Skip to content

Commit cb8496b

Browse files
chanel-ychanel-y
committed
added queries, tests, docs
1 parent 3101cc8 commit cb8496b

8 files changed

Lines changed: 152 additions & 0 deletions

File tree

‎powershell/ql/src/queries/security/cwe-502/BinaryFormatterDeserialization.qhelp‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
7+
<p>Using BinaryFormatter to deserialize an object from untrusted input may result in security problems, such
8+
as denial of service or remote code execution.</p>
9+
10+
</overview>
11+
<recommendation>
12+
13+
<p>Avoid using BinaryFormatter.</p>
14+
15+
</recommendation>
16+
<example>
17+
18+
<p>In this example, a string is deserialized using a
19+
<code>BinaryFormatter</code>. BinaryFormatter is an easily exploited deserializer.</p>
20+
21+
<sample src="examples/BinaryFormatterDeserialization.ps1" />
22+
23+
</example>
24+
<references>
25+
26+
<li>
27+
Mu&ntilde;oz, Alvaro and Mirosh, Oleksandr:
28+
<a href="https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-Json-Attacks.pdf">JSON Attacks</a>.
29+
</li>
30+
31+
<li>
32+
Microsoft:
33+
<a href="https://learn.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide">Deserialization risks in use of BinaryFormatter and related types</a>.
34+
</li>
35+
36+
</references>
37+
</qhelp>

‎powershell/ql/src/queries/security/cwe-502/BinaryFormatterDeserialization.ql‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/**
2+
* @name Use of Binary Formatter deserialization
3+
* @description Use of Binary Formatter is unsafe
4+
* @kind problem
5+
* @problem.severity error
6+
* @security-severity 8.8
7+
* @precision high
8+
* @id powershell/microsoft/public/binary-formatter-deserialization
9+
* @tags correctness
10+
* security
11+
* external/cwe/cwe-502
12+
*/
13+
14+
import powershell
15+
import semmle.code.powershell.dataflow.DataFlow
16+
import semmle.code.powershell.dataflow.TaintTracking
17+
18+
from DataFlow::ObjectCreationNode source, DataFlow::CallNode cn
19+
where
20+
source.getExprNode().getExpr().(CallExpr).getAnArgument().getValue().asString() = "System.Runtime.Serialization.Formatters.Binary.BinaryFormatter" and
21+
cn.getQualifier().getALocalSource() = source and
22+
cn.getLowerCaseName() = "deserialize"
23+
select cn, "Call to BinaryFormatter.Deserialize"

‎powershell/ql/src/queries/security/cwe-502/UnsafeDeserialization.qhelp‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
7+
<p>Deserializing an object from untrusted input may result in security problems, such
8+
as denial of service or remote code execution.</p>
9+
10+
</overview>
11+
<recommendation>
12+
13+
<p>Avoid using an unsafe deserialization framework.</p>
14+
15+
</recommendation>
16+
<example>
17+
18+
<p>In this example, a string is deserialized using a
19+
<code>BinaryFormatter</code>. BinaryFormatter is an easily exploited deserializer.</p>
20+
21+
<sample src="examples/BinaryFormatterDeserialization.ps1" />
22+
23+
</example>
24+
<references>
25+
26+
<li>
27+
Mu&ntilde;oz, Alvaro and Mirosh, Oleksandr:
28+
<a href="https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-Json-Attacks.pdf">JSON Attacks</a>.
29+
</li>
30+
31+
<li>
32+
Microsoft:
33+
<a href="https://learn.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide">Deserialization risks in use of BinaryFormatter and related types</a>.
34+
</li>
35+
36+
</references>
37+
</qhelp>

‎powershell/ql/src/queries/security/cwe-502/UnsafeDeserialization.ql‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
/**
2+
* @name Unsafe deserializer
3+
* @description Calling an unsafe deserializer with data controlled by an attacker
4+
* can lead to denial of service and other security problems.
5+
* @kind problem
6+
* @problem.severity error
7+
* @security-severity 8.8
8+
* @precision high
9+
* @id powershell/microsoft/public/unsafe-deserialization
10+
* @tags correctness
11+
* security
12+
* external/cwe/cwe-502
13+
*/
14+
15+
import powershell
16+
import semmle.code.powershell.dataflow.flowsources.FlowSources
17+
import semmle.code.powershell.dataflow.DataFlow
18+
import semmle.code.powershell.dataflow.TaintTracking
19+
20+
module DeserializationConfig implements DataFlow::ConfigSig {
21+
predicate isSource(DataFlow::Node source) { source instanceof SourceNode }
22+
23+
predicate isSink(DataFlow::Node sink) {
24+
exists(DataFlow::ObjectCreationNode ocn, DataFlow::CallNode cn |
25+
cn.getQualifier().getALocalSource() = ocn and
26+
ocn.getExprNode().getExpr().(CallExpr).getAnArgument().getValue().asString() = "System.Runtime.Serialization.Formatters.Binary.BinaryFormatter" and
27+
cn.getLowerCaseName() = "deserialize" and
28+
cn.getAnArgument() = sink
29+
)
30+
}
31+
predicate isAdditionalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo){
32+
exists(InvokeMemberExpr ime |
33+
nodeTo.asExpr().getExpr() = ime and
34+
nodeFrom.asExpr().getExpr() = ime.getAnArgument()
35+
)
36+
}
37+
}
38+
39+
module DeserializationFlow = TaintTracking::Global<DeserializationConfig>;
40+
41+
from DataFlow::Node source, DataFlow::Node sink
42+
where DeserializationFlow::flow(source, sink)
43+
select sink, "Unsafe deserializer is used. Make sure the value being deserialized comes from a trusted source."

‎powershell/ql/src/queries/security/cwe-502/examples/BinaryFormatterDeserialization.ps1‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
$untrustedBase64 = Read-Host "Enter user input"
2+
3+
$formatter = New-Object System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
4+
$stream = [System.IO.MemoryStream]::new([Convert]::FromBase64String($untrustedBase64))
5+
6+
$obj = $formatter.Deserialize($stream)

‎powershell/ql/test/query-tests/security/cwe-502/UnsafeDeserialization.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| test.ps1:4:31:4:37 | stream | Unsafe deserializer is used. Make sure the value being deserialized comes from a trusted source. |

‎powershell/ql/test/query-tests/security/cwe-502/UnsafeDeserialization.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
queries/security/cwe-502/UnsafeDeserialization.ql

‎powershell/ql/test/query-tests/security/cwe-502/test.ps1‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
$untrustedBase64 = Read-Host "Enter user input"
2+
$formatter = New-Object System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
3+
$stream = [System.IO.MemoryStream]::new([Convert]::FromBase64String($untrustedBase64))
4+
$obj = $formatter.Deserialize($stream)

0 commit comments

Comments
 (0)