Horusec Java

Nesta seção, você vai encontrar mais informações sobre vulnerabilidades que o Horusec encontra em projetos Java.

O que é?

O Horusec-Java é uma ferramenta SAST criado pela equipe do Horusec para fazer a busca de vulnerabilidades em projetos java.

Exemplos de vulnerabilidades

A seguir, você encontra todos os exemplos de vulnerabilidades que o Horussec-Java identifica. O conteúdo foi traduzido, porém também foi mantido em inglês porque é assim que a mensagem aparece no sistema.

Para visualizar vulnerabilidades específicas para projetos mobile, acesse a página Horusec-Mobile (Java e Kotlin) porque são as mesmas com as de Kotlin

File Is World Readable

Indica que o código está vulnerável e que, por isso, qualquer app consegue ler o arquivo.

The file is World Readable. Any App can read from the file. For more information checkout the CWE-276 (https://cwe.mitre.org/data/definitions/276.html) advisory.

Exemplo de código vulnerável:

fos = openFileOutput(filename, MODE_WORLD_READABLE);
fos.write(userInfo.getBytes());

Exemplo de código não vulnerável:

fos = openFileOutput(filename, MODE_PRIVATE);

File Is World Writable

Indica que o código está vulnerável e que, por isso, qualquer app pode escrever no arquivo.

The file is World Writable. Any App can write to the file. For more information checkout the CWE-276 (https://cwe.mitre.org/data/definitions/276.html) advisory.

Exemplo de código vulnerável:

fos = openFileOutput(filename, MODE_WORLD_WRITABLE);
fos.write(userInfo.getBytes());

Exemplo de código não vulnerável:

fos = openFileOutput(filename, MODE_PRIVATE);

No Write External Content

Indica que o código está sensível e qualquer app pode ler ou escrever no armazenamento externo do seu arquivo.

App can read/write to External Storage. Any App can read data written to External Storage. For more information checkout the CWE-276 (https://cwe.mitre.org/data/definitions/276.html) advisory.
This rule raises an issue when the following functions are called:

android.os.Environment.getExternalStorageDirectory

android.os.Environment.getExternalStoragePublicDirectory

android.content.Context.getExternalFilesDir

android.content.Context.getExternalFilesDirs

android.content.Context.getExternalMediaDirs

android.content.Context.getExternalCacheDir

android.content.Context.getExternalCacheDirs

android.content.Context.getObbDir

android.content.Context.getObbDirs

Exemplo de código sensível:

import android.content.Context;
import android.os.Environment;

public class AccessExternalFiles {

    public void accessFiles(Context context) {
        Environment.getExternalStoragePublicDirectory(Environment.DIRECTORY_PICTURES); // Sensitive
        context.getExternalFilesDir(Environment.DIRECTORY_PICTURES); // Sensitive
    }
}

No use IVs weak

Indica que o aplicativo está usando um IVs fraco e que, por isso, está mais suscetível a ataques no seu diretório.

The App may use weak IVs like 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 or 0x01,0x02,0x03,0x04,0x05,0x06,0x07. Not using a random IV makes the resulting ciphertext much more predictable and susceptible to a dictionary attack. For more information checkout the CWE-329 (https://cwe.mitre.org/data/definitions/329.html) advisory.

This App may have root detection capabilities

Indica risco de que a raiz do aplicativo esteja com suas capacidades debilitadas. Isso pode acontecer se existir qualquer um dos códigos a seguir:

.contains("test-keys")

/system/app/Superuser.apk

isDeviceRooted()

/system/bin/failsafe/su

/system/sd/xbin/su

"/system/xbin/which", "su"

RootTools.isAccessGiven()

Set or Read Clipboard data

Indica uma vulnerabilidade encontrada quando você faz um set ou lê o conteúdo do seu clipboard usando qualquer um dos códigos a seguir:

content.ClipboardManager

CLIPBOARD_SERVICE

ClipboardManager

Message Digest

Indica que um algoritmo não é mais seguro por ser muito fácil de criar colisões no seu hash.

