mirror of
https://github.com/MobSF/Mobile-Security-Framework-MobSF.git
synced 2026-10-11 22:50:09 +00:00
Ajin Abraham
62563ca429
Security Fixes [GHSA-8j49-mmcx-4mp5] Arbitrary File Read via Path Traversal in ZIP/APK Icon Extraction The android:icon attribute from an APK manifest was interpolated into file paths without validation, allowing a crafted APK to read arbitrary files from the server. Fixed by adding is_path_traversal() and is_safe_path() guards in find_icon_path_zip. Dependency bump included. [GHSA-3p54-567p-2wpr] CSRF Checks Not Enforced After Django Middleware Migration The migration from the deprecated MIDDLEWARE_CLASSES to MIDDLEWARE omitted CsrfViewMiddleware, SecurityMiddleware, and XFrameOptionsMiddleware, leaving CSRF, HSTS, and clickjacking protections silently disabled. All three have been restored to the active MIDDLEWARE tuple. The now-dead MIDDLEWARE_CLASSES block has been removed to prevent future confusion. [GHSA-x768-8642-mmq9] Zip Bomb Denial of Service via Per-File Size Limit Bypass The per-file size check in ZIP extraction logged a warning on oversized members but was missing a continue, allowing files exceeding ZIP_MAX_UNCOMPRESSED_FILE_SIZE to be extracted anyway as long as the aggregate limit was not reached. Fixed by adding the missing continue. [GHSA-95px-34x5-p37h] SSRF Port Restriction Bypass in assetlinks_check valid_host() was called with only the bare hostname, allowing android:port to be appended afterward without going through port validation, bypassing the HTTP/HTTPS-only restriction. Fixed with a two-layer approach: primary port allowlist check before URL assembly in get_browsable_activities, and a defence-in-depth re-check in _check_url. Hardening The hand-rolled safe_extract used os.path.abspath (symlink-blind) instead of os.path.realpath, creating a TOCTOU window where a symlink could redirect extraction outside the destination directory. Replaced with Python 3.12's tarfile.extractall(filter='data') (PEP 706), which rejects symlinks, hardlinks, absolute paths, and traversal members per-member before extraction. A robust realpath-based fallback is included for older Python versions. Both download_app_data call sites in the iOS dynamic analyser now wrap app_container and tarfile with shlex.quote when building the SSH tar command, as defensive coding hygiene. Refactoring is_path_traversal, is_safe_path, clean_filename, cmd_injection_check, is_pipe_or_link, and is_attack_pattern were scattered across utils.py and shared.py. All have been moved to mobsf/MobSF/security.py as the single authoritative location for security primitives. Developer Tooling AGENTS.md / CLAUDE.md - AI agent guidelines Added a coding-standards document for AI coding agents (Cursor, Claude, Codex) covering MobSF-specific secure-by-default patterns: path traversal guards, archive extraction safety, Django middleware active-tuple hygiene, split-validation anti-patterns (SSRF port bypass), guard completeness (continue/return/raise after every security check), and Django-specific security features (form validators, decorators, middleware). CLAUDE.md is a symlink to AGENTS.md.
296 lines
12 KiB
Python
296 lines
12 KiB
Python
# -*- coding: utf_8 -*-
|
|
"""Module for network security analysis."""
|
|
import logging
|
|
from pathlib import Path
|
|
|
|
from defusedxml.minidom import parseString
|
|
|
|
from mobsf.MobSF.security import is_path_traversal
|
|
from mobsf.MobSF.utils import (
|
|
append_scan_status,
|
|
)
|
|
|
|
logger = logging.getLogger(__name__)
|
|
HIGH = 'high'
|
|
WARNING = 'warning'
|
|
INFO = 'info'
|
|
SECURE = 'secure'
|
|
|
|
|
|
def read_netsec_config(checksum, app_dir, config, src_type):
|
|
"""Read the manifest file."""
|
|
msg = 'Reading Network Security config'
|
|
try:
|
|
config_file = None
|
|
config = config.replace('@xml/', '', 1)
|
|
base = Path(app_dir)
|
|
if src_type == 'studio':
|
|
# Support only android studio source files
|
|
xml_dir = base / 'app' / 'src' / 'main' / 'res' / 'xml'
|
|
else:
|
|
# APK
|
|
xml_dir = base / 'apktool_out' / 'res' / 'xml'
|
|
if not is_path_traversal(config):
|
|
netsec_file = xml_dir / f'{config}.xml'
|
|
if netsec_file.exists():
|
|
desc = f'{msg} from {config}.xml'
|
|
logger.info(desc)
|
|
append_scan_status(checksum, desc)
|
|
return netsec_file.read_text('utf8', 'ignore')
|
|
# Couldn't find the file defined in manifest
|
|
xmls = Path(xml_dir).glob('*.xml')
|
|
for xml in xmls:
|
|
if 'network_security' in xml.stem:
|
|
config_file = xml
|
|
break
|
|
if not config_file:
|
|
return None
|
|
desc = f'{msg} from {config_file.name}'
|
|
logger.info(desc)
|
|
append_scan_status(checksum, desc)
|
|
return config_file.read_text('utf8', 'ignore')
|
|
except Exception as exp:
|
|
logger.exception(msg)
|
|
append_scan_status(checksum, msg, repr(exp))
|
|
return None
|
|
|
|
|
|
def analysis(checksum, app_dir, config, is_debuggable, src_type):
|
|
"""Perform Network Security Analysis."""
