antgroup / antgroup/YASA-Engine

分析spring的漏洞场景，未发现结果

Open
#93 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
323
Forks
40
No merged PRs in 30d

Description

描述

在使用靶场：https://github.com/tangxiaofeng7/SecExample 进行测试的时候未检测出结果，根据console中显示的内容明确Source和Sink的配置规则有正确加载。查看callgraph.json ，也是发现有存在对应sink的调用边。

输出情况

./yasa-engine-linux-x64 --sourcePath /opt/app/SecExample/ --checkerPackIds taint-flow-java-default --ruleConfigFile ./example-rule-config/rule_config_java.json --language java --report /tmp/xxx/ --dumpAllCG
main file:/snapshot/YASA-Engine/dist/main.js
Specific checkerPackIds: [ 'taint-flow-java-default' ]
Rule config file:  /root/flaaaaag/pyinstxtractor/semgrep-rules/java/example-rule-config/rule_config_java.json
source path: /opt/app/SecExample/
Report directory: /tmp/xxx/
Analyze Language: java
Analyze Analyer: SpringAnalyzer

=======================  Register rules  =======================
resolveCheckerPath projectRoot : /snapshot/YASA-Engine
Resolved checker path :/snapshot/YASA-Engine/dist/checker/callgraph/callgraph-checker.js
rules-basic-handler [CONFIG] Loaded from: /snapshot/YASA-Engine/dist/config.js
resolveCheckerPath projectRoot : /snapshot/YASA-Engine
Resolved checker path :/snapshot/YASA-Engine/dist/checker/taint/java/java-default-taint-checker.js
rules-basic-handler [CONFIG] Loaded from: /snapshot/YASA-Engine/dist/config.js
resolveCheckerPath projectRoot : /snapshot/YASA-Engine
Resolved checker path :/snapshot/YASA-Engine/dist/checker/sanitizer/sanitizer-checker.js
rules-basic-handler [CONFIG] Loaded from: /snapshot/YASA-Engine/dist/config.js
load checkers: [ 'callgraph', 'taint_flow_java_input', 'sanitizer' ]
================================================================