The MD5 algorithm and its successor, SHA-1, are no longer considered secure, because it is too easy to create hash collisions with them. That is, it takes too little computational effort to come up with a different input that produces the same MD5 or SHA-1 hash, and using the new, same-hash value gives an attacker the same access as if he had the originally-hashed value. This applies as well to the other Message-Digest algorithms: MD2, MD4, MD6, HAVAL-128, HMAC-MD5, DSA (which uses SHA-1), RIPEMD, RIPEMD-128, RIPEMD-160, HMACRIPEMD160.

Exemplo de código vulnerável:

MyProprietaryMessageDigest extends MessageDigest {
    @Override
    protected byte[] engineDigest() {
        [...]
        //Creativity is a bad idea
        return [...];
    }
}

Exemplo de código não vulnerável:

MessageDigest sha256Digest = MessageDigest.getInstance("SHA256");
sha256Digest.update(password.getBytes());

Overly permissive file permission

Indica que houve um permissionamento excessivo ao arquivo, o que pode deixá-lo vulnerável a ataques.

It is generally a bad practices to set overly permissive file permission such as read+write+exec for all users. If the file affected is a configuration, a binary, a script or sensitive data, it can lead to privilege escalation or information leakage. For more information checkout the CWE-732 (https://cwe.mitre.org/data/definitions/732.html) advisory.

Exemplo de código vulnerável:

Set<PosixFilePermission> perms = new HashSet<>();
perms.add(PosixFilePermission.OWNER_READ);
perms.add(PosixFilePermission.OWNER_WRITE);
perms.add(PosixFilePermission.OWNER_EXECUTE);

perms.add(PosixFilePermission.GROUP_READ);
perms.add(PosixFilePermission.GROUP_WRITE);
perms.add(PosixFilePermission.GROUP_EXECUTE);

perms.add(PosixFilePermission.OTHERS_READ);
perms.add(PosixFilePermission.OTHERS_WRITE);
perms.add(PosixFilePermission.OTHERS_EXECUTE);

Exemplo de código não vulnerável:

Set<PosixFilePermission> perms = new HashSet<>();
perms.add(PosixFilePermission.OWNER_READ);
perms.add(PosixFilePermission.OWNER_WRITE);
perms.add(PosixFilePermission.OWNER_EXECUTE);

perms.add(PosixFilePermission.GROUP_READ);
perms.add(PosixFilePermission.GROUP_WRITE);
perms.add(PosixFilePermission.GROUP_EXECUTE);

DES, DESede, RSA is insecure

Indica que o DES, RSA ou DESede não estão mais seguros.

DES is considered strong ciphers for modern applications. Currently, NIST recommends the usage of AES block ciphers instead of DES. For more information checkout the CWE-326 (https://cwe.mitre.org/data/definitions/326.html) advisory.

Exemplo de código vulnerável:

Cipher c = Cipher.getInstance("DES/ECB/PKCS5Padding");
c.init(Cipher.ENCRYPT_MODE, k, iv);
byte[] cipherText = c.doFinal(plainText);

// =========== //

Cipher c = Cipher.getInstance("DESede/ECB/PKCS5Padding");
c.init(Cipher.ENCRYPT_MODE, k, iv);
byte[] cipherText = c.doFinal(plainText);

// =========== //

Cipher.getInstance("RSA/NONE/NoPadding")

Exemplo de código não vulnerável:

Cipher c = Cipher.getInstance("AES/GCM/NoPadding");
c.init(Cipher.ENCRYPT_MODE, k, iv);
byte[] cipherText = c.doFinal(plainText);

// =========== //

Cipher c = Cipher.getInstance("AES/GCM/NoPadding");
c.init(Cipher.ENCRYPT_MODE, k, iv);
byte[] cipherText = c.doFinal(plainText);

// =========== //

Cipher.getInstance("RSA/ECB/OAEPWithMD5AndMGF1Padding")

Hidden elements

Indica que há elementos ocultos e que, por isso, essas informações podem ser vazadas.

Hidden elements in view can be used to hide data from user. But this data can be leaked. For more information checkout the CWE-919 (https://cwe.mitre.org/data/definitions/919.html) advisory.

Weak block mode for Cryptographic Hash Function

Indica que há um fraco bloqueio para entrada no seu hash.

