|
| 1 | +/** |
| 2 | + * @name Unsafe certificate trust and improper hostname verification |
| 3 | + * @description Unsafe implementation of the interface X509TrustManager, HostnameVerifier, and SSLSocket/SSLEngine ignores all SSL certificate validation errors when establishing an HTTPS connection, thereby making the app vulnerable to man-in-the-middle attacks. |
| 4 | + * @kind problem |
| 5 | + * @id java/unsafe-cert-trust |
| 6 | + * @tags security |
| 7 | + * external/cwe-273 |
| 8 | + */ |
| 9 | + |
| 10 | +import java |
| 11 | +import semmle.code.java.security.Encryption |
| 12 | + |
| 13 | +/** |
| 14 | + * X509TrustManager class that blindly trusts all certificates in server SSL authentication |
| 15 | + */ |
| 16 | +class X509TrustAllManager extends RefType { |
| 17 | + X509TrustAllManager() { |
| 18 | + this.getASupertype*() instanceof X509TrustManager and |
| 19 | + exists(Method m1 | |
| 20 | + m1.getDeclaringType() = this and |
| 21 | + m1.hasName("checkServerTrusted") and |
| 22 | + m1.getBody().getNumStmt() = 0 |
| 23 | + ) and |
| 24 | + exists(Method m2, ReturnStmt rt2 | |
| 25 | + m2.getDeclaringType() = this and |
| 26 | + m2.hasName("getAcceptedIssuers") and |
| 27 | + rt2.getEnclosingCallable() = m2 and |
| 28 | + rt2.getResult() instanceof NullLiteral |
| 29 | + ) |
| 30 | + } |
| 31 | +} |
| 32 | + |
| 33 | +/** |
| 34 | + * The init method of SSLContext with the trust all manager, which is sslContext.init(..., serverTMs, ...) |
| 35 | + */ |
| 36 | +class X509TrustAllManagerInit extends MethodAccess { |
| 37 | + X509TrustAllManagerInit() { |
| 38 | + this.getMethod().hasName("init") and |
| 39 | + this.getMethod().getDeclaringType() instanceof SSLContext and //init method of SSLContext |
| 40 | + ( |
| 41 | + exists(ArrayInit ai | |
| 42 | + this.getArgument(1).(ArrayCreationExpr).getInit() = ai and |
| 43 | + ai.getInit(0).(VarAccess).getVariable().getInitializer().getType().(Class).getASupertype*() |
| 44 | + instanceof X509TrustAllManager //Scenario of context.init(null, new TrustManager[] { TRUST_ALL_CERTIFICATES }, null); |
| 45 | + ) |
| 46 | + or |
| 47 | + exists(Variable v, ArrayInit ai | |
| 48 | + this.getArgument(1).(VarAccess).getVariable() = v and |
| 49 | + ai.getParent() = v.getAnAssignedValue() and |
| 50 | + ai.getInit(0).getType().(Class).getASupertype*() instanceof X509TrustAllManager //Scenario of context.init(null, serverTMs, null); |
| 51 | + ) |
| 52 | + ) |
| 53 | + } |
| 54 | +} |
| 55 | + |
| 56 | +/** |
| 57 | + * HostnameVerifier class that allows a certificate whose CN (Common Name) does not match the host name in the URL |
| 58 | + */ |
| 59 | +class TrustAllHostnameVerifier extends RefType { |
| 60 | + TrustAllHostnameVerifier() { |
| 61 | + this.getASupertype*() instanceof HostnameVerifier and |
| 62 | + exists(Method m, ReturnStmt rt | |
| 63 | + m.getDeclaringType() = this and |
| 64 | + m.hasName("verify") and |
| 65 | + rt.getEnclosingCallable() = m and |
| 66 | + rt.getResult().(BooleanLiteral).getBooleanValue() = true |
| 67 | + ) |
| 68 | + } |
| 69 | +} |
| 70 | + |
| 71 | +/** |
| 72 | + * The setDefaultHostnameVerifier method of HttpsURLConnection with the trust all configuration |
| 73 | + */ |
| 74 | +class TrustAllHostnameVerify extends MethodAccess { |
| 75 | + TrustAllHostnameVerify() { |
| 76 | + this.getMethod().hasName("setDefaultHostnameVerifier") and |
| 77 | + this.getMethod().getDeclaringType() instanceof HttpsURLConnection and //httpsURLConnection.setDefaultHostnameVerifier method |
| 78 | + ( |
| 79 | + exists(NestedClass nc | |
| 80 | + nc.getASupertype*() instanceof TrustAllHostnameVerifier and |
| 81 | + this.getArgument(0).getType() = nc //Scenario of HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {...}); |
