contrast-agent 3.8.4

data/lib/contrast/agent/protect/rule/deserialization.rb

@@ -0,0 +1,193 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        # This class handles our implementation of the Untrusted
+        # Deserialization Protect rule.
+        class Deserialization < Contrast::Agent::Protect::Rule::Base
+          # The TeamServer recognized name of this rule
+          NAME = 'untrusted-deserialization'
+
+          # The rule specific reason for raising a security exception.
+          BLOCK_MESSAGE = 'Untrusted Deserialization rule triggered. Deserialization blocked.'
+
+          # Gadgets that map to ERB modules
+          ERB_GADGETS = %w[
+            object:ERB
+          ].cs__freeze
+
+          # Gadgets that map to ActionDispatch modules
+          ACTION_DISPATCH_GADGETS = %w[
+            object:ActionDispatch::Routing::RouteSet::NamedRouteCollection
+          ].cs__freeze
+
+          # Gadgets that map to Arel Modules
+          AREL_GADGETS = %w[
+            string:Arel::Nodes::SqlLiteral
+            object:Arel::Nodes
+          ].cs__freeze
+
+          # Used to indicate to TeamServer the gadget is an ERB module
+          ERB = 'ERB'
+          # Used to indicate to TeamServer the gadget is an ActionDispatch
+          # module
+          DISPATCH = 'ActionDispatch'
+          # Used to indicate to TeamServer the gadget is an Arel module
+          AREL = 'Arel'
+
+          # Return the TeamServer understood id / name of this rule.
+          # @return [String] the TeamServer understood id / name of this rule.
+          def name
+            NAME
+          end
+
+          # Return the specific blocking message for this rule.
+          # @return [String] the reason for the raised security exception.
+          def block_message
+            BLOCK_MESSAGE
+          end
+
+          # Per the spec, this rule applies regardless of input. Only the mode
+          # of the rule and code exclusions apply at this point.
+          # @return [Boolean] should the rule apply to this call.
+          def infilter? _context
+            return false unless enabled?
+            return false if protect_excluded_by_code?
+
+            true
+          end
+
+          # Determine if the input being deserialized is an attack and take
+          # appropriate actions.
+          # @param context [Contrast::Agent::RequestContext] the request
+          #   context in which this attack is occurring.
+          # @param serialized_input [String] the string being deserialized.
+          # @raise [Contrast::SecurityException] if attack detected while in
+          #   block mode.
+          def infilter context, serialized_input
+            return unless infilter?(context)
+
+            gadget = find_gadget(serialized_input)
+            # If there isn't a gadget, this isn't an attack, so we have nothing
+            # to do here. Let the application carry on business as usual.
+            return unless gadget
+
+            ia_result = build_evaluation(serialized_input)
+            kwargs = { GADGET_TYPE: gadget }
+            result = build_attack_with_match(context, ia_result, nil, serialized_input, **kwargs)
+            append_to_activity(context, result)
+
+            raise Contrast::SecurityException.new(self, block_message) if blocked?
+          end
+
+          # Determine if the issued command was called while we're
+          # deserializing. If we are, treat this as an attack.
+          # @param gadget_command [String] the command being executed during
+          #   the deserialization call.
+          # @raise [Contrast::SecurityException] if attack detected while in
+          #   block mode.
+          def check_command_scope gadget_command
+            return unless deserializing?
+
+            context = Contrast::Agent::REQUEST_TRACKER.current
+            kwargs = { COMMAND_SCOPE: true }
+            ia_result = build_evaluation(gadget_command)
+            result = build_attack_with_match(context, ia_result, nil, gadget_command, **kwargs)
+            append_to_activity(context, result)
+            raise Contrast::SecurityException.new(self, BLOCK_MESSAGE) if blocked?
+          end
+
+          # I don't know a better way to do this without introducing another
+          # scope.
+          # The policy files are designed around using the Module names, not
+          # the file names, but stack is built using filenames. These are the
+          # files and methods we patch for this rule.