[YASA] Begin execution
[YASA] Executing preProcess
[YASA][preProcess] Executing parseCode
[YASA][preProcess] Executing preload
[YASA][preProcess] Completed preload, cost: 3ms
[YASA][preProcess] Completed parseCode, cost: 419ms
[YASA][preProcess] Executing processModule
[YASA][preProcess] Completed processModule, cost: 36ms
[YASA] Completed preProcess, cost: 483ms
[YASA] Executing startAnalyze
rules-basic-handler [CONFIG] Loaded from: /snapshot/YASA-Engine/dist/config.js
makeAllCG-start
        makeAllCG-10%
        makeAllCG-30%
        makeAllCG-70%
        makeAllCG-100%
YASA will collect Entrypoint and Source
rules-basic-handler [CONFIG] Loaded from: /snapshot/YASA-Engine/dist/config.js
makeAllCG-start
        makeAllCG-10%
        makeAllCG-30%
        makeAllCG-70%
        makeAllCG-100%
[YASA] Completed startAnalyze, cost: 95ms
[YASA] Executing symbolInterpret
EntryPoint [/src/main/java/com/suyu/secexample/SecexampleApplication.main] is executing
EntryPoint [/src/main/java/com/suyu/secexample/cors/controller/corscontroller.vuln1] is executing
EntryPoint [/src/main/java/com/suyu/secexample/cors/controller/corscontroller.vuln2] is executing
EntryPoint [/src/main/java/com/suyu/secexample/csrf/controller/csrfcontroller.input] is executing
EntryPoint [/src/main/java/com/suyu/secexample/csrf/controller/csrfcontroller.addUser] is executing
EntryPoint [/src/main/java/com/suyu/secexample/fastjson/controller/fastjsoncontroller.input] is executing
EntryPoint [/src/main/java/com/suyu/secexample/fastjson/controller/fastjsoncontroller.fastjson1] is executing
EntryPoint [/src/main/java/com/suyu/secexample/fastjson/controller/fastjsoncontroller.fastjson2] is executing
EntryPoint [/src/main/java/com/suyu/secexample/messageecho/controller/messagecontroller.index] is executing
EntryPoint [/src/main/java/com/suyu/secexample/messageecho/controller/messagecontroller.getcode] is executing
EntryPoint [/src/main/java/com/suyu/secexample/messageecho/controller/messagecontroller.testcode] is executing
EntryPoint [/src/main/java/com/suyu/secexample/rce/controller/rcecontroller.input] is executing
EntryPoint [/src/main/java/com/suyu/secexample/rce/controller/rcecontroller.index] is executing
EntryPoint [/src/main/java/com/suyu/secexample/sql/controller/sqlcontroller.index] is executing
EntryPoint [/src/main/java/com/suyu/secexample/sql/controller/sqlcontroller.listUserByName] is executing
EntryPoint [/src/main/java/com/suyu/secexample/ssrf/controller/ssrfcontroller.index] is executing
EntryPoint [/src/main/java/com/suyu/secexample/xss/controller/xsscontroller.index] is executing
EntryPoint [/src/main/java/com/suyu/secexample/xss/controller/xsscontroller.input] is executing
EntryPoint [/src/main/java/com/suyu/secexample/xss/controller/xsscontroller.outputmessage] is executing
EntryPoint [/src/main/java/com/suyu/secexample/xxe/controller/xxecontroller.input] is executing
EntryPoint [/src/main/java/com/suyu/secexample/SecexampleApplication.main] is executing
EntryPoint [/src/main/java/com/suyu/secexample/cors/controller/corscontroller.vuln1] is executing
EntryPoint [/src/main/java/com/suyu/secexample/cors/controller/corscontroller.vuln2] is executing
EntryPoint [/src/main/java/com/suyu/secexample/csrf/service/UsernameService.addUser] is executing
EntryPoint [/src/main/java/com/suyu/secexample/csrf/controller/csrfcontroller.input] is executing
EntryPoint [/src/main/java/com/suyu/secexample/csrf/controller/csrfcontroller.addUser] is executing
EntryPoint [/src/main/java/com/suyu/secexample/csrf/mapper/UsernameMapper.addUser] is executing
EntryPoint [/src/main/java/com/suyu/secexample/fastjson/controller/fastjsoncontroller.input] is executing
EntryPoint [/src/main/java/com/suyu/secexample/fastjson/controller/fastjsoncontroller.fastjson1] is executing
EntryPoint [/src/main/java/com/suyu/secexample/fastjson/controller/fastjsoncontroller.fastjson2] is executing
EntryPoint [/src/main/java/com/suyu/secexample/messageecho/controller/messagecontroller.index] is executing
EntryPoint [/src/main/java/com/suyu/secexample/messageecho/controller/messagecontroller.getcode] is executing
EntryPoint [/src/main/java/com/suyu/secexample/messageecho/controller/messagecontroller.testcode] is executing
EntryPoint [/src/main/java/com/suyu/secexample/rce/controller/rcecontroller.input] is executing
EntryPoint [/src/main/java/com/suyu/secexample/rce/controller/rcecontroller.index] is executing
EntryPoint [/src/main/java/com/suyu/secexample/sql/service/UserService.listUser] is executing
EntryPoint [/src/main/java/com/suyu/secexample/sql/service/UserService.listUserByName] is executing
EntryPoint [/src/main/java/com/suyu/secexample/sql/controller/sqlcontroller.index] is executing
EntryPoint [/src/main/java/com/suyu/secexample/sql/controller/sqlcontroller.listUserByName] is executing
EntryPoint [/src/main/java/com/suyu/secexample/sql/mapper/UserMapper.listUser] is executing
EntryPoint [/src/main/java/com/suyu/secexample/sql/mapper/UserMapper.listUserByName] is executing
EntryPoint [/src/main/java/com/suyu/secexample/ssrf/controller/ssrfcontroller.index] is executing
EntryPoint [/src/main/java/com/suyu/secexample/ssrf/utils/HttpTool.getHttpReuest] is executing
EntryPoint [/src/main/java/com/suyu/secexample/xss/controller/xsscontroller.index] is executing
EntryPoint [/src/main/java/com/suyu/secexample/xss/controller/xsscontroller.input] is executing
EntryPoint [/src/main/java/com/suyu/secexample/xss/controller/xsscontroller.outputmessage] is executing
EntryPoint [/src/main/java/com/suyu/secexample/xxe/controller/xxecontroller.input] is executing
EntryPoint [/src/main/java/com/suyu/secexample/csrf/service/impl/UsernameServiceImpl.addUser] is executing
EntryPoint [/src/main/java/com/suyu/secexample/sql/service/impl/UserServiceImpl.listUser] is executing
EntryPoint [/src/main/java/com/suyu/secexample/sql/service/impl/UserServiceImpl.listUserByName] is executing
[YASA] Completed symbolInterpret, cost: 108ms
[YASA] Execution completed, cost: 687ms

