diff --git a/mobsf/MobSF/init.py b/mobsf/MobSF/init.py
index dee045f2..2256b26d 100644
--- a/mobsf/MobSF/init.py
+++ b/mobsf/MobSF/init.py
@@ -10,7 +10,7 @@ from mobsf.install.windows.setup import windows_config_local
logger = logging.getLogger(__name__)
-VERSION = '3.5.1'
+VERSION = '3.5.2'
BANNER = """
__ __ _ ____ _____ _____ ____
| \/ | ___ | |__/ ___|| ___|_ _|___ / | ___|
diff --git a/mobsf/MobSF/settings.py b/mobsf/MobSF/settings.py
index e3003710..363912b5 100644
--- a/mobsf/MobSF/settings.py
+++ b/mobsf/MobSF/settings.py
@@ -278,7 +278,10 @@ LOGGING = {
},
},
}
-# ===================
+# ===========================
+# ENTERPRISE FEATURE REQUESTS
+# ===========================
+EFR_01 = os.getenv('EFR_01', '0')
# USER CONFIGURATION
# ===================
if CONFIG_HOME:
diff --git a/mobsf/StaticAnalyzer/views/common/appsec.py b/mobsf/StaticAnalyzer/views/common/appsec.py
index e47239de..5110f9ca 100644
--- a/mobsf/StaticAnalyzer/views/common/appsec.py
+++ b/mobsf/StaticAnalyzer/views/common/appsec.py
@@ -39,6 +39,58 @@ def common_fields(findings, data):
'description': f'{desc}\n{ref}',
'section': 'code',
})
+ # Permissions
+ dang_perms = []
+ fmt_perm = ''
+ for pm, meta in data['permissions'].items():
+ status = meta['status']
+ description = meta.get('description')
+ if status == 'dangerous':
+ info = meta.get('info')
+ if not info:
+ info = meta.get('reason')
+ dang_perms.append(
+ f'{pm} ({status}): '
+ f'{info} - {description}')
+ if dang_perms:
+ fmt_perm += '\n\n'.join(dang_perms)
+ findings['hotspot'].append({
+ 'title': (
+ f'Found {len(dang_perms)} '
+ 'critical permission(s)'),
+ 'description': (
+ 'Ensure that these permissions '
+ 'are required by the application.\n\n'
+ f'{fmt_perm}'),
+ 'section': 'permissions',
+ })
+ # File Analysis
+ cert_files = None
+ cfp = []
+ for fa in data['file_analysis']:
+ if 'Cert' in fa.get('finding', ''):
+ cfp = fa['files']
+ break
+ if 'Cert' in fa.get('issue', ''):
+ cert_files = fa['files']
+ break
+ if cert_files:
+ for f in cert_files:
+ cfp.append(f['file_path'])
+ if cfp:
+ fcerts = '\n'.join(cfp)
+ findings['hotspot'].append({
+ 'title': (
+ f'Found {len(cfp)} '
+ 'certificate/key file(s)'),
+ 'description': (
+ 'Ensure that these files '
+ 'does not contain any '
+ 'private information or '
+ 'sensitive key materials.\n\n'
+ f'{fcerts}'),
+ 'section': 'files',
+ })
# Malicious Domains
for domain, value in data['domains'].items():
if value['bad'] == 'yes':
@@ -64,7 +116,8 @@ def common_fields(findings, data):
t = len(data['trackers']['trackers'])
findings['trackers'] = t
if t > 4:
- findings['high'].append({
+ sev = 'hotspot' if settings.EFR_01 == '1' else 'high'
+ findings[sev].append({
'title': 'Application contains Privacy Trackers',
'description': (
f'This app has more than {t} privacy trackers.'
@@ -73,7 +126,8 @@ def common_fields(findings, data):
'section': 'trackers',
})
elif t > 0:
- findings['warning'].append({
+ sev = 'hotspot' if settings.EFR_01 == '1' else 'warning'
+ findings[sev].append({
'title': 'Application contains Privacy Trackers',
'description': (
f'This app has {t} privacy trackers.'
