",
            "class": "",
            "method": "createPackageContext"
        },
        {
            "descriptor": "(Ljava/lang/String;)Ljava/lang/Class;",
            "class": "Ljava/lang/ClassLoader;",
            "method": "loadClass"
        }
    ],
    "score": 1,
    "label": []
}

Quark Script Result

$ python3 CWE-94.py
Method: checkSignatures not found!
CWE-94 is detected in ovaa.apk

Detect CWE-921 in Android Application

This scenario seeks to find the unsecured storage mechanism of sensitive data in the APK file.

CWE-921: Storage of Sensitive Data in a Mechanism without Access Control

We analyze the definition of CWE-921 and identify its characteristics.

See CWE-921 for more details.

Code of CWE-921 in ovaa.apk

We use the ovaa.apk sample to explain the vulnerability code of CWE-921.

CWE-921 Detection Process Using Quark Script API

Let’s use the above APIs to show how the Quark script finds this vulnerability.

First, we design a detection rule checkFileExistence.json to spot on behavior that checks if a file exists on a given storage mechanism. Then, we use API methodInstance.getArguments() to get the file path. Finally, CWE-921 is found if the file path contains the keyword sdcard.

Quark Script: CWE-921.py

from quark.script import runQuarkAnalysis, Rule

SAMPLE_PATH = "ovaa.apk"
RULE_PATH = "checkFileExistence.json"

ruleInstance = Rule(RULE_PATH)
quarkResult = runQuarkAnalysis(SAMPLE_PATH, ruleInstance)

for existingFile in quarkResult.behaviorOccurList:
    filePath = existingFile.secondAPI.getArguments()[0]
    if "sdcard" in filePath:
        print(f"This file is stored inside the SDcard\n")
        print(f"CWE-921 is detected in {SAMPLE_PATH}.")

Quark Rule: checkFileExistence.json

{
    "crime": "Check file existence",
    "permission": [],
    "api": [
        {
            "descriptor": "(Ljava/lang/String;)V",
            "class": "Ljava/io/File;",
            "method": "<init>"
        },
        {
            "descriptor": "()Z",
            "class": "Ljava/io/File;",
            "method": "exists"
        }
    ],
    "score": 1,
    "label": []
}

Quark Script Result

$ python3 CWE-921.py
This file is stored inside the SDcard

CWE-921 is detected in ovaa.apk.

[haeter525]

LGTM!