======================  Analysis Overview  =====================
Language                           : java
Files analyzed                     : 23
Lines of code                      : 541
Total time                         : 687ms
Total instruction                  : 809
Executed instruction               : 809
Execution count                    : 1708
Sources configured                 : 23
Sinks configured                   : 10
Valid entrypoints                  : 50
Avg execution time per instruction : 0.00ms
Avg instruction execution count    : 2.11
Execution time 70%/99%/100%        : 0.00ms/0.00ms/0.00ms
Execution times 70%/99%/100%       : 3.00/6.00/31.00
================================================================


===================  Performance Statistics  ===================
total cost: 687ms
preProcess cost: 483ms
  parseCode cost: 419ms
    parse cost: 414ms
    other cost: 5ms
  preload cost: 3ms
  processModule cost: 36ms
  other cost: 25ms
startAnalyze cost: 95ms
symbolInterpret cost: 108ms
other cost: 1ms
================================================================

Found 3 potential output strategy files
Registered strategy: callgraph from callgraph-output-strategy.js
Registered strategy: interactive from interactive-output-strategy.js
Registered strategy: taintflow from taint-output-strategy.js
Successfully registered 3 output strategies

=======================  outputFindings  =======================
start dump CG to /tmp/xxx/callgraph.json
CG info is write to /tmp/xxx/callgraph.json
================================================================

analyze done

查看 callgraph.json 的调用情况：

"rcecontroller :: index \\n[rcecontroller.java : 24_49]->Runtime.getRuntime": {
      "id": "rcecontroller :: index \\n[rcecontroller.java : 24_49]->Runtime.getRuntime",
      "sourceNodeId": "rcecontroller :: index \\n[rcecontroller.java : 24_49]",
      "targetNodeId": "Runtime.getRuntime",
      "callSite": {
          "loc": {
              "start": {
                  "line": 32,
                  "column": 17
              },
              "end": {
                  "line": 32,
                  "column": 36
              },
              "sourcefile": "/opt/app/SecExample/src/main/java/com/suyu/secexample/rce/controller/rcecontroller.java"
          }
      }
  },
  "rcecontroller :: index \\n[rcecontroller.java : 24_49]->Runtime.getRuntime().exec": {
      "id": "rcecontroller :: index \\n[rcecontroller.java : 24_49]->Runtime.getRuntime().exec",
      "sourceNodeId": "rcecontroller :: index \\n[rcecontroller.java : 24_49]",
      "targetNodeId": "Runtime.getRuntime().exec",
      "callSite": {
          "loc": {
              "start": {
                  "line": 32,
                  "column": 17
              },
              "end": {
                  "line": 32,
                  "column": 50
              },
              "sourcefile": "/opt/app/SecExample/src/main/java/com/suyu/secexample/rce/controller/rcecontroller.java"
          }
      }
  },

而默认的rule_config_java.json中也有Runtime.getRuntime.exec()这个sink

[
  {
    "checkerIds": [
      "taint_flow_java_input",
      "taint_flow_spring_input"
    ],
    "sources": {},
    "sinks": {
      "FuncCallTaintSink": [
        {
          "args": [
            "0"
          ],
          "attribute": "JavaCommandExec",    
          "calleeType": "",
          "fsig": "Runtime.getRuntime().exec"
        },
        {
          "args": [
            "0"
          ],
          "attribute": "JavaCommandExec",
          "calleeType": "",
          "fsig": "SinkUtil.sink"
        },
        {
          "args": [
            "0"
          ],
          "attribute": "JavaCommandExec",
          "calleeType": "Runtime.getRuntime()",
          "fsig": "exec"
        },
        {
          "args": [
            "0"
          ],
          "attribute": "JavaCommandExec",
          "calleeType": "Runtime",
          "fsig": "exec"
        },
....

但是在最后输出的时候却没有任何结果输出

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by rerunning the provided yasa-engine command against SecExample and compare the generated /tmp/xxx report with callgraph.json. Inspect the Runtime.getRuntime().exec sink in example-rule-config/rule_config_java.json and the listed rcecontroller.java call edge. Done means the configured taint flow produces a finding for the demonstrated call, or the reason it does not is documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring, typescript
Domain
devtools, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.