@@ -94,7 +148,8 @@ def common_fields(findings, data):
secrets = data['secrets']
if len(secrets) > 1:
sec = '\n'.join(secrets)
- findings['warning'].append({
+ sev = 'hotspot' if settings.EFR_01 == '1' else 'warning'
+ findings[sev].append({
'title': 'This app may contain hardcoded secrets',
'description': (
'The following secrets were identified from the app. '
@@ -120,6 +175,7 @@ def get_android_dashboard(context, from_ctx=False):
'warning': [],
'info': [],
'secure': [],
+ 'hotspot': [],
'total_trackers': None,
}
if from_ctx:
@@ -179,6 +235,7 @@ def get_ios_dashboard(context, from_ctx=False):
'warning': [],
'info': [],
'secure': [],
+ 'hotspot': [],
'total_trackers': None,
}
if from_ctx:
@@ -276,6 +333,7 @@ def appsec_dashboard(request, checksum, api=False):
return print_n_send_error_response(request, msg)
context['version'] = settings.MOBSF_VER
context['title'] = 'AppSec Scorecard'
+ context['efr01'] = True if settings.EFR_01 == '1' else False
if api:
return context
else:
diff --git a/mobsf/StaticAnalyzer/views/ios/permission_analysis.py b/mobsf/StaticAnalyzer/views/ios/permission_analysis.py
index dee66a4c..5a9f9022 100644
--- a/mobsf/StaticAnalyzer/views/ios/permission_analysis.py
+++ b/mobsf/StaticAnalyzer/views/ios/permission_analysis.py
@@ -83,8 +83,8 @@ def check_permissions(p_list):
for perm, desc in COCOA_KEYS.items():
if perm in p_list:
permissions[perm] = {
- 'description': desc[0],
+ 'info': desc[0],
'status': desc[1],
- 'reason': p_list.get(perm, ''),
+ 'description': p_list.get(perm, ''),
}
return permissions
diff --git a/mobsf/StaticAnalyzer/views/ios/view_source.py b/mobsf/StaticAnalyzer/views/ios/view_source.py
index ca7c588a..18255a7f 100644
--- a/mobsf/StaticAnalyzer/views/ios/view_source.py
+++ b/mobsf/StaticAnalyzer/views/ios/view_source.py
@@ -103,9 +103,12 @@ def run(request, api=False):
dat = flip.read()
elif typ == 'plist':
file_format = 'json'
- dat = biplist.readPlist(sfile)
try:
+ dat = biplist.readPlist(sfile)
dat = json.dumps(dat, indent=4, sort_keys=True)
+ except biplist.InvalidPlistException:
+ file_format = 'xml'
+ dat = Path(sfile).read_text()
except Exception:
pass
elif typ == 'db':
diff --git a/mobsf/static/others/css/pdf_report.css b/mobsf/static/others/css/pdf_report.css
index eef2c077..6effc8ca 100644
--- a/mobsf/static/others/css/pdf_report.css
+++ b/mobsf/static/others/css/pdf_report.css
@@ -103,6 +103,10 @@ td{
background-color: green;
}
+.td-secondary {
+ background-color: rgb(30, 31, 30);
+}
+
.tbl-white {
color:#ffffff;
}
diff --git a/mobsf/templates/pdf/android_report.html b/mobsf/templates/pdf/android_report.html
index 6dd34134..ad4ee6da 100755
--- a/mobsf/templates/pdf/android_report.html
+++ b/mobsf/templates/pdf/android_report.html
@@ -143,15 +143,17 @@
| HIGH |
- WARNING |
+ MEDIUM |
INFO |
SECURE |
+ HOTSPOT |
{{ appsec.high | length}} |
{{ appsec.warning | length}} |
{{ appsec.info | length}} |
{{ appsec.secure | length}} |
+ {{ appsec.hotspot | length}} |
diff --git a/mobsf/templates/pdf/ios_report.html b/mobsf/templates/pdf/ios_report.html
index 09f1c02d..a10cc59e 100644
--- a/mobsf/templates/pdf/ios_report.html
+++ b/mobsf/templates/pdf/ios_report.html
@@ -142,15 +142,17 @@
| HIGH |
- WARNING |
+ MEDIUM |
INFO |
SECURE |
+ HOTSPOT |
{{ appsec.high | length}} |
{{ appsec.warning | length}} |
{{ appsec.info | length}} |
{{ appsec.secure | length}} |
+ {{ appsec.hotspot | length}} |
@@ -231,7 +233,7 @@
| PERMISSIONS |
STATUS |
- DESCRIPTION |
+ INFO |
REASON IN MANIFEST |
@@ -245,10 +247,10 @@
{{ desc.status }}
- {{ desc.description}}
+ {{ desc.info}}
|
- {{ desc.reason }}
+ {{ desc.description }}
|
{% endfor %}
diff --git a/mobsf/templates/static_analysis/appsec_dashboard.html b/mobsf/templates/static_analysis/appsec_dashboard.html
index c69bfc5a..d1fcaedb 100644
--- a/mobsf/templates/static_analysis/appsec_dashboard.html
+++ b/mobsf/templates/static_analysis/appsec_dashboard.html
@@ -146,6 +146,7 @@ sidebar-collapse
+ {% if not efr01 %}
@@ -171,6 +172,7 @@ sidebar-collapse
+ {% endif %}
@@ -234,6 +236,7 @@ sidebar-collapse
+ {% if not efr01 %}
@@ -258,6 +261,7 @@ sidebar-collapse
- Warning
+ Medium
{{ warning | length}}
@@ -307,7 +311,7 @@ sidebar-collapse
-
+
@@ -320,7 +324,7 @@ sidebar-collapse
-
+
@@ -333,7 +337,21 @@ sidebar-collapse
+
+
+
+
+
+
+ {% if efr01 %}Need to Investigate{% else %}Hotspot{% endif %}
+ {{ hotspot | length}}
+
+
+
+
+
+
{% for item in high %}
@@ -362,7 +380,7 @@ sidebar-collapse
@@ -397,6 +415,8 @@ sidebar-collapse
{% endfor %}
+
+
{% for item in secure %}
{% endfor %}
+
+
+{% for item in hotspot %}
+
+{% endfor %}
+
+
+
+
| PERMISSIONS |
STATUS |
- DESCRIPTION |
+ INFO |
REASON IN MANIFEST |
@@ -502,10 +502,10 @@
{% endif %}
- {{ desc.description}}
+ {{ desc.info}}
|
- {{ desc.reason }}
+ {{ desc.description }}
|
{% endfor %}
diff --git a/mobsf/templates/static_analysis/ios_source_analysis.html b/mobsf/templates/static_analysis/ios_source_analysis.html
index 0a0e599d..fb2e776a 100755
--- a/mobsf/templates/static_analysis/ios_source_analysis.html
+++ b/mobsf/templates/static_analysis/ios_source_analysis.html
@@ -444,7 +444,7 @@
| PERMISSIONS |
STATUS |
- DESCRIPTION |
+ INFO |
REASON IN MANIFEST |
@@ -463,10 +463,10 @@
{% endif %}
- {{ desc.description}}
+ {{ desc.info}}
|
- {{ desc.reason }}
+ {{ desc.description }}
|
{% endfor %}