+          #
+          # There's not real test for this since I can't figure out how to get
+          # a command to execute from within the .load methods
+          # Assuming someone else does, this should just work (tested with
+          # Screener and the combination "%w[erb.rb `result']")
+          DESERIALIZER_STACK = [
+            %w[/psych.rb: `load'],
+            %w[/marshal.rb: `load']
+          ].cs__freeze
+          # We're considered deserializing if the call stack includes a
+          # reference to the file in which a serializer is defined and
+          # the method of that serializer responsible for deserializing.
+          # @return [Boolean] if the caller indicates deserialization.
+          def deserializing?
+            Kernel.caller.product(DESERIALIZER_STACK).find do |(frame, (class_signature_form, method_signature_form))|
+              frame.end_with?(method_signature_form) && frame.include?(class_signature_form)
+            end
+          end
+
+          protected
+
+          # Build the RaspRuleSample for the detected Deserialization attack.
+          # @param context [Contrast::Agent::RequestContext] the request
+          #   context in which this attack is occurring.
+          # @param input_analysis_result [Contrast::Api::Settings::InputAnalysisResult]
+          #   the result of the analysis done by this rule.
+          # @param _candidate_string [nil] unused.
+          # @param kwargs [Hash, nil] Hash of inputs used by this rule to flesh
+          #   out the report to TeamServer in order to provide specific
+          #   information for this rule.
+          # @return [Contrast::Api::Dtm::RaspRuleSample] the information needed
+          #   to render this attack event in TeamServer.
+          def build_sample context, input_analysis_result, _candidate_string, **kwargs
+            sample = build_base_sample(context, input_analysis_result)
+            sample.untrusted_deserialization = Contrast::Api::Dtm::UntrustedDeserializationDetails.new
+
+            deserializer = kwargs[:GADGET_TYPE]
+            sample.untrusted_deserialization.deserializer = Contrast::Utils::StringUtils.protobuf_safe_string(deserializer)
+
+            command = !!kwargs[:COMMAND_SCOPE]
+            sample.untrusted_deserialization.command = command
+
+            sample
+          end
+
+          private
+
+          # Used to name this input since input analysis isn't done for this
+          # rule
+          INPUT_NAME = 'Serialized Gadget'
+          # We know that this attack happened, so the result is always matched
+          # and the level is always critical. Only variable is the Gadget
+          # supplied by the attacker.
+          # @param gadget_string [String] the input to be deserialized in which
+          #   the gadget exists or the command that resulted from deserializing
+          #   an input not detected in the initial infilter.
+          # @return [Contrast::Api::Settings::InputAnalysisResult] the result
+          #   of the analysis done by this rule.
+          def build_evaluation gadget_string
+            ia_result = Contrast::Api::Settings::InputAnalysisResult.new
+            ia_result.rule_id = name
+            ia_result.input_type = :UNKNOWN
+            ia_result.key = INPUT_NAME
+            ia_result.value = Contrast::Utils::StringUtils.protobuf_safe_string(gadget_string)
+            ia_result
+          end
+
+          # Find the gadget within the serialized input, if such a gadget
+          # exists.
+          # @param serialized_input [String] the string being deserialized in
+          #   which the gadget may exist.
+          # @return [String, nil] the gadget, if found.
+          def find_gadget serialized_input
+            if ERB_GADGETS.any? { |gadget| serialized_input.index(gadget) }
+              ERB
+            elsif ACTION_DISPATCH_GADGETS.any? { |gadget| serialized_input.index(gadget) }
+              DISPATCH
+            elsif AREL_GADGETS.any? { |gadget| serialized_input.index(gadget) }
+              AREL
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/rule/http_method_tampering.rb

@@ -0,0 +1,80 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        # The Ruby implementation of the Protect HTTP Method Tampering rule.
