From e00991caa7ca935dfa6b018ddab74b3acb6639de Mon Sep 17 00:00:00 2001 From: Ajin Abraham Date: Sat, 19 Feb 2022 10:55:28 -0800 Subject: [PATCH] HOTFIX: EFR01 Enterprise feature request (#1908) * Replace Warning with Medium and added Hotspot * Add file analysis to hotspot * Enterprise Feature Request Flag * EFR01 changes * version bump --- mobsf/MobSF/init.py | 2 +- mobsf/MobSF/settings.py | 5 +- mobsf/StaticAnalyzer/views/common/appsec.py | 64 ++++++++++++++++++- .../views/ios/permission_analysis.py | 4 +- mobsf/StaticAnalyzer/views/ios/view_source.py | 5 +- mobsf/static/others/css/pdf_report.css | 4 ++ mobsf/templates/pdf/android_report.html | 4 +- mobsf/templates/pdf/ios_report.html | 10 +-- .../static_analysis/appsec_dashboard.html | 56 ++++++++++++++-- .../static_analysis/ios_binary_analysis.html | 6 +- .../static_analysis/ios_source_analysis.html | 6 +- 11 files changed, 142 insertions(+), 24 deletions(-) diff --git a/mobsf/MobSF/init.py b/mobsf/MobSF/init.py index dee045f2..2256b26d 100644 --- a/mobsf/MobSF/init.py +++ b/mobsf/MobSF/init.py @@ -10,7 +10,7 @@ from mobsf.install.windows.setup import windows_config_local logger = logging.getLogger(__name__) -VERSION = '3.5.1' +VERSION = '3.5.2' BANNER = """ __ __ _ ____ _____ _____ ____ | \/ | ___ | |__/ ___|| ___|_ _|___ / | ___| diff --git a/mobsf/MobSF/settings.py b/mobsf/MobSF/settings.py index e3003710..363912b5 100644 --- a/mobsf/MobSF/settings.py +++ b/mobsf/MobSF/settings.py @@ -278,7 +278,10 @@ LOGGING = { }, }, } -# =================== +# =========================== +# ENTERPRISE FEATURE REQUESTS +# =========================== +EFR_01 = os.getenv('EFR_01', '0') # USER CONFIGURATION # =================== if CONFIG_HOME: diff --git a/mobsf/StaticAnalyzer/views/common/appsec.py b/mobsf/StaticAnalyzer/views/common/appsec.py index e47239de..5110f9ca 100644 --- a/mobsf/StaticAnalyzer/views/common/appsec.py +++ b/mobsf/StaticAnalyzer/views/common/appsec.py @@ -39,6 +39,58 @@ def common_fields(findings, data): 'description': f'{desc}\n{ref}', 'section': 'code', }) + # Permissions + dang_perms = [] + fmt_perm = '' + for pm, meta in data['permissions'].items(): + status = meta['status'] + description = meta.get('description') + if status == 'dangerous': + info = meta.get('info') + if not info: + info = meta.get('reason') + dang_perms.append( + f'{pm} ({status}): ' + f'{info} - {description}') + if dang_perms: + fmt_perm += '\n\n'.join(dang_perms) + findings['hotspot'].append({ + 'title': ( + f'Found {len(dang_perms)} ' + 'critical permission(s)'), + 'description': ( + 'Ensure that these permissions ' + 'are required by the application.\n\n' + f'{fmt_perm}'), + 'section': 'permissions', + }) + # File Analysis + cert_files = None + cfp = [] + for fa in data['file_analysis']: + if 'Cert' in fa.get('finding', ''): + cfp = fa['files'] + break + if 'Cert' in fa.get('issue', ''): + cert_files = fa['files'] + break + if cert_files: + for f in cert_files: + cfp.append(f['file_path']) + if cfp: + fcerts = '\n'.join(cfp) + findings['hotspot'].append({ + 'title': ( + f'Found {len(cfp)} ' + 'certificate/key file(s)'), + 'description': ( + 'Ensure that these files ' + 'does not contain any ' + 'private information or ' + 'sensitive key materials.