Skip to content
This repository was archived by the owner on Nov 28, 2023. It is now read-only.

Commit 0ba8a0b

Browse files
FeeiCNFeeiCN
authored
Merge pull request #576 from wufeifei/develop
Released v2.0.0-alpha.4
2 parents ce5a5c9 + a60cd60 commit 0ba8a0b

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

66 files changed

+1112
-147
lines changed

‎CHANGES.md

+9
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,15 @@ Cobra Changelog
33

44
Here you can see the full list of changes between each Cobra release.
55

6+
Version 2.0.0-alpha.4
7+
---------------------
8+
9+
Released on Sep 12 2017
10+
11+
- 增加WebShell规则和测试用例 #571
12+
- 支持FPC模式修复函数 #565 #559
13+
- 其它细节优化和Bug修复
14+
615
Version 2.0.0-alpha.3
716
---------------------
817

‎cobra/__version__.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
__issue_page__ = 'https://github.com/wufeifei/cobra/issues/new'
88
__python_version__ = sys.version.split()[0]
99
__platform__ = platform.platform()
10-
__version__ = '2.0.0-alpha.3'
10+
__version__ = '2.0.0-alpha.4'
1111
__author__ = 'Feei'
1212
__author_email__ = '[email protected]'
1313
__license__ = 'MIT License'

‎cobra/config.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ def __init__(self, level1=None, level2=None):
7070
value = config.get(level1, level2)
7171
except Exception as e:
7272
traceback.print_exc()
73-
logger.critical("./configs file configure failed.\nError: {0}".format(e.message))
73+
logger.critical("./configs file configure failed. {u}\nError: {e}".format(u='https://wufeifei.github.io/cobra/config', e=e.message))
7474
self.value = value
7575

7676
@staticmethod

‎cobra/engine.py

+6-3
Original file line numberDiff line numberDiff line change
@@ -522,7 +522,7 @@ def is_annotation(self):
522522
- Java:
523523
:return: boolean
524524
"""
525-
match_result = re.findall(r"(#|\\\*|\/\/)+", self.code_content)
525+
match_result = re.findall(r"^(#|\\\*|\/\/)+", self.code_content)
526526
# Skip detection only on match
527527
if self.is_match_only_rule():
528528
return False
@@ -620,13 +620,16 @@ def scan(self):
620620
if self.file_path[-3:].lower() == 'php':
621621
try:
622622
ast = CAST(self.rule_match, self.target_directory, self.file_path, self.line_number, self.code_content)
623+
rule_repair = []
623624
if self.rule_match_mode == const.mm_function_param_controllable:
624-
rule_match = self.rule_match.strip('()').split('|')
625+
rule_match = self.rule_match.strip('()').split('|') # 漏洞规则整理为列表
626+
if self.rule_repair is not None:
627+
rule_repair = self.rule_repair.strip('()').split('|') # 修复规则整理为列表
625628
logger.debug('[RULE_MATCH] {r}'.format(r=rule_match))
626629
try:
627630
with open(self.file_path, 'r') as fi:
628631
code_contents = fi.read()
629-
result = scan_parser(code_contents, rule_match, self.line_number)
632+
result = scan_parser(code_contents, rule_match, self.line_number, rule_repair)
630633
logger.debug('[AST] [RET] {c}'.format(c=result))
631634
if len(result) > 0:
632635
if result[0]['code'] == 1: # 函数参数可控

‎cobra/parser.py

+10-4
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818

1919
with_line = True
2020
scan_results = [] # 结果存放列表初始化
21+
repairs = [] # 用于存放修复函数
2122

2223

2324
def export(items):
@@ -134,7 +135,7 @@ def get_binaryop_params(node): # 当为BinaryOp类型时，分别对left和righ
134135
if isinstance(node.right, php.Variable):
135136
params.append(node.right.name)
136137

137-
elif not isinstance(node.right, php.Variable) or not isinstance(node.left, php.Variable): # right不为变量时
138+
if not isinstance(node.right, php.Variable) or not isinstance(node.left, php.Variable): # right不为变量时
138139
params_right = get_binaryop_deep_params(node.right, params)
139140
params_left = get_binaryop_deep_params(node.left, params)
140141

@@ -213,8 +214,10 @@ def is_repair(expr):
213214
:return:
214215
"""
215216
is_re = False # 是否修复，默认值是未修复
216-
if expr == 'escapeshellcmd':
217-
is_re = True
217+
for repair in repairs:
218+
if expr == repair:
219+
is_re = True
220+
return is_re
218221
return is_re
219222