+        class HttpMethodTampering < Contrast::Agent::Protect::Rule::BaseService
+          NAME = 'method-tampering'
+          STANDARD_METHODS = %w[GET HEAD POST PUT DELETE CONNECT OPTIONS TRACE PATCH].cs__freeze
+
+          def name
+            NAME
+          end
+
+          def postfilter context
+            return unless enabled? && POSTFILTER_MODES.include?(mode)
+
+            logger.debug("#{ name } postfilter...")
+            return if normal_request?(context)
+
+            # The only way to be here in postfilter with a result is if the rule mode was MONITOR
+            ia_results = gather_ia_results(context)
+            return if ia_results.empty?
+
+            # does the status code start with 4 or 5? Rails responds with 404 (but java is checking 501)
+            response_code = context&.response&.response_code
+            return unless response_code
+
+            method = ia_results.first.value
+            result = if response_code.to_s.start_with?('4', '5')
+                       build_attack_without_match(
+                           context,
+                           nil,
+                           nil,
+                           method: method,
+                           response_code: response_code)
+                     else
+                       build_attack_with_match(
+                           context,
+                           nil,
+                           nil,
+                           nil,
+                           method: method,
+                           response_code: response_code)
+                     end
+            append_to_activity(context, result) if result
+          end
+
+          protected
+
+          def build_sample context, evaluation, _candidate_string, **kwargs
+            sample = build_base_sample(context, evaluation)
+            sample.user_input.value = kwargs[:method]
+
+            sample.method_tampering = Contrast::Api::Dtm::HttpMethodTamperingDetails.new
+            sample.method_tampering.method = Contrast::Utils::StringUtils.protobuf_safe_string(kwargs[:method])
+            code = kwargs[:response_code] || -1
+            sample.method_tampering.response_code = code.to_i
+            sample
+          end
+
+          def build_user_input _evaluation
+            input = Contrast::Api::Dtm::UserInput.new
+            input.input_type = :METHOD
+            input
+          end
+
+          private
+
+          def normal_request? context
+            method = context.request.request_method
+            context.request.static_request? || method.nil? || STANDARD_METHODS.include?(method.upcase)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/rule/no_sqli.rb

@@ -0,0 +1,101 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+# This could be useful for making patterns maybe?
+# https://github.com/cr0hn/nosqlinjection_wordlists
+# https://www.owasp.org/index.php/Testing_for_NoSQL_injection
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        # The Ruby implementation of the Protect NoSQL Injection rule.
+        class NoSqli < Contrast::Agent::Protect::Rule::BaseService
+          NAME = 'nosql-injection'
+          BLOCK_MESSAGE = 'NoSQLi rule triggered. Response blocked.'
+
+          def name
+            NAME
+          end
+
+          def block_message
+            BLOCK_MESSAGE
+          end
+
+          def infilter context, database, query_string
+            return nil unless infilter?(context)
+
+            result = find_attacker(context, query_string, database: database)
+            return nil unless result
+
+            append_to_activity(context, result)
+
+            raise Contrast::SecurityException.new(self, BLOCK_MESSAGE) if blocked?