\n\n' + f'{fcerts}'), + 'section': 'files', + }) # Malicious Domains for domain, value in data['domains'].items(): if value['bad'] == 'yes': @@ -64,7 +116,8 @@ def common_fields(findings, data): t = len(data['trackers']['trackers']) findings['trackers'] = t if t > 4: - findings['high'].append({ + sev = 'hotspot' if settings.EFR_01 == '1' else 'high' + findings[sev].append({ 'title': 'Application contains Privacy Trackers', 'description': ( f'This app has more than {t} privacy trackers.' @@ -73,7 +126,8 @@ def common_fields(findings, data): 'section': 'trackers', }) elif t > 0: - findings['warning'].append({ + sev = 'hotspot' if settings.EFR_01 == '1' else 'warning' + findings[sev].append({ 'title': 'Application contains Privacy Trackers', 'description': ( f'This app has {t} privacy trackers.' @@ -94,7 +148,8 @@ def common_fields(findings, data): secrets = data['secrets'] if len(secrets) > 1: sec = '\n'.join(secrets) - findings['warning'].append({ + sev = 'hotspot' if settings.EFR_01 == '1' else 'warning' + findings[sev].append({ 'title': 'This app may contain hardcoded secrets', 'description': ( 'The following secrets were identified from the app. ' @@ -120,6 +175,7 @@ def get_android_dashboard(context, from_ctx=False): 'warning': [], 'info': [], 'secure': [], + 'hotspot': [], 'total_trackers': None, } if from_ctx: @@ -179,6 +235,7 @@ def get_ios_dashboard(context, from_ctx=False): 'warning': [], 'info': [], 'secure': [], + 'hotspot': [], 'total_trackers': None, } if from_ctx: @@ -276,6 +333,7 @@ def appsec_dashboard(request, checksum, api=False): return print_n_send_error_response(request, msg) context['version'] = settings.MOBSF_VER context['title'] = 'AppSec Scorecard' + context['efr01'] = True if settings.EFR_01 == '1' else False if api: return context else: diff --git a/mobsf/StaticAnalyzer/views/ios/permission_analysis.py b/mobsf/StaticAnalyzer/views/ios/permission_analysis.py index dee66a4c..5a9f9022 100644 --- a/mobsf/StaticAnalyzer/views/ios/permission_analysis.py +++ b/mobsf/StaticAnalyzer/views/ios/permission_analysis.py @@ -83,8 +83,8 @@ def check_permissions(p_list): for perm, desc in COCOA_KEYS.items(): if perm in p_list: permissions[perm] = { - 'description': desc[0], + 'info': desc[0], 'status': desc[1], - 'reason': p_list.get(perm, ''), + 'description': p_list.get(perm, ''), } return permissions diff --git a/mobsf/StaticAnalyzer/views/ios/view_source.py b/mobsf/StaticAnalyzer/views/ios/view_source.py index ca7c588a..18255a7f 100644 --- a/mobsf/StaticAnalyzer/views/ios/view_source.py +++ b/mobsf/StaticAnalyzer/views/ios/view_source.py @@ -103,9 +103,12 @@ def run(request, api=False): dat = flip.read() elif typ == 'plist': file_format = 'json' - dat = biplist.readPlist(sfile) try: + dat = biplist.readPlist(sfile) dat = json.dumps(dat, indent=4, sort_keys=True) + except biplist.InvalidPlistException: + file_format = 'xml' + dat = Path(sfile).read_text() except Exception: pass elif typ == 'db': diff --git a/mobsf/static/others/css/pdf_report.css b/mobsf/static/others/css/pdf_report.css index eef2c077..6effc8ca 100644 --- a/mobsf/static/others/css/pdf_report.css +++ b/mobsf/static/others/css/pdf_report.css @@ -103,6 +103,10 @@ td{ background-color: green; } +.td-secondary { + background-color: rgb(30, 31, 30); +} + .tbl-white { color:#ffffff; } diff --git a/mobsf/templates/pdf/android_report.html b/mobsf/templates/pdf/android_report.html index 6dd34134..ad4ee6da 100755 --- a/mobsf/templates/pdf/android_report.html +++ b/mobsf/templates/pdf/android_report.html @@ -143,15 +143,17 @@ - + + +
HIGH WARNING MEDIUM INFO SECURE HOTSPOT

