Skip to content

Commit 0469eac

Browse files
chanel-ychanel-y
committed
additional weak hash cases, initial queries for cipher mode and KDF alg
1 parent 021cdeb commit 0469eac

4 files changed

Lines changed: 140 additions & 10 deletions

File tree

‎powershell/ql/src/queries/security/cwe-327/ApprovedCipherMode.ql‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
/**
2+
* @name Use of a weak cipher mode
3+
* @description Using weak cipher modes such as ECB or OFB can compromise the security of encrypted data.
4+
* @kind problem
5+
* @problem.severity error
6+
* @security-severity 7.5
7+
* @precision high
8+
* @id powershell/weak-cipher-mode
9+
* @tags security
10+
* external/cwe/cwe-327
11+
*/
12+
13+
import powershell
14+
import semmle.code.powershell.ApiGraphs
15+
import semmle.code.powershell.dataflow.TaintTracking
16+
import semmle.code.powershell.dataflow.DataFlow
17+
18+
class WeakCipherMode extends API::Node {
19+
WeakCipherMode() {
20+
this = API::getTopLevelMember("system").getMember("security").getMember("cryptography").getMember("ciphermode").getMember("cbc")
21+
}
22+
}
23+
24+
module WeakCipherModeConfig implements DataFlow::ConfigSig {
25+
predicate isSource(DataFlow::Node source) {
26+
exists(WeakCipherMode wcm | source = wcm.asSource())
27+
}
28+
29+
predicate isSink(DataFlow::Node sink) { any() }
30+
31+
}
32+
33+
module CommandInjectionFlow = TaintTracking::Global<WeakCipherModeConfig>;
34+
35+
36+
37+
//dataflow from WeakCipherMode to Mode property of System.Security.Cryptography.Aes object!
38+
39+
from DataFlow::Node mode
40+
where mode = API::getTopLevelMember("system")
41+
.getMember("security")
42+
.getMember("cryptography")
43+
.getMember("aes")
44+
.getMember("mode")
45+
.asSink()
46+
// select mode, "mode member of aes"
47+
48+
from API::Node item
49+
select item, "node"
50+
51+
52+
// from API::Node sink
53+
// where sink = API::getTopLevelMember("system").getMember("security").getMember("cryptography").getMember("ciphermode").getMember("cbc")
54+
// select sink, sink.asSource()
55+
56+
// from InvokeEncryptModeArgument a
57+
// select a, "Use of weak cipher mode in encryption."

‎powershell/ql/src/queries/security/cwe-327/ObsoleteKDFAlgorithm.ql‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
/**
2+
* @name Use of obsolete Key Derivation Function (KDF) algorithm
3+
* @description Using obsolete or weak KDF algorithms like PasswordDeriveBytes (PBKDF1)
4+
* instead of secure alternatives like Rfc2898DeriveBytes (PBKDF2) can
5+
* compromise password security.
6+
* @kind problem
7+
* @problem.severity error
8+
* @security-severity 7.5
9+
* @precision high
10+
* @id powershell/obsolete-kdf-algorithm
11+
* @tags security
12+
* external/cwe/cwe-327
13+
* external/cwe/cwe-328
14+
* cryptography
15+
*/
16+
17+
import powershell
18+
19+
import semmle.code.powershell.ApiGraphs
20+
import semmle.code.powershell.dataflow.DataFlow
21+
22+
23+
class CryptDeriveKeyCall extends DataFlow::CallNode {
24+
CryptDeriveKeyCall() {
25+
this = API::getTopLevelMember("system")
26+
.getMember("security")
27+
.getMember("cryptography")
28+
.getMember("passwordderivebytes")
29+
.getMember("cryptderivekey")
30+
.asCall()
31+
or
32+
this = API::getTopLevelMember("system")
33+
.getMember("security")
34+
.getMember("cryptography")
35+
.getMember("rfc2898derivebytes")
36+
.getMember("cryptderivekey")
37+
.asCall()
38+
}
39+
}
40+
41+
// from DataFlow::CallNode cn
42+
// where
43+
// cn instanceof CryptDeriveKeyCall
44+
// select cn, "Use of obsolete Crypto API. Consider using Rfc2898DeriveBytes (PBKDF2) or a more modern alternative like Argon2."
45+
46+
// from DataFlow::CallNode cn
47+
// select cn, "cn"
48+
// from CryptDeriveKeyCall cn
49+
// select cn, "Use of obsolete KDF algorithm PasswordDeriveBytes (PBKDF1). Consider using Rfc2898DeriveBytes (PBKDF2) or a more modern alternative like Argon2."
50+
51+
from DataFlow::CallNode apiNode
52+
where
53+
apiNode = API::getTopLevelMember("system")
54+
.getMember("security")
55+
.getMember("cryptography")
56+
.getMember("passwordderivebytes")
57+
.getMember("cryptderivekey").asCall()
58+
select apiNode, "node"

