MobSF/Mobile-Security-Framework-MobSF
1
0
Fork 0
mirror of https://github.com/MobSF/Mobile-Security-Framework-MobSF.git synced 2026-10-12 02:06:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

HOTFIX: EFR01 Enterprise feature request (#1908)

Browse Source 
* Replace Warning with Medium and added Hotspot
* Add file analysis to hotspot
* Enterprise Feature Request Flag
* EFR01 changes
* version bump
This commit is contained in:
Ajin Abraham
2022-02-19 10:55:28 -08:00
committed by GitHub
parent 996a57cfe8
commit e00991caa7
11 changed files with 142 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mobsf/MobSF/init.py
+1 -1
View File
@@ -10,7 +10,7 @@ from mobsf.install.windows.setup import windows_config_local
logger = logging.getLogger(__name__)
VERSION = '3.5.1'
VERSION = '3.5.2'
BANNER = """
__ __ _ ____ _____ _____ ____
| \/ | ___ | |__/ ___|| ___|_ _|___ / | ___|
mobsf/MobSF/settings.py
+4 -1
View File
@@ -278,7 +278,10 @@ LOGGING = {
},
},
}
# ===================
# ===========================
# ENTERPRISE FEATURE REQUESTS
# ===========================
EFR_01 = os.getenv('EFR_01', '0')
# USER CONFIGURATION
# ===================
if CONFIG_HOME:
mobsf/StaticAnalyzer/views/common/appsec.py
+61 -3
View File
@@ -39,6 +39,58 @@ def common_fields(findings, data):
'description': f'{desc}\n{ref}',
'section': 'code',
})
# Permissions
dang_perms = []
fmt_perm = ''
for pm, meta in data['permissions'].items():
status = meta['status']
description = meta.get('description')
if status == 'dangerous':
info = meta.get('info')
if not info:
info = meta.get('reason')
dang_perms.append(
f'{pm} ({status}): '
f'{info} - {description}')
if dang_perms:
fmt_perm += '\n\n'.join(dang_perms)
findings['hotspot'].append({
'title': (
f'Found {len(dang_perms)} '
'critical permission(s)'),
'description': (
'Ensure that these permissions '
'are required by the application.\n\n'
f'{fmt_perm}'),
'section': 'permissions',
})
# File Analysis
cert_files = None
cfp = []
for fa in data['file_analysis']:
if 'Cert' in fa.get('finding', ''):
cfp = fa['files']
break
if 'Cert' in fa.get('issue', ''):
cert_files = fa['files']
break
if cert_files:
for f in cert_files:
cfp.append(f['file_path'])
if cfp:
fcerts = '\n'.join(cfp)
findings['hotspot'].append({
'title': (
f'Found {len(cfp)} '
'certificate/key file(s)'),
'description': (
'Ensure that these files '
'does not contain any '
'private information or '
'sensitive key materials.\n\n'
f'{fcerts}'),
'section': 'files',
})
# Malicious Domains
for domain, value in data['domains'].items():
if value['bad'] == 'yes':
@@ -64,7 +116,8 @@ def common_fields(findings, data):
t = len(data['trackers']['trackers'])
findings['trackers'] = t
if t > 4:
findings['high'].append({
sev = 'hotspot' if settings.EFR_01 == '1' else 'high'
findings[sev].append({
'title': 'Application contains Privacy Trackers',
'description': (
f'This app has more than {t} privacy trackers.'
@@ -73,7 +126,8 @@ def common_fields(findings, data):
'section': 'trackers',
})
elif t > 0:
findings['warning'].append({
sev = 'hotspot' if settings.EFR_01 == '1' else 'warning'
findings[sev].append({
'title': 'Application contains Privacy Trackers',
'description': (
f'This app has {t} privacy trackers.'