|
|
try:
|
|
netsec = {
|
|
'network_findings': [],
|
|
'network_summary': {},
|
|
}
|
|
if not config:
|
|
return netsec
|
|
netsec_conf = read_netsec_config(
|
|
checksum,
|
|
app_dir,
|
|
config,
|
|
src_type)
|
|
if not netsec_conf:
|
|
return netsec
|
|
msg = 'Parsing Network Security config'
|
|
logger.info(msg)
|
|
append_scan_status(checksum, msg)
|
|
parsed = parseString(netsec_conf)
|
|
finds = []
|
|
summary = {HIGH: 0, WARNING: 0, INFO: 0, SECURE: 0}
|
|
# Base Config
|
|
b_cfg = parsed.getElementsByTagName('base-config')
|
|
# 0 or 1 of <base-config>
|
|
if b_cfg:
|
|
if b_cfg[0].getAttribute('cleartextTrafficPermitted') == 'true':
|
|
finds.append({
|
|
'scope': ['*'],
|
|
'description': (
|
|
'Base config is insecurely configured'
|
|
' to permit clear text traffic to all domains.'),
|
|
'severity': HIGH,
|
|
})
|
|
summary[HIGH] += 1
|
|
if b_cfg[0].getAttribute('cleartextTrafficPermitted') == 'false':
|
|
finds.append({
|
|
'scope': ['*'],
|
|
'description': (
|
|
'Base config is configured to disallow '
|
|
'clear text traffic to all domains.'),
|
|
'severity': SECURE,
|
|
})
|
|
summary[SECURE] += 1
|
|
trst_anch = b_cfg[0].getElementsByTagName('trust-anchors')
|
|
if trst_anch:
|
|
certs = trst_anch[0].getElementsByTagName('certificates')
|
|
for cert in certs:
|
|
loc = cert.getAttribute('src')
|
|
override = cert.getAttribute('overridePins')
|
|
if '@raw/' in loc:
|
|
finds.append({
|
|
'scope': ['*'],
|
|
'description': (
|
|
'Base config is configured to trust'
|
|
f'bundled certs {loc}.'),
|
|
'severity': INFO,
|
|
})
|
|
summary[INFO] += 1
|
|
elif loc == 'system':
|
|
finds.append({
|
|
'scope': ['*'],
|
|
'description': (
|
|
'Base config is configured to trust'
|
|
' system certificates.'),
|
|
'severity': WARNING,
|
|
})
|
|
summary[WARNING] += 1
|
|
elif loc == 'user':
|
|
finds.append({
|
|
'scope': ['*'],
|
|
'description': (
|
|
'Base config is configured to trust'
|
|
' user installed certificates.'),
|
|
'severity': HIGH,
|
|
})
|
|
summary[HIGH] += 1
|
|
if override == 'true':
|
|
finds.append({
|
|
'scope': ['*'],
|
|
'description': (
|
|
'Base config is configured to '
|
|
'bypass certificate pinning.'),
|
|
'severity': HIGH,
|
|
})
|
|
summary[HIGH] += 1
|
|
# Domain Config
|
|
dom_cfg = parsed.getElementsByTagName('domain-config')
|
|
# Any number of <domain-config>
|
|
for cfg in dom_cfg:
|
|
domain_list = []
|
|
domains = cfg.getElementsByTagName('domain')
|
|
for dom in domains:
|
|
domain_list.append(dom.firstChild.nodeValue)
|
|
if cfg.getAttribute('cleartextTrafficPermitted') == 'true':
|
|
finds.append({
|
|
'scope': domain_list,
|
|
'description': (
|
|
'Domain config is insecurely configured'
|
|
' to permit clear text traffic to these '
|
|
'domains in scope.'),
|
|
'severity': HIGH,
|
|
})
|
|
summary[HIGH] += 1
|
|
elif cfg.getAttribute('cleartextTrafficPermitted') == 'false':
|
|
finds.append({
|
|
'scope': domain_list,
|
|
'description': (
|
|
'Domain config is securely configured'
|
|
' to disallow clear text traffic to these '
|
|
'domains in scope.'),
|
|
'severity': SECURE,
|
|
})
|
|
summary[SECURE] += 1
|
|
dtrust = cfg.getElementsByTagName('trust-anchors')
|
|
if dtrust:
|
|
certs = dtrust[0].getElementsByTagName('certificates')
|
|
for cert in certs:
|
|
loc = cert.getAttribute('src')