| 82 | + ) |
| 83 | + or |
| 84 | + exists(Variable v | |
| 85 | + this.getArgument(0).(VarAccess).getVariable() = v and |
| 86 | + v.getInitializer().getType() instanceof TrustAllHostnameVerifier //Scenario of HttpsURLConnection.setDefaultHostnameVerifier(verifier); |
| 87 | + ) |
| 88 | + ) |
| 89 | + } |
| 90 | +} |
| 91 | + |
| 92 | +class SSLEngine extends RefType { |
| 93 | + SSLEngine() { this.hasQualifiedName("javax.net.ssl", "SSLEngine") } |
| 94 | +} |
| 95 | + |
| 96 | +class Socket extends RefType { |
| 97 | + Socket() { this.hasQualifiedName("java.net", "Socket") } |
| 98 | +} |
| 99 | + |
| 100 | +class SocketFactory extends RefType { |
| 101 | + SocketFactory() { this.hasQualifiedName("javax.net", "SocketFactory") } |
| 102 | +} |
| 103 | + |
| 104 | +class SSLSocket extends RefType { |
| 105 | + SSLSocket() { this.hasQualifiedName("javax.net.ssl", "SSLSocket") } |
| 106 | +} |
| 107 | + |
| 108 | +/** |
| 109 | + * has setEndpointIdentificationAlgorithm set correctly |
| 110 | + */ |
| 111 | +predicate setEndpointIdentificationAlgorithm(MethodAccess createSSL) { |
| 112 | + exists( |
| 113 | + Variable sslo, MethodAccess ma, Variable sslparams //setSSLParameters with valid setEndpointIdentificationAlgorithm set |
| 114 | + | |
| 115 | + createSSL = sslo.getAnAssignedValue() and |
| 116 | + ma.getQualifier() = sslo.getAnAccess() and |
| 117 | + ma.getMethod().hasName("setSSLParameters") and |
| 118 | + ma.getArgument(0) = sslparams.getAnAccess() and |
| 119 | + exists(MethodAccess setepa | |
| 120 | + setepa.getQualifier() = sslparams.getAnAccess() and |
| 121 | + setepa.getMethod().hasName("setEndpointIdentificationAlgorithm") and |
| 122 | + not setepa.getArgument(0) instanceof NullLiteral |
| 123 | + ) |
| 124 | + ) |
| 125 | +} |
| 126 | + |
| 127 | +/** |
| 128 | + * has setEndpointIdentificationAlgorithm set correctly |
| 129 | + */ |
| 130 | +predicate hasEndpointIdentificationAlgorithm(Variable ssl) { |
| 131 | + exists( |
| 132 | + MethodAccess ma, Variable sslparams //setSSLParameters with valid setEndpointIdentificationAlgorithm set |
| 133 | + | |
| 134 | + ma.getQualifier() = ssl.getAnAccess() and |
| 135 | + ma.getMethod().hasName("setSSLParameters") and |
| 136 | + ma.getArgument(0) = sslparams.getAnAccess() and |
| 137 | + exists(MethodAccess setepa | |
| 138 | + setepa.getQualifier() = sslparams.getAnAccess() and |
| 139 | + setepa.getMethod().hasName("setEndpointIdentificationAlgorithm") and |
| 140 | + not setepa.getArgument(0) instanceof NullLiteral |
| 141 | + ) |
| 142 | + ) |
| 143 | +} |
| 144 | + |
| 145 | +/** |
| 146 | + * Cast of Socket to SSLSocket |
| 147 | + */ |
| 148 | +predicate sslCast(MethodAccess createSSL) { |
| 149 | + exists(Variable ssl, CastExpr ce | |
| 150 | + ce.getExpr() = createSSL and |
| 151 | + ce.getControlFlowNode().getASuccessor().(VariableAssign).getDestVar() = ssl and |
| 152 | + ssl.getType() instanceof SSLSocket //With a type cast `SSLSocket socket = (SSLSocket) socketFactory.createSocket("www.example.com", 443)` |
| 153 | + ) |
| 154 | +} |
| 155 | + |
| 156 | +/** |
| 157 | + * SSL object is created in a separate method call or in the same method |
| 158 | + */ |
| 159 | +predicate hasFlowPath(MethodAccess createSSL, Variable ssl) { |
| 160 | + ( |
| 161 | + createSSL = ssl.getAnAssignedValue() |
| 162 | + or |
| 163 | + exists(CastExpr ce | |
| 164 | + ce.getExpr() = createSSL and |
| 165 | + ce.getControlFlowNode().getASuccessor().(VariableAssign).getDestVar() = ssl //With a type cast like SSLSocket socket = (SSLSocket) socketFactory.createSocket("www.example.com", 443); |
| 166 | + ) |
| 167 | + ) |
| 168 | + or |