@@ -94,7 +148,8 @@ def common_fields(findings, data):
secrets = data['secrets']
if len(secrets) > 1:
sec = '\n'.join(secrets)
findings['warning'].append({
sev = 'hotspot' if settings.EFR_01 == '1' else 'warning'
findings[sev].append({
'title': 'This app may contain hardcoded secrets',
'description': (
'The following secrets were identified from the app. '
@@ -120,6 +175,7 @@ def get_android_dashboard(context, from_ctx=False):
'warning': [],
'info': [],
'secure': [],
'hotspot': [],
'total_trackers': None,
}
if from_ctx:
@@ -179,6 +235,7 @@ def get_ios_dashboard(context, from_ctx=False):
'warning': [],
'info': [],
'secure': [],
'hotspot': [],
'total_trackers': None,
}
if from_ctx:
@@ -276,6 +333,7 @@ def appsec_dashboard(request, checksum, api=False):
return print_n_send_error_response(request, msg)
context['version'] = settings.MOBSF_VER
context['title'] = 'AppSec Scorecard'
context['efr01'] = True if settings.EFR_01 == '1' else False
if api:
return context
else:
mobsf/StaticAnalyzer/views/ios/permission_analysis.py
+2 -2
View File
@@ -83,8 +83,8 @@ def check_permissions(p_list):
for perm, desc in COCOA_KEYS.items():
if perm in p_list:
permissions[perm] = {
'description': desc[0],
'info': desc[0],
'status': desc[1],
'reason': p_list.get(perm, ''),
'description': p_list.get(perm, ''),
}
return permissions
mobsf/StaticAnalyzer/views/ios/view_source.py
+4 -1
View File
@@ -103,9 +103,12 @@ def run(request, api=False):
dat = flip.read()
elif typ == 'plist':
file_format = 'json'
dat = biplist.readPlist(sfile)
try:
dat = biplist.readPlist(sfile)
dat = json.dumps(dat, indent=4, sort_keys=True)
except biplist.InvalidPlistException:
file_format = 'xml'
dat = Path(sfile).read_text()
except Exception:
pass
elif typ == 'db':
mobsf/static/others/css/pdf_report.css
+4
View File
@@ -103,6 +103,10 @@ td{
background-color: green;
}
.td-secondary {
background-color: rgb(30, 31, 30);
}
.tbl-white {
color:#ffffff;
}
mobsf/templates/pdf/android_report.html
+3 -1
View File
@@ -143,15 +143,17 @@
<table class="basic tbl-white">
<tr>
<th class="td-high"><i class="fas fa-bug"> </i> HIGH</th>
<th class="td-warning"><i class="fas fa-exclamation-triangle"> </i> WARNING</th>
<th class="td-warning"><i class="fas fa-exclamation-triangle"> </i> MEDIUM</th>
<th class="td-info"><i class="fas fa-info"> </i> INFO</th>
<th class="td-success"><i class="fas fa-check"></i> SECURE</th>
<th class="td-secondary"><i class="fab fa-searchengin"></i> HOTSPOT</th>
</tr>
<tr>
<td class="td-high"><h2>{{ appsec.high | length}}</h2></td>
<td class="td-warning"><h2>{{ appsec.warning | length}}</h2></td>
<td class="td-info"><h2>{{ appsec.info | length}}</h2></td>
<td class="td-success"><h2>{{ appsec.secure | length}}</h2></td>
<td class="td-secondary"><h2>{{ appsec.hotspot | length}}</h2></td>
</tr>
</table>
</div>
mobsf/templates/pdf/ios_report.html
+6 -4
View File
@@ -142,15 +142,17 @@
<table class="basic tbl-white">
<tr>
<th class="td-high"><i class="fas fa-bug"> </i> HIGH</th>
<th class="td-warning"><i class="fas fa-exclamation-triangle"> </i> WARNING</th>
<th class="td-warning"><i class="fas fa-exclamation-triangle"> </i> MEDIUM</th>
<th class="td-info"><i class="fas fa-info"> </i> INFO</th>
<th class="td-success"><i class="fas fa-check"></i> SECURE</th>
<th class="td-secondary"><i class="fab fa-searchengin"></i> HOTSPOT</th>
</tr>
<tr>
<td class="td-high"><h2>{{ appsec.high | length}}</h2></td>
<td class="td-warning"><h2>{{ appsec.warning | length}}</h2></td>
<td class="td-info"><h2>{{ appsec.info | length}}</h2></td>
<td class="td-success"><h2>{{ appsec.secure | length}}</h2></td>
<td class="td-secondary"><h2>{{ appsec.hotspot | length}}</h2></td>
</tr>
</table>
</div>
@@ -231,7 +233,7 @@
<tr>
<th>PERMISSIONS</th>
<th>STATUS</th>
<th>DESCRIPTION</th>
<th>INFO</th>
<th>REASON IN MANIFEST</th>
</tr>
</thead>
@@ -245,10 +247,10 @@
{{ desc.status }}
</td>
<td>
{{ desc.description}}
{{ desc.info}}
</td>
<td>
{{ desc.reason }}
{{ desc.description }}
</td>
</tr>
{% endfor %}
mobsf/templates/static_analysis/appsec_dashboard.html
+51 -5
View File