{{ appsec.high | length}}

{{ appsec.warning | length}}

{{ appsec.info | length}}

{{ appsec.secure | length}}

{{ appsec.hotspot | length}}
diff --git a/mobsf/templates/pdf/ios_report.html b/mobsf/templates/pdf/ios_report.html index 09f1c02d..a10cc59e 100644 --- a/mobsf/templates/pdf/ios_report.html +++ b/mobsf/templates/pdf/ios_report.html @@ -142,15 +142,17 @@ - + + +
HIGH WARNING MEDIUM INFO SECURE HOTSPOT

{{ appsec.high | length}}

{{ appsec.warning | length}}

{{ appsec.info | length}}

{{ appsec.secure | length}}

{{ appsec.hotspot | length}}
@@ -231,7 +233,7 @@ PERMISSIONS STATUS - DESCRIPTION + INFO REASON IN MANIFEST @@ -245,10 +247,10 @@ {{ desc.status }} - {{ desc.description}} + {{ desc.info}} - {{ desc.reason }} + {{ desc.description }} {% endfor %} diff --git a/mobsf/templates/static_analysis/appsec_dashboard.html b/mobsf/templates/static_analysis/appsec_dashboard.html index c69bfc5a..d1fcaedb 100644 --- a/mobsf/templates/static_analysis/appsec_dashboard.html +++ b/mobsf/templates/static_analysis/appsec_dashboard.html @@ -146,6 +146,7 @@ sidebar-collapse
+ {% if not efr01 %}

@@ -171,6 +172,7 @@ sidebar-collapse

+ {% endif %}
@@ -234,6 +236,7 @@ sidebar-collapse
+ {% if not efr01 %}

@@ -258,6 +261,7 @@ sidebar-collapse

+ {% endif %} @@ -298,7 +302,7 @@ sidebar-collapse
- Warning + Medium {{ warning | length}}
@@ -307,7 +311,7 @@ sidebar-collapse -
+
@@ -320,7 +324,7 @@ sidebar-collapse
-
+
@@ -333,7 +337,21 @@ sidebar-collapse
+ +
+
+ + +
+ {% if efr01 %}Need to Investigate{% else %}Hotspot{% endif %} + {{ hotspot | length}} +
+ +
+
+ +

{% for item in high %} @@ -362,7 +380,7 @@ sidebar-collapse

- warning {{ item.title}} + medium {{ item.title}}

@@ -397,6 +415,8 @@ sidebar-collapse {% endfor %} + + {% for item in secure %}
@@ -417,6 +437,32 @@ sidebar-collapse
{% endfor %} + + +{% for item in hotspot %} +
+ +
+
+

+ {% if efr01 %}need to investigate{% else %}hotspot{% endif %} {{ item.title}} +

+
+ +
+ + +
+
+ 
{{ item.description}}
+
+
+
+{% endfor %} + + + +
@@ -477,7 +523,7 @@ sidebar-collapse } }, data: { - labels: [`High`, `Warning`, `Info`, `Secure`], + labels: [`High`, `Medium`, `Info`, `Secure`], datasets: [{ backgroundColor: [ "#dc3545", diff --git a/mobsf/templates/static_analysis/ios_binary_analysis.html b/mobsf/templates/static_analysis/ios_binary_analysis.html index 737fd662..ef7332cf 100755 --- a/mobsf/templates/static_analysis/ios_binary_analysis.html +++ b/mobsf/templates/static_analysis/ios_binary_analysis.html @@ -483,7 +483,7 @@ PERMISSIONS STATUS - DESCRIPTION + INFO REASON IN MANIFEST @@ -502,10 +502,10 @@ {% endif %} - {{ desc.description}} + {{ desc.info}} - {{ desc.reason }} + {{ desc.description }} {% endfor %} diff --git a/mobsf/templates/static_analysis/ios_source_analysis.html b/mobsf/templates/static_analysis/ios_source_analysis.html index 0a0e599d..fb2e776a 100755 --- a/mobsf/templates/static_analysis/ios_source_analysis.html +++ b/mobsf/templates/static_analysis/ios_source_analysis.html @@ -444,7 +444,7 @@ PERMISSIONS STATUS - DESCRIPTION + INFO REASON IN MANIFEST @@ -463,10 +463,10 @@ {% endif %} - {{ desc.description}} + {{ desc.info}} - {{ desc.reason }} + {{ desc.description }} {% endfor %}