|
| 1 | +/** |
| 2 | + * @name Unsafe usage of v1 version of Azure Storage client-side encryption (CVE-2022-30187). |
| 3 | + * @description Unsafe usage of v1 version of Azure Storage client-side encryption, please refer to http://aka.ms/azstorageclientencryptionblog |
| 4 | + * @kind problem |
| 5 | + * @tags security |
| 6 | + * cryptography |
| 7 | + * external/cwe/cwe-327 |
| 8 | + * @id cs/azure-storage/unsafe-usage-of-client-side-encryption-version |
| 9 | + * @problem.severity error |
| 10 | + * @precision high |
| 11 | + */ |
| 12 | + |
| 13 | +import csharp |
| 14 | + |
| 15 | +/** |
| 16 | + * Holds if `oc` is creating an object of type `c` = `Azure.Storage.ClientSideEncryptionOptions` |
| 17 | + * and `e` is the `version` argument to the constructor |
| 18 | + */ |
| 19 | +predicate isCreatingAzureClientSideEncryptionObject(ObjectCreation oc, Class c, Expr e) { |
| 20 | + exists(Parameter p | p.hasName("version") | |
| 21 | + c.hasQualifiedName("Azure.Storage.ClientSideEncryptionOptions") and |
| 22 | + oc.getTarget() = c.getAConstructor() and |
| 23 | + e = oc.getArgumentForParameter(p) |
| 24 | + ) |
| 25 | +} |
| 26 | + |
| 27 | +/** |
| 28 | + * Holds if `oc` is an object creation of the outdated type `c` = `Microsoft.Azure.Storage.Blob.BlobEncryptionPolicy` |
| 29 | + */ |
| 30 | +predicate isCreatingOutdatedAzureClientSideEncryptionObject(ObjectCreation oc, Class c) { |
| 31 | + c.hasQualifiedName("Microsoft.Azure.Storage.Blob.BlobEncryptionPolicy") and |
| 32 | + oc.getTarget() = c.getAConstructor() |
| 33 | +} |
| 34 | + |
| 35 | +/** |
| 36 | + * Holds if the Azure.Storage assembly for `c` is a version known to support |
| 37 | + * version 2+ for client-side encryption |
| 38 | + */ |
| 39 | +predicate doesAzureStorageAssemblySupportSafeClientSideEncryption(Assembly asm) { |
| 40 | + exists(int versionCompare | |
| 41 | + versionCompare = asm.getVersion().compareTo("12.12.0.0") and |
| 42 | + versionCompare >= 0 |
| 43 | + ) and |
| 44 | + asm.getName() = "Azure.Storage.Common" |
| 45 | +} |
| 46 | + |
| 47 | +/** |
| 48 | + * Holds if the Azure.Storage assembly for `c` is a version known to support |
| 49 | + * version 2+ for client-side encryption and if the argument for the constructor `version` |
| 50 | + * is set to a secure value. |
| 51 | + */ |
| 52 | +predicate isObjectCreationArgumentSafeAndUsingSafeVersionOfAssembly(Expr versionExpr, Assembly asm) { |
| 53 | + // Check if the Azure.Storage assembly version has the fix |
| 54 | + doesAzureStorageAssemblySupportSafeClientSideEncryption(asm) and |
| 55 | + // and that the version argument for the constructor is guaranteed to be Version2 |
| 56 | + isExprAnAccessToSafeClientSideEncryptionVersionValue(versionExpr) |
| 57 | +} |
| 58 | + |
| 59 | +/** |
| 60 | + * Holds if the expression `e` is an access to a safe version of the enum `ClientSideEncryptionVersion` |
| 61 | + * or an equivalent numeric value |
| 62 | + */ |
| 63 | +predicate isExprAnAccessToSafeClientSideEncryptionVersionValue(Expr e) { |
| 64 | + exists(EnumConstant ec | |
| 65 | + ec.hasQualifiedName("Azure.Storage.ClientSideEncryptionVersion.V2_0") and |
| 66 | + ec.getAnAccess() = e |
| 67 | + ) |
| 68 | +} |
| 69 | + |
| 70 | +from Expr e, Class c, Assembly asm |
| 71 | +where |
| 72 | + asm = c.getLocation() and |
| 73 | + ( |
| 74 | + exists(Expr e2 | |
| 75 | + isCreatingAzureClientSideEncryptionObject(e, c, e2) and |
| 76 | + not isObjectCreationArgumentSafeAndUsingSafeVersionOfAssembly(e2, asm) |
| 77 | + ) |
| 78 | + or |
| 79 | + isCreatingOutdatedAzureClientSideEncryptionObject(e, c) |
| 80 | + ) |
| 81 | +select e, "Unsafe usage of v1 version of Azure Storage client-side encryption." |
0 commit comments