A weak ECB, (a.k.a ‘block mode’) was found in one of your Ciphers. Always use a strong, high entropy hash, for example the SHA-512 with salt options. For more information check:

CWE-327

__CWE-719__

CWE-326

_CWE-780 _ for deeper details on how to fix it.

Weak Cryptographic Hash Function used

Indica que há uma criptografia fraca CHF que pode aumentar o risco de ataque para vazamento de dados.

Using a weak CHF pose a threat to your application security since it can be vulnerable to a number of attacks that could lead to data leaking, improper access of features and resources of your infrastructure and even rogue sessions. For more information checkout the CWE-327 (https://cwe.mitre.org/data/definitions/327.html) advisory.

Possible File With Vulnerability When Open

Indica que um possível arquivo com vulnerabilidade foi aberto.

The file is World Readable and Writable. Any App can read/write to the file. For more information checkout the CWE-276 (https://cwe.mitre.org/data/definitions/276.html) advisory.

Sensitive Information Not Encrypted

Indica que há informações sensíveis não criptografadas.

App can write to App Directory. Sensitive Information should be encrypted. For more information checkout the CWE-276 (https://cwe.mitre.org/data/definitions/276.html) advisory.

Insecure Random Number Generator

Indica que o app está usando um gerador de números randômicos que não é seguro.

The App uses an insecure Random Number Generator. For more information checkout the CWE-330 (https://cwe.mitre.org/data/definitions/330.html) advisory.

No Default Java Hash

Indica que não há um hash Java default, o que enfraquece a segurança do seu projeto.

This App uses Java Hash Code. It’s a weak hash function and should never be used in Secure Crypto Implementation. For more information checkout the CWE-327 (https://cwe.mitre.org/data/definitions/327.html) advisory.

Layout Params Flag Secure

Indica que há atividades que estão evitando a captura de tela quando vão para background da sua aplicação.

No use SQL Cipher

Indica que não há um SWL Cipher e, por isso, o “segredo” de senhas e demais dados sensíveis podem ser descobertos.

This App uses SQL Cipher. But the secret may be hardcoded. For more information checkout the CWE-312 (https://cwe.mitre.org/data/definitions/312.html) advisory.

Prevent Tap Jacking Attacks

Indica que o app está com fragilidades e que, por isso, pode não prevenir ataques de tapjacking.

This app has capabilities to prevent tapjacking attacks. For more information checkout the CWE-1021 (https://cwe.mitre.org/data/definitions/1021.html) advisory.

Prevent Write sensitive information in tmp file

Indica a necessidade de criar um arquivo para previnir ataques a certos dados sensíveis.

App creates temp file. Sensitive information should never be written into a temp file. For more information checkout the CWE-276 (https://cwe.mitre.org/data/definitions/276.html) advisory.

Get Window Flag Secure

Indica quando as capacidades do app de prevenir capturas de telas que venham do Recent Task History/Now On Tap etc.

Exemplo de código vulnerável:

public void disableScreenCapture() {
    getWindow().setFlags(WindowManager.LayoutParams.FLAG_SECURE,
            WindowManager.LayoutParams.FLAG_SECURE);

}

Loading Native Code

Indica quando há problemas para código nativo ser carregado, em especial no caso de biblioteca compartilhada.

Exemplo de código vulnerável:

System.loadLibrary("library")

Dynamic Class and Dexloading

Indica quando há um Dynamic Class and Dexloading.

Exemplo de código vulnerável:

import dalvik.system.DexClassLoader
or
import java.security.ClassLoader
or
import java.net.URLClassLoader
or
import java.security.SecureClassLoader

Java Crypto import

Indica que há um problema na importação de Java Crypto.

Exemplo de código vulnerável:

import javax.crypto
or
import kalium.crypto
or
import bouncycastle.crypto

Starting Service

Indica que há vulnerabilidades ao iniciar aplicação usando StartingService or BindService.

Exemplo de código vulnerável:

startService(...)
or
bindService(...)

Sending Broadcast

Indica que há problemas no Sending Broadcast.

Exemplo de código vulnerável:

sendBroadcast(...)
or
sendOrderedBroadcast(...)
or
sendStickyBroadcast(...)

Local File I/O Operations

Indica possíveis vulnerabilidades no Local File I/O Operations.