@@ -146,6 +146,7 @@ sidebar-collapse
<div class="row">
<div class="col-lg-3">
{% if not efr01 %}
<div class="card">
<div class="card-header ui-sortable-handle" >
<h3 class="card-title">
@@ -171,6 +172,7 @@ sidebar-collapse
</div>
</div><!-- /.card-body -->
</div>
{% endif %}
</div>
<div class="col-lg-3">
@@ -234,6 +236,7 @@ sidebar-collapse
</div>
<div class="col-lg-3">
{% if not efr01 %}
<div class="card">
<div class="card-header ui-sortable-handle" >
<h3 class="card-title">
@@ -258,6 +261,7 @@ sidebar-collapse
</div>
</div><!-- /.card-body -->
</div>
{% endif %}
</div>
</div>
@@ -298,7 +302,7 @@ sidebar-collapse
<span class="info-box-icon bg-warning"><i class="fas fa-exclamation-triangle"></i></span>
<div class="info-box-content">
<span class="info-box-text">Warning</span>
<span class="info-box-text">Medium</span>
<span class="info-box-number">{{ warning | length}}</span>
</div>
<!-- /.info-box-content -->
@@ -307,7 +311,7 @@ sidebar-collapse
</div>
<!-- /.col -->
<div class="col-md-3 col-sm-6 col-12">
<div class="col-md-2 col-sm-6 col-12">
<div class="info-box">
<span class="info-box-icon bg-info"><i class="fas fa-info"></i></span>
@@ -320,7 +324,7 @@ sidebar-collapse
<!-- /.info-box -->
</div>
<!-- /.col -->
<div class="col-md-3 col-sm-6 col-12">
<div class="col-md-2 col-sm-6 col-12">
<div class="info-box">
<span class="info-box-icon bg-success"><i class="fas fa-check"></i></span>
@@ -333,7 +337,21 @@ sidebar-collapse
<!-- /.info-box -->
</div>
<div class="col-md-2 col-sm-6 col-12">
<div class="info-box">
<span class="info-box-icon bg-secondary"><i class="fab fa-searchengin"></i></span>
<div class="info-box-content">
<span class="info-box-text"> {% if efr01 %}Need to Investigate{% else %}Hotspot{% endif %}</span>
<span class="info-box-number">{{ hotspot | length}}</span>
</div>
<!-- /.info-box-content -->
</div>
<!-- /.info-box -->
</div>
</div>
<!--end boxes-->
</br>
{% for item in high %}
@@ -362,7 +380,7 @@ sidebar-collapse
<div class="sameline">
<div class="card-header">
<h4 class="card-title w-100">
<span class="badge bg-warning">warning</span> {{ item.title}}
<span class="badge bg-warning">medium</span> {{ item.title}}
</h4>
</div>
<label> {{ item.section | upper }}</label>
@@ -397,6 +415,8 @@ sidebar-collapse
{% endfor %}
{% for item in secure %}
<div class="card card-success card-outline">
<a class="d-block w-100" data-toggle="collapse" href="#success-{{ forloop.counter }}">
@@ -417,6 +437,32 @@ sidebar-collapse
</div>
</div>
{% endfor %}
{% for item in hotspot %}
<div class="card card-secondary card-outline">
<a class="d-block w-100" data-toggle="collapse" href="#secondary-{{ forloop.counter }}">
<div class="sameline">
<div class="card-header">
<h4 class="card-title w-100">
<span class="badge bg-secondary">{% if efr01 %}need to investigate{% else %}hotspot{% endif %}</span> {{ item.title}}
</h4>
</div>
<label class="text-right"> {{ item.section | upper }}</label>
</div>
</a>
<div id="secondary-{{ forloop.counter }}" class="collapse" data-parent="#accordion">
<div class="card-body">
<pre>{{ item.description}}</pre>
</div>
</div>
</div>
{% endfor %}
</div>
</div> </div>
</div>
@@ -477,7 +523,7 @@ sidebar-collapse
}
},
data: {
labels: [`High`, `Warning`, `Info`, `Secure`],
labels: [`High`, `Medium`, `Info`, `Secure`],
datasets: [{
backgroundColor: [
"#dc3545",
mobsf/templates/static_analysis/ios_binary_analysis.html
+3 -3
View File
@@ -483,7 +483,7 @@
<tr>
<th>PERMISSIONS</th>
<th>STATUS</th>
<th>DESCRIPTION</th>
<th>INFO</th>
<th>REASON IN MANIFEST</th>
</tr>
</thead>
@@ -502,10 +502,10 @@
{% endif %}
</td>
<td>
{{ desc.description}}
{{ desc.info}}
</td>
<td>
{{ desc.reason }}
{{ desc.description }}
</td>
</tr>
{% endfor %}
mobsf/templates/static_analysis/ios_source_analysis.html
+3 -3
View File
@@ -444,7 +444,7 @@
<tr>
<th>PERMISSIONS</th>
<th>STATUS</th>
<th>DESCRIPTION</th>
<th>INFO</th>
<th>REASON IN MANIFEST</th>
</tr>
</thead>
@@ -463,10 +463,10 @@
{% endif %}
</td>
<td>
{{ desc.description}}
{{ desc.info}}
</td>
<td>
{{ desc.reason }}
{{ desc.description }}
</td>
</tr>
{% endfor %}