|
|
override = cert.getAttribute('overridePins')
|
|
if '@raw/' in loc:
|
|
finds.append({
|
|
'scope': domain_list,
|
|
'description': (
|
|
'Domain config is configured to trust '
|
|
f'bundled certs {loc}.'),
|
|
'severity': INFO,
|
|
})
|
|
summary[INFO] += 1
|
|
elif loc == 'system':
|
|
finds.append({
|
|
'scope': domain_list,
|
|
'description': (
|
|
'Domain config is configured to trust'
|
|
' system certificates.'),
|
|
'severity': WARNING,
|
|
})
|
|
summary[WARNING] += 1
|
|
elif loc == 'user':
|
|
finds.append({
|
|
'scope': domain_list,
|
|
'description': (
|
|
'Domain config is configured to trust'
|
|
' user installed certificates.'),
|
|
'severity': HIGH,
|
|
})
|
|
summary[HIGH] += 1
|
|
if override == 'true':
|
|
finds.append({
|
|
'scope': domain_list,
|
|
'description': (
|
|
'Domain config is configured to '
|
|
'bypass certificate pinning.'),
|
|
'severity': HIGH,
|
|
})
|
|
summary[HIGH] += 1
|
|
pinsets = cfg.getElementsByTagName('pin-set')
|
|
if pinsets:
|
|
exp = pinsets[0].getAttribute('expiration')
|
|
pins = pinsets[0].getElementsByTagName('pin')
|
|
all_pins = []
|
|
for pin in pins:
|
|
digest = pin.getAttribute('digest')
|
|
pin_val = pin.firstChild.nodeValue
|
|
if digest:
|
|
tmp = f'Pin: {pin_val} Digest: {digest}'
|
|
else:
|
|
tmp = f'Pin: {pin_val}'
|
|
all_pins.append(tmp)
|
|
pins_list = ','.join(all_pins)
|
|
if exp:
|
|
finds.append({
|
|
'scope': domain_list,
|
|
'description': (
|
|
'Certificate pinning expires '
|
|
f'on {exp}. After this date '
|
|
'pinning will be disabled. '
|
|
f'[{pins_list}]'),
|
|
'severity': INFO,
|
|
})
|
|
summary[INFO] += 1
|
|
else:
|
|
finds.append({
|
|
'scope': domain_list,
|
|
'description': (
|
|
'Certificate pinning does '
|
|
'not have an expiry. Ensure '
|
|
'that pins are updated before '
|
|
'certificate expire. '
|
|
f'[{pins_list}]'),
|
|
'severity': SECURE,
|
|
})
|
|
summary[SECURE] += 1
|
|
# Debug Overrides
|
|
de_over = parsed.getElementsByTagName('debug-overrides')
|
|
# 0 or 1 of <debug-overrides>
|
|
if de_over and is_debuggable:
|
|
if de_over[0].getAttribute('cleartextTrafficPermitted') == 'true':
|
|
finds.append({
|
|
'scope': ['*'],
|
|
'description': (
|
|
'Debug override is configured to permit clear '
|
|
'text traffic to all domains and the app '
|
|
'is debuggable.'),
|
|
'severity': HIGH,
|
|
})
|
|
summary[HIGH] += 1
|
|
otrst_anch = de_over[0].getElementsByTagName('trust-anchors')
|
|
if otrst_anch:
|
|
certs = otrst_anch[0].getElementsByTagName('certificates')
|
|
for cert in certs:
|
|
loc = cert.getAttribute('src')
|
|
override = cert.getAttribute('overridePins')
|
|
if '@raw/' in loc:
|
|
finds.append({
|
|
'scope': ['*'],
|
|
'description': (
|
|
'Debug override is configured to trust '
|
|
f'bundled debug certs {loc}.'),
|
|
'severity': HIGH,
|
|
})
|
|
summary[HIGH] += 1
|
|
if override == 'true':
|
|
finds.append({
|
|
'scope': ['*'],
|
|
'description': (
|
|
'Debug override is configured to '
|
|
'bypass certificate pinning.'),
|
|
'severity': HIGH,
|
|
})
|
|
summary[HIGH] += 1
|
|
netsec['network_findings'] = finds
|
|
netsec['network_summary'] = summary
|
|
except Exception as exp:
|
|
msg = 'Performing Network Security Analysis'
|
|
logger.exception(msg)
|
|
append_scan_status(checksum, msg, repr(exp))
|
|
return netsec
|