Possíveis vulnerabilidades ao usar:

OpenFileOutput

getSharedPreferences

SharedPreferences.Editor

getCacheDir

getExternalStorageState

openOrCreateDatabase

Inter Process Communication

Indica algum problema interno de processar comunicação.

Inter Process Communication

Possíveis vulnerabilidades ao usar:

IRemoteService

IRemoteService.Stub

IBinder

DefaultHttpClient with default constructor is not compatible with TLS 1.2

Indica a sua implementação precisa ser atualizada para evitar incompatibilidades com TLS 1.2.

Upgrade your implementation to use one of the recommended constructs and configure https.protocols JVM option to include TLSv1.2. Use SystemDefaultHttpClient instead. For more information checkout (https://blogs.oracle.com/java-platform-group/diagnosing-tls,-ssl,-and-https).

Weak SSLContext

Indica que a sua implementação precisa ser atualizada para estar compatível com SSLContext.

Upgrade your implementation to the following, and configure https.protocols JVM option to include TLSv1.2:. Use SSLContext.getInstance(“TLS”). For more information checkout (https://blogs.oracle.com/java-platform-group/diagnosing-tls,-ssl,-and-https)

HostnameVerifier that accept any signed certificates

Indica possíveis problemas com HostNameVerifier para trabalhar vulnerabilidades em alguns hosts.

A HostnameVerifier that accept any host are often use because of certificate reuse on many hosts. As a consequence, this is vulnerable to Man-in-the-middle attacks since the client will trust any certificate. For more information checkout the CWE-295 (https://cwe.mitre.org/data/definitions/295.html) advisory.

URL rewriting method

Indica que o método de reescrita da URL pode ter alguns riscos de segurança.

URL rewriting has significant security risks. Since session ID appears in the URL, it may be easily seen by third parties. Session ID in the URL can be disclosed in many ways. For more information checkout the (https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A2-Broken_Authentication) advisory.

Disabling HTML escaping

Indica que o HTML escaping não está funcionando corretamente e, por isso, pode representar riscos de XSS.

Disabling HTML escaping put the application at risk for Cross-Site Scripting (XSS). For more information checkout the CWE-79 (https://cwe.mitre.org/data/definitions/79.html) advisory.

Overly permissive CORS policy

Indica que o CORS policy está com excesso de permissionamento, o que pode representar riscos de segurança.

A web server defines which other domains are allowed to access its domain using cross-origin requests. However, caution should be taken when defining the header because an overly permissive CORS policy will allow a malicious application to communicate with the victim application in an inappropriate way, leading to spoofing, data theft, relay and other attacks. For more information checkout the (https://fetch.spec.whatwg.org/) advisory.

SQL Injection

Indica que os valores do SQL Injection podem não estar sendo passados com segurança.

The input values included in SQL queries need to be passed in safely. Bind variables in prepared statements can be used to easily mitigate the risk of SQL injection. Alternatively to prepare statements, each parameter can be escaped manually. For more information checkout the CWE-89 (https://cwe.mitre.org/data/definitions/89.html) advisory.

SQL Injection With Turbine

Indica mais uma vulnerabilidade associada a SQL Injection.

The input values included in SQL queries need to be passed in safely. Bind variables in prepared statements can be used to easily mitigate the risk of SQL injection. Turbine API provide a DSL to build query with Java code. Alternatively to prepare statements, each parameter can be escaped manually. For more information checkout the CWE-89 (https://cwe.mitre.org/data/definitions/89.html) advisory.

SQL Injection With Hibernate

Indica mais uma vulnerabilidade associada a SQL Injection.

The input values included in SQL queries need to be passed in safely. Bind variables in prepared statements can be used to easily mitigate the risk of SQL injection. Alternatively to prepare statements, Hibernate Criteria can be used. For more information checkout the CWE-89 (https://cwe.mitre.org/data/definitions/89.html) advisory and checkout the CWE-564 (https://cwe.mitre.org/data/definitions/564.html) advisory.

SQL Injection With JDO

Indica mais uma vulnerabilidade associada a SQL Injection.

The input values included in SQL queries need to be passed in safely. Bind variables in prepared statements can be used to easily mitigate the risk of SQL injection. For more information checkout the CWE-89 (https://cwe.mitre.org/data/definitions/89.html) advisory.