‎powershell/ql/src/queries/security/cwe-327/WeakHashes.ql‎

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -27,14 +27,9 @@ class WeakHashAlgorithmObjectCreation extends DataFlow::ObjectCreationNode {
2727

2828
class WeakHashAlgorithmObjectCreate extends DataFlow::CallNode {
2929
WeakHashAlgorithmObjectCreate() {
30-
// System.Security.Cryptography.MD5
31-
this = API::getTopLevelMember("system")
32-
.getMember("security")
33-
.getMember("cryptography")
34-
.getMember("md5")
35-
.getMember("create")
36-
.asCall()
37-
}
30+
this = API::getTopLevelMember("system").getMember("security").getMember("cryptography").getMember("md5").getMember("create").asCall() or
31+
this = API::getTopLevelMember("system").getMember("security").getMember("cryptography").getMember("sha1").getMember("create").asCall()
32+
}
3833
}
3934

4035
class ComputeHashSink extends DataFlow::Node {
@@ -47,12 +42,22 @@ class ComputeHashSink extends DataFlow::Node {
4742
cn.getQualifier().getALocalSource() = ocn and
4843
cn.getLowerCaseName() = "computehash" and
4944
cn.getAnArgument() = this
50-
)
45+
)
5146
}
5247
}
5348

49+
class CreateFromNameSink extends DataFlow::CallNode {
50+
CreateFromNameSink(){
51+
this = API::getTopLevelMember("system").getMember("security").getMember("cryptography").getMember("cryptoconfig").getMember("createfromname").asCall() and
52+
this.getAnArgument().asExpr().getValue().asString() = "System.Security.Cryptography.MD5" or
53+
this.getAnArgument().asExpr().getValue().asString() = "MD5"
54+
55+
}
56+
}
57+
5458
from DataFlow::Node sink
5559
where sink instanceof ComputeHashSink or
5660
sink instanceof WeakHashAlgorithmObjectCreation or
57-
sink instanceof WeakHashAlgorithmObjectCreate
61+
sink instanceof WeakHashAlgorithmObjectCreate or
62+
sink instanceof CreateFromNameSink
5863
select sink, "Use of weak cryptographic hash algorithm."

‎powershell/ql/test/query-tests/security/cwe-327/WeakHashes/test.ps1‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,16 @@ $sha1ProviderHash = $sha1Provider.ComputeHash([System.Text.Encoding]::UTF8.GetBy
2020
$sha1Managed = New-Object System.Security.Cryptography.SHA1Managed
2121
$sha1ManagedHash = $sha1Managed.ComputeHash([System.Text.Encoding]::UTF8.GetBytes("data"))
2222

23+
# BAD: HMACMD5 uses weak MD5
24+
$md5hmac = New-Object System.Security.Cryptography.HMACMD5
25+
26+
# BAD: Creating weak hash algorithms from name
27+
$o = [System.Security.Cryptography.CryptoConfig]::CreateFromName("MD5")
28+
$o = [System.Security.Cryptography.CryptoConfig]::CreateFromName("System.Security.Cryptography.MD5")
29+
$o = [System.Security.Cryptography.CryptoConfig]::CreateFromName("SHA1")
30+
$o = [System.Security.Cryptography.CryptoConfig]::CreateFromName("System.Security.Cryptography.SHA1")
31+
32+
2333
# ---------------------------------------------------------
2434
# GOOD: Safe usage of cryptographically secure algorithms
2535
# ---------------------------------------------------------

0 commit comments

Comments
 (0)