220223

@@ -661,16 +664,19 @@ def analysis(nodes, vul_function, back_node, vul_lineo, function_params=None):
661664
back_node.append(node)
662665

663666

664-
def scan_parser(code_content, sensitive_func, vul_lineno):
667+
def scan_parser(code_content, sensitive_func, vul_lineno, repair):
665668
"""
666669
开始检测函数
667670
:param code_content: 要检测的文件内容
668671
:param sensitive_func: 要检测的敏感函数,传入的为函数列表
669672
:param vul_lineno: 漏洞函数所在行号
673+
:param repair: 对应漏洞的修复函数列表
670674
:return:
671675
"""
672676
try:
677+
global repairs
673678
global scan_results
679+
repairs = repair
674680
scan_results = []
675681
parser = make_parser()
676682
all_nodes = parser.parse(code_content, debug=False, lexer=lexer.clone(), tracking=with_line)

‎docs/index.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,8 @@
4848
| 290 | LB | Logic Bug | 逻辑错误 |
4949
| 320 | VO | Variables Override | 变量覆盖漏洞 |
5050
| 350 | WF | Weak Function | 不安全的函数 |
51-
| 355 | WE |Weak Encryption | 不安全的加密 |
51+
| 355 | WE | Weak Encryption | 不安全的加密 |
52+
| 360 | WS | WebShell | WebShell |
5253
| 970 | AV | Android Vulnerabilities | Android漏洞 |
5354
| 980 | IV | iOS Vulnerabilities | iOS漏洞 |
5455
| 999 | IC | Insecure Components| 引用了存在漏洞的三方组件(Maven/Pods/PIP/NPM) |

‎docs/labels.md

+1
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
| 320 | VO | Variables Override | 变量覆盖漏洞 |
2727
| 350 | WF | Weak Function | 不安全的函数 |
2828
| 355 | WE |Weak Encryption | 不安全的加密 |
29+
| 360 | WS | WebShell | WebShell |
2930
| 970 | AV | Android Vulnerabilities | Android漏洞 |
3031
| 980 | IV | iOS Vulnerabilities | iOS漏洞 |
3132
| 999 | IC | Insecure Components| 引用了存在漏洞的三方组件(Maven/Pods/PIP/NPM) |

‎rules/CVI-120001.xml

+9-11
Original file line numberDiff line numberDiff line change
@@ -7,20 +7,19 @@
77
<level value="6"/>
88
<test>
99
<case assert="true"><![CDATA[
10-
function curl($url){
11-
$ch = curl_init();
12-
curl_setopt($ch, CURLOPT_URL, $url);
13-
curl_setopt($ch, CURLOPT_HEADER, 0);
14-
curl_exec($ch);
15-
curl_close($ch);
16-
}
17-
$url = $_GET['url'];
18-
curl($url);
10+
function curl($url){
11+
$ch = curl_init();
12+
curl_setopt($ch, CURLOPT_URL, $url);
13+
curl_setopt($ch, CURLOPT_HEADER, 0);
14+
curl_exec($ch);
15+
curl_close($ch);
16+
}
17+
$url = $_GET['url'];
18+
curl($url);
1919
]]></case>
2020
</test>
2121
<solution>
2222
## 安全风险
23-
2423
SSRF漏洞(Server-Side Request Forgery)
2524

2625
### 形成原理
@@ -42,7 +41,6 @@
4241
curl_exec($ch);
4342
curl_close($ch);
4443
}
45-
4644
$url = $_GET['url'];
4745
curl($url);
4846
```

‎rules/CVI-120002.xml

+4-4
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,12 @@
66
<level value="7"/>
77
<test>
88
<case assert="true"><![CDATA[
9-
$url = $_GET['url'];
10-
echo file_get_contents($url);
9+
$url = $_GET['url'];
10+
echo file_get_contents($url);
1111
]]></case>
1212
<case assert="false"><![CDATA[
13-
$url = "http://www.example.com";
14-
echo file_get_contents($url);
13+
$url = "http://www.example.com";
14+
echo file_get_contents($url);
1515
]]></case>
1616
</test>
1717
<solution>

‎rules/CVI-120003.xml

+1-2
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
<name value="get_headers导致的SSRF"/>
44
<language value="php"/>
55
<match mode="function-param-controllable"><![CDATA[get_headers]]></match>
6-
<repair block="in-function-up"><![CDATA[in_array\s*\(\s*{{PARAM}}\s*,|preg_match(?:_all)?\s*\(\s*(?:.+?)\s*,\s*{{PARAM}}\s*[,\)]]]></repair>
76
<level value="7"/>
87
<test>
98
<case assert="true"><![CDATA[
@@ -41,5 +40,5 @@
4140
```
4241
</solution>
4342
<status value="on"/>
44-
<author name="Lightless" email="[email protected]"/>
43+
<author name="Lightless" email="[email protected]"/>
4544
</cobra>

