You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Detect CWE-940 in Android Application (ovaa,Vuldroid)
1
+
# Detect CWE-940 in Android Application
2
2
3
-
This scenario aims to demonstrate the detection of the **Improper
4
-
Verification of Source of a Communication Channel** vulnerability using
5
-
[ovaa.apk](https://github.com/oversecured/ovaa) and
6
-
[Vuldroid.apk](https://github.com/jaiswalakshansh/Vuldroid). See
7
-
[CWE-940](https://cwe.mitre.org/data/definitions/940.html) for more
8
-
details.
3
+
This scenario seeks to find the **Improper Verification of Source of a Communication Channel** in the APK file.
9
4
10
-
To begin with, we create a detection rule named `LoadUrlFromIntent.json`
11
-
to identify behavior that loads url from intent data to the WebView.
5
+
## CWE-940: Improper Verification of Source of a Communication Channel
12
6
13
-
Next, we retrieve the methods that pass the url. Following this, we
14
-
check if these methods are only for setting intent, such as
15
-
`findViewById`, `getStringExtra`, or `getIntent`.
7
+
We analyze the definition of CWE-940 and identify its characteristics.
16
8
17
-
If **NO**, it could imply that the APK uses communication channels
18
-
without proper verification, which may cause CWE-940 vulnerability.
9
+
See [CWE-940](https://cwe.mitre.org/data/definitions/940.html) for more details.
19
10
20
-
# Quark Script CWE-940.py
11
+
21
12
22
-
The Quark Script below uses ovaa.apk to demonstrate. You can change the
23
-
`SAMPLE_PATH` to the sample you want to detect. For example,
24
-
`SAMPLE_PATH = "Vuldroid.apk"`.
13
+
## Code of CWE-940 in ovaa.apk
25
14
26
-
```python
15
+
We use the [ovaa.apk](https://github.com/oversecured/ovaa) sample to explain the vulnerability code of CWE-940.
16
+
17
+
18
+
19
+
## Quark Script: CWE-940.py
20
+
21
+
Let’s use the above APIs to show how the Quark script finds this vulnerability.
22
+
23
+
To begin with, we create a detection rule named `LoadUrlFromIntent.json` to identify behavior that loads URLs from intent data to the `WebView`.
24
+
25
+
Next, we retrieve the methods that pass the URL. Then, we check if these methods are only for getting the URL, such as `findViewById`, `getStringExtra`, or `getIntent`.
26
+
27
+
If **YES**, it could imply that the APK uses communication channels without proper verification, which may cause CWE-940 vulnerability.
28
+
29
+
```python
27
30
from quark.script import runQuarkAnalysis, Rule
28
31
29
32
SAMPLE_PATH="ovaa.apk"
30
33
RULE_PATH="LoadUrlFromIntent.json"
31
34
32
-
INTENT_SETTING_METHODS= [
35
+
URL_GETTING_METHODS= [
33
36
"findViewById",
34
37
"getStringExtra",
35
38
"getIntent",
@@ -45,19 +48,19 @@ for behaviorInstance in quarkResult.behaviorOccurList:
45
48
verifiedMethodCandidates = []
46
49
47
50
for method in methodsInArgs:
48
-
if method.methodName notinINTENT_SETTING_METHODS:
51
+
if method.methodName notinURL_GETTING_METHODS:
49
52
verifiedMethodCandidates.append(method)
50
53
51
54
if verifiedMethodCandidates == []:
52
55
caller = behaviorInstance.methodCaller.fullName
53
-
print(f"cwe-940 is detected in method, {caller}")
56
+
print(f"CWE-940 is detected in method, {caller}")
54
57
```
55
58
56
59
## Quark Rule: LoadUrlFromIntent.json
57
60
58
-
```json
61
+
```
59
62
{
60
-
"crime": "Load Url from Intent and open WebView",
63
+
"crime": "Load Url from Intent",
61
64
"permission": [],
62
65
"api": [
63
66
{
@@ -78,9 +81,7 @@ for behaviorInstance in quarkResult.behaviorOccurList:
78
81
79
82
## Quark Script Result
80
83
81
-
-**ovaa.apk**
82
-
83
-
```TEXT
84
+
```
84
85
$ python CWE-940.py
85
86
CWE-940 is detected in method, Loversecured/ovaa/activities/WebViewActivity; onCreate (Landroid/os/Bundle;)V
0 commit comments