SQL Injection With JPA

Indica mais uma vulnerabilidade associada a SQL Injection.

The input values included in SQL queries need to be passed in safely. Bind variables in prepared statements can be used to easily mitigate the risk of SQL injection. For more information checkout the CWE-89 (https://cwe.mitre.org/data/definitions/89.html) advisory.

SQL Injection Spring JDBC

Indica mais uma vulnerabilidade associada a SQL Injection.

The input values included in SQL queries need to be passed in safely. Bind variables in prepared statements can be used to easily mitigate the risk of SQL injection. For more information checkout the CWE-89 (https://cwe.mitre.org/data/definitions/89.html) advisory.

SQL Injection JDBC

Indica mais uma vulnerabilidade associada a SQL Injection.

The input values included in SQL queries need to be passed in safely. Bind variables in prepared statements can be used to easily mitigate the risk of SQL injection. For more information checkout the CWE-89 (https://cwe.mitre.org/data/definitions/89.html) advisory.

Potential LDAP Injection

Indica uma potencial vulnerabilidade com LDAP.

Just like SQL, all inputs passed to an LDAP query need to be passed in safely. Unfortunately, LDAP doesn’t have prepared statement interfaces like SQL. Therefore, the primary defense against LDAP injection is strong input validation of any untrusted data before including it in an LDAP query. For more information checkout the CWE-90 (https://cwe.mitre.org/data/definitions/90.html) advisory.

Potential external control of configuration

Indica possíveis riscos ao permitir controle externo às configurações do sistema.

Allowing external control of system settings can disrupt service or cause an application to behave in unexpected, and potentially malicious ways. An attacker could cause an error by providing a nonexistent catalog name or connect to an unauthorized portion of the database. For more information checkout the CWE-15 (https://cwe.mitre.org/data/definitions/15.html) advisory.

Bad hexadecimal concatenation

Indica uma má concatenação do hexadecimal.

When converting a byte array containing a hash signature to a human readable string, a conversion mistake can be made if the array is read byte by byte. The following sample illustrates the use of the method Integer.toHexString() which will trim any leading zeroes from each byte of the computed hash value. For more information checkout the CWE-704 (https://cwe.mitre.org/data/definitions/704.html) advisory.

NullCipher is insecure

Indica inseguranças relacionadas à NullCipher.

The NullCipher is rarely used intentionally in production applications. It implements the Cipher interface by returning ciphertext identical to the supplied plaintext. In a few contexts, such as testing, a NullCipher may be appropriate. For more information checkout the CWE-704 (https://cwe.mitre.org/data/definitions/704.html) advisory.

Unsafe hash equals

Indica que o valor secreto do hash pode ser descoberto por invasores devido a problemas em algumas funções.

An attacker might be able to detect the value of the secret hash due to the exposure of comparison timing. When the functions Arrays.equals() or String.equals() are called, they will exit earlier if fewer bytes are matched. For more information checkout the CWE-704 (https://cwe.mitre.org/data/definitions/704.html) advisory.

Unvalidated Redirect

Indica problemas de redirecionamento.

Unvalidated redirects occur when an application redirects a user to a destination URL specified by a user supplied parameter that is not validated. Such vulnerabilities can be used to facilitate phishing attacks. For more information checkout the CWE-601 (https://cwe.mitre.org/data/definitions/601.html) advisory.

@RequestMapping methods should be public

Indica possíveis problemas no método @RequestMapping.

A method with a @RequestMapping annotation part of a class annotated with @Controller (directly or indirectly through a meta annotation - @RestController from Spring Boot is a good example) will be called to handle matching web requests. That will happen even if the method is private, because Spring invokes such methods via reflection, without checking visibility. For more information checkout the OWASAP:A6 (https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A6-Security_Misconfiguration) advisory.

LDAP deserialization should be disabled

Indica que a desirialização do LDAP pode estar desabilitada.

JNDI supports the deserialization of objects from LDAP directories, which is fundamentally insecure and can lead to remote code execution. This rule raises an issue when an LDAP search query is executed with SearchControls configured to allow deserialization. For more information checkout the CWE-502 (https://cwe.mitre.org/data/definitions/502.html) advisory.