Java: Add a query for MVEL injections - #3329
Conversation
b718c49 to
4a29ef9
Compare
|
At first, I thought that only static methods from the |
|
|
||
| class MvelCompiledScript extends RefType { | ||
| MvelCompiledScript() { hasQualifiedName("org.mvel2.jsr223", "MvelCompiledScript") } | ||
| } |
There was a problem hiding this comment.
I'm missing org.mvel2.templates.TemplateCompiler.compileTemplate
There was a problem hiding this comment.
Yup! There are actually even more sinks for templates. I'll update the query.
There was a problem hiding this comment.
I've updated the query.
|
I also added a sink for |
4a1815c to
686530f
Compare
|
Fixed similar issues that were found in #3291 |
|
GHSL scope and impact feedback: this is a high impact query that will find potential RCE vulnerabilities. We have verified this query has a low FP rate in its result set. |
aschackmull
left a comment
There was a problem hiding this comment.
One minor comment, otherwise LGTM.
|
|
||
| predicate test() { | ||
| exists(ConstructorCall cc | cc.getConstructedType() instanceof CompiledAccExpression) | ||
| } |
There was a problem hiding this comment.
| predicate test() { | |
| exists(ConstructorCall cc | cc.getConstructedType() instanceof CompiledAccExpression) | |
| } |
Looks like test code that was left by mistake.
| and then runs it in the default powerfull context. | ||
| </p> | ||
| <sample src="UnsafeMvelExpressionEvaluation.java" /> | ||
|
|
There was a problem hiding this comment.
| </example> |
Missing close tag.
- Added experimental/Security/CWE/CWE-094/MvelInjection.ql - Added experimental/Security/CWE/CWE-094/MvelInjectionLib.qll - Added a qhelp file with an example of vulnerable code - Added tests and stubs for mvel2-2.4.7
- Updated MvelInjectionLib.qll - Added tests and stubs for JSR 223 API
686530f to
b7c3dd6
Compare
|
@aschackmull Thanks for the review! I've addressed your comments. |
I'd like to add a query that looks for expression language injections with MVEL. Here is a list of main updates:
experimental/Security/CWE/CWE-094/MvelInjection.ql.experimental/Security/CWE/CWE-094/MvelInjectionLib.qll.mvel2-2.4.7.MVEL is a powerful expression language that allows, in particular, calling arbitrary methods. That may lead to arbitrary code execution. In past, there were several issues (not reported by myself) due to unsafe evaluation of MVEL expressions:
Currently, the query doesn't find the CVEs above. To make it work, the query needs to be updated with additional taint propagation steps that take into account internal structure of Elasticsearch and Drools. This internal structure is not visible to users via public APIs. I didn't model this internal structure because I am not sure if the users can benefit from it.