| 169 | + exists(MethodAccess tranm | |
| 170 | + createSSL.getEnclosingCallable() = tranm.getMethod() and |
| 171 | + tranm.getControlFlowNode().getASuccessor().(VariableAssign).getDestVar() = ssl and |
| 172 | + not setEndpointIdentificationAlgorithm(createSSL) //Check the scenario of invocation before used in the current method |
| 173 | + ) |
| 174 | +} |
| 175 | + |
| 176 | +/** |
| 177 | + * Not have the SSLParameter set |
| 178 | + */ |
| 179 | +predicate hasNoEndpointIdentificationSet(MethodAccess createSSL, Variable ssl) { |
| 180 | + //No setSSLParameters set |
| 181 | + hasFlowPath(createSSL, ssl) and |
| 182 | + not exists(MethodAccess ma | |
| 183 | + ma.getQualifier() = ssl.getAnAccess() and |
| 184 | + ma.getMethod().hasName("setSSLParameters") |
| 185 | + ) |
| 186 | + or |
| 187 | + //No endpointIdentificationAlgorithm set with setSSLParameters |
| 188 | + hasFlowPath(createSSL, ssl) and |
| 189 | + not setEndpointIdentificationAlgorithm(createSSL) |
| 190 | +} |
| 191 | + |
| 192 | +/** |
| 193 | + * The setEndpointIdentificationAlgorithm method of SSLParameters with the ssl engine or socket |
| 194 | + */ |
| 195 | +class SSLEndpointIdentificationNotSet extends MethodAccess { |
| 196 | + SSLEndpointIdentificationNotSet() { |
| 197 | + ( |
| 198 | + this.getMethod().hasName("createSSLEngine") and |
| 199 | + this.getMethod().getDeclaringType() instanceof SSLContext //createEngine method of SSLContext |
| 200 | + or |
| 201 | + this.getMethod().hasName("createSocket") and |
| 202 | + this.getMethod().getDeclaringType() instanceof SocketFactory and |
| 203 | + this.getMethod().getReturnType() instanceof Socket and |
| 204 | + sslCast(this) //createSocket method of SocketFactory |
| 205 | + ) and |
| 206 | + exists(Variable ssl | |
| 207 | + hasNoEndpointIdentificationSet(this, ssl) and //Not set in itself |
| 208 | + not exists(VariableAssign ar, Variable newSsl | |
| 209 | + ar.getSource() = this.getCaller().getAReference() and |
| 210 | + ar.getDestVar() = newSsl and |
| 211 | + hasEndpointIdentificationAlgorithm(newSsl) //Not set in its caller either |
| 212 | + ) |
| 213 | + ) and |
| 214 | + not exists(MethodAccess ma | ma.getMethod() instanceof HostnameVerifierVerify) //Reduce false positives since this method access set default hostname verifier |
| 215 | + } |
| 216 | +} |
| 217 | + |
| 218 | +class RabbitMQConnectionFactory extends RefType { |
| 219 | + RabbitMQConnectionFactory() { this.hasQualifiedName("com.rabbitmq.client", "ConnectionFactory") } |
| 220 | +} |
| 221 | + |
| 222 | +/** |
| 223 | + * The com.rabbitmq.client.ConnectionFactory useSslProtocol method access without enableHostnameVerification |
| 224 | + */ |
| 225 | +class RabbitMQEnableHostnameVerificationNotSet extends MethodAccess { |
| 226 | + RabbitMQEnableHostnameVerificationNotSet() { |
| 227 | + this.getMethod().hasName("useSslProtocol") and |
| 228 | + this.getMethod().getDeclaringType() instanceof RabbitMQConnectionFactory and |
| 229 | + exists(Variable v | |
| 230 | + v.getType() instanceof RabbitMQConnectionFactory and |
| 231 | + this.getQualifier() = v.getAnAccess() and |
| 232 | + not exists(MethodAccess ma | |
| 233 | + ma.getMethod().hasName("enableHostnameVerification") and |
| 234 | + ma.getQualifier() = v.getAnAccess() |
| 235 | + ) |
| 236 | + ) |
| 237 | + } |
| 238 | +} |
| 239 | + |
| 240 | +from MethodAccess aa |
| 241 | +where |
| 242 | + aa instanceof TrustAllHostnameVerify or |
| 243 | + aa instanceof X509TrustAllManagerInit or |
| 244 | + aa instanceof SSLEndpointIdentificationNotSet or |
| 245 | + aa instanceof RabbitMQEnableHostnameVerificationNotSet |
| 246 | +select aa, "Unsafe configuration of trusted certificates" |
0 commit comments