‎rules/CVI-120004.xml

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<cobra document="https://github.com/wufeifei/cobra">
3+
<name value="fsockopen造成的SSRF"/>
4+
<language value="php"/>
5+
<match mode="function-param-controllable"><![CDATA[fsockopen]]></match>
6+
<level value="7"/>
7+
<test>
8+
<case assert="true"><![CDATA[
9+
$host = $_GET['host'];
10+
$fp = fsockopen($host, intval($port), $errno, $errstr, 30);
11+
]]></case>
12+
</test>
13+
<solution>
14+
## 安全风险
15+
SSRF漏洞(Server-Side Request Forgery)
16+
17+
### 形成原理
18+
SSRF形成的原因大都是由于服务端提供了从其他服务器应用获取数据的功能且没有对目标地址做过滤与限制。
19+
20+
### 风险
21+
1、攻击者可以对外网、服务器所在内网、本地进行端口扫描，获取服务的banner信息。
22+
2、攻击运行在内网或本地的应用程序。
23+
3、对内网web应用进行指纹识别。
24+
4、攻击内外网的web应用。
25+
5、利用file协议读取本地文件等。
26+
27+
## 修复方案
28+
1. 限制协议为HTTP、HTTPS
29+
2. 限制请求域名白名单
30+
3. 禁止30x跳转
31+
32+
</solution>
33+
<status value="on"/>
34+
<author name="JoyChou" email="[email protected]"/>
35+
</cobra>

‎rules/CVI-140001.xml

-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
<?xml version="1.0" encoding="UTF-8"?>
2-
32
<cobra document="https://github.com/wufeifei/cobra">
43
<name value="文本框反射型XSS"/>
54
<language value="jsp"/>

‎rules/CVI-140002.xml

+1-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
2-
32
<cobra document="https://github.com/wufeifei/cobra">
4-
<name value="输出入参"/>
3+
<name value="输出入参可能导致XSS"/>
54
<language value="java"/>
65
<match mode="regex-only-match"><![CDATA[out\.println\s*\(\s*request\.get(Parameter|QueryString)\s*\(\s*\"]]></match>
76
<level value="4"/>

‎rules/CVI-140003.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<name value="直接输出入参可能导致XSS"/>
44
<language value="php"/>
55
<match mode="function-param-controllable"><![CDATA[(echo|print|print_r|exit|die|printf|vprintf|trigger_error|user_error|odbc_result_all|ovrimos_result_all|ifx_htmltbl_result)]]></match>
6-
<repair block="in-function"><![CDATA[(htmlspecialchars\s*\(\s*{{PARAM}}\s*)]]></repair>
6+
<repair block="in-function"><![CDATA[(htmlspecialchars]]></repair>
77
<level value="4"/>
88
<test>
99
<case assert="true"><![CDATA[print_r ($_GET['test']);]]></case>

‎rules/CVI-140004.xml

-22
This file was deleted.

‎rules/CVI-160001.xml

-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
<?xml version="1.0" encoding="UTF-8"?>
2-
32
<cobra document="https://github.com/wufeifei/cobra">
43
<name value="拼接SQL注入"/>
54
<language value="java"/>

‎rules/CVI-160002.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
<case assert="false"><![CDATA[$query = "SELECT id FROM products LIMIT 20 ;";]]></case>
1010
<case assert="true"><![CDATA[$s = "select" + $v + "from " + $tb + "where id = " + $id;]]></case>
1111
<case assert="true"><![CDATA[
12-
$query = "SELECT id, name, inserted, size FROM products
12+
$query = "SELECT id, name, inserted, size FROM products
1313
WHERE size = '$size'
1414
ORDER BY $order
1515
LIMIT $limit, $offset;";

‎rules/CVI-160003.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<name value="MySQL Execute Functions可能导致SQL注入"/>
44
<language value="php"/>
55
<match mode="function-param-controllable"><![CDATA[(mysql_query|mysql_db_query)]]></match>
6-
<repair block="in-function"><![CDATA[(?:mysql_real_escape_string|addslashes)\s*\(\s*{{PARAM}}\s*[\),]]]></repair>
6+
<repair block="in-function"><![CDATA[(mysql_real_escape_string|addslashes)]]></repair>
77
<level value="8"/>
88
<test>
99
<case assert="true"><![CDATA[

‎rules/CVI-160004.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<cobra document="https://github.com/wufeifei/cobra">
33
<name value="SQL Execute Functions可能导致SQL注入"/>
44
<language value="php"/>
5-
<match mode="function-param-controllable"><![CDATA[(mysqli_query|pg_execute|pg_insert|pg_query|pg_select|pg_update|sqlite_query|msql_query|mssql_query|odbc_exec|fbsql_query|sybase_query|ibase_query|dbx_query|ingres_query|ifx_query|oci_parse|sqlsrv_query|maxdb_query|db2_exec)\s?\(]]></match>
5+
<match mode="function-param-controllable"><![CDATA[(mysqli_query|pg_execute|pg_insert|pg_query|pg_select|pg_update|sqlite_query|msql_query|mssql_query|odbc_exec|fbsql_query|sybase_query|ibase_query|dbx_query|ingres_query|ifx_query|oci_parse|sqlsrv_query|maxdb_query|db2_exec)]]></match>
66
<level value="8"/>
77
<test>
88
<case assert="true"><![CDATA[

‎rules/CVI-165001.xml

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<cobra document="https://github.com/wufeifei/cobra">
3+
<name value="LDAP注入"/>
4+
<language value="php"/>
5+
<match mode="function-param-controllable"><![CDATA[(ldap_add|ldap_delete|ldap_list|ldap_read|ldap_search|ldap_bind)]]></match>
6+
<repair block="in-function-up"><![CDATA[ldap_escape\s*\(\s*.+?\s*,\s*.+?\s*,\s*LDAP_ESCAPE_FILTER\s*\)]]></repair>
7+
<level value="5"/>
8+
<test>
9+
<case assert="true"><![CDATA[
10+
$surname=$_GET['surname'];
11+
$filter = "(sn=" . $surname . ")";
12+
$sr=ldap_search($ds, "o=My Company, c=US", $filter);
13+
$info = ldap_get_entries($ds, $sr);
14+
]]></case>
15+
</test>
16+
<solution>
17+
## 安全风险
18+
19+
LDAP Injection
20+
允许进行LDAP查询 + 输入未进行过滤 ---> LDAP注入
21+
这种威胁可以让攻击者能够从LADP树中提取到很多很重要的信息
22+
23+
## 修复方案
24+
对用户输入数据中包含的”语言本身的保留字符”进行转义(例如可以使用`ldap_escape`)
25+
26+
</solution>
27+
<status value="on"/>
28+
<author name="Feei" email="[email protected]"/>
29+
</cobra>
30+

‎rules/CVI-167001.xml

+1-8
Original file line numberDiff line numberDiff line change
@@ -7,17 +7,13 @@
77
<level value="5"/>
88
<test>
99
<case assert="true"><![CDATA[
10-
<?php
1110
$xml = $_POST['xml'];
1211
$data = simplexml_load_string($xml);
13-
?>
1412
]]></case>
1513
<case assert="false"><![CDATA[
16-
<?php
1714
$xml = $_POST['xml'];
1815
libxml_disable_entity_loader(true);
1916
$data = simplexml_load_string($xml);
20-
?>
2117
]]></case>
2218
</test>
2319
<solution>
@@ -42,18 +38,15 @@
4238

4339
## 举例
4440
```php
45-
<?php
4641
$xml = $_POST['xml'];
4742
$data = simplexml_load_string($xml);
48-
?>
4943
```
5044
修改后代码
5145
```php
52-
<?php
5346
$xml = $_POST['xml'];
5447
libxml_disable_entity_loader(true);
5548
$data = simplexml_load_string($xml);
56-
?>
49+
```
5750
</solution>
5851
<status value="on"/>
5952
<author name="Lightless" email="[email protected] "/>

‎rules/CVI-180001.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<cobra document="https://github.com/wufeifei/cobra">
33
<name value="远程代码执行"/>
44
<language value="php"/>
5-
<match mode="function-param-controllable"><![CDATA[(array_map|create_function|call_user_func|call_user_func_array|assert|eval|dl|register_tick_function|register_shutdown_function|preg_replace)]]></match>
5+
<match mode="function-param-controllable"><![CDATA[(array_map|create_function|call_user_func|call_user_func_array|assert|eval|dl|register_tick_function|register_shutdown_function|array_filter|array_reduce|array_diff_ukey|array_udiff|array_walk|array_walk_recursive|uasort|uksort|usort)]]></match>
66
<level value="10"/>
77
<test>
88
<case assert="true"><![CDATA[array_map($_GET['pass'],$array);]]></case>

0 commit comments

Comments
 (0)