+          end
+
+          def build_attack_with_match context, input_analysis_result, result, query_string, **kwargs
+            return result if mode == :NO_ACTION || mode == :PERMIT
+
+            attack_string = input_analysis_result.value
+            regexp = Regexp.new(Regexp.escape(attack_string), Regexp::IGNORECASE)
+            return nil unless query_string.match?(regexp)
+
+            scanner = select_scanner
+            ss = StringScanner.new(query_string)
+            length = attack_string.length
+            while ss.scan_until(regexp)
+              # the pos of StringScanner is at the end of the regexp (input string),
+              # we need the beginning
+              idx = ss.pos - attack_string.length
+              last_boundary, boundary = scanner.crosses_boundary(query_string, idx, input_analysis_result.value)
+              next unless last_boundary && boundary
+
+              kwargs[:start_idx] = idx
+              kwargs[:end_idx] = idx + length
+              kwargs[:boundary_overrun_idx] = boundary
+              kwargs[:input_boundary_idx] = last_boundary
+
+              result ||= build_attack_result(context)
+              update_successful_attack_response(context, input_analysis_result, result, query_string)
+              append_sample(context, input_analysis_result, result, query_string, **kwargs)
+            end
+
+            result
+          end
+
+          protected
+
+          def find_attacker context, potential_attack_string, **kwargs
+            if potential_attack_string
+              # We need the query hash to be a JSON string to match on JSON input attacks
+              begin
+                potential_attack_string = JSON.generate(potential_attack_string).to_s
+              rescue JSON::GeneratorError
+                logger.debug("Error in JSON::generate from input #{ potential_attack_string }")
+              end
+            end
+            super(context, potential_attack_string, **kwargs)
+          end
+
+          def build_sample context, input_analysis_result, candidate_string, **kwargs
+            input = input_analysis_result.value
+
+            sample = build_base_sample(context, input_analysis_result)
+            sample.no_sqli = Contrast::Api::Dtm::NoSqlInjectionDetails.new
+            sample.no_sqli.query = Contrast::Utils::StringUtils.protobuf_safe_string(candidate_string)
+            sample.no_sqli.start_idx = sample.no_sqli.query.index(input).to_i
+            sample.no_sqli.boundary_overrun_idx = sample.no_sqli.start_idx + input.length
+            sample.no_sqli.input_boundary_idx = kwargs[:boundary].to_i
+            sample.no_sqli.input_boundary_idx = kwargs[:last_boundary].to_i
+            sample
+          end
+
+          private
+
+          def select_scanner
+            @_select_scanner ||= Contrast::Agent::Protect::Rule::NoSqli::MongoNoSqlScanner.new
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner.rb

@@ -0,0 +1,40 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        class NoSqli
+          # The Mongo specific NoSQL scanner, used by the NoSQLI rule to
+          # determine if a NoSQL attack was performed against a Mongo database.
+          #
+          # @deprecated RUBY-356
+          class MongoNoSqlScanner < Contrast::Agent::Protect::Rule::DefaultScanner
+            # Is the current & next character '//' or are the current and
+            # subsequent characters '<--' ?
+            def start_line_comment? char, index, query
+              if char == Contrast::Utils::ObjectShare::SLASH &&
+                    query[index + 1] == Contrast::Utils::ObjectShare::SLASH
+                return true
+              end
+
+              char == Contrast::Utils::ObjectShare::LEFT_ANGLE &&
+                  query[index + 1] == Contrast::Utils::ObjectShare::DASH &&
+                  query[index + 2] == Contrast::Utils::ObjectShare::DASH
+            end
+
+            def start_block_comment? _char, _index, _query
+              false
+            end
+
+            # Indicates if '""' inside of double quotes is the equivalent of '\"'
+            def double_quote_escape_in_double_quote?
+              true
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/rule/path_traversal.rb

@@ -0,0 +1,143 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/stack_trace_utils'
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        # This class handles our implementation of the Path Traversal
+        # Protect rule.
+        class PathTraversal < Contrast::Agent::Protect::Rule::BaseService
+          include Contrast::Components::Interface
+          access_component :logging, :agent
+
+          NAME = 'path-traversal'
+          SYSTEM_PATHS = %w[
+            /proc/self
+            etc/passwd
+            etc/shadow
+            etc/hosts
+            etc/groups
+            etc/gshadow
+            ntuser.dat
+            /Windows/win.ini
+            /windows/system32/
+            /windows/repair/
+          ].cs__freeze
+
+          KNOWN_SECURITY_BYPASS_MARKERS = ['::$DATA', '::$Index', '', '\x00'].cs__freeze
+
+          def name
+            NAME
+          end
+
+          def infilter context, method, path
+            return unless infilter?(context)
+
+            result = find_attacker(context, path)
+            return unless result
+
+            append_to_activity(context, result)
+            return unless blocked?
+
+            raise Contrast::SecurityException.new(
+                self,
+                "Path Traversal rule triggered. Call to File.#{ method } blocked.")
+          end
+
+          protected
+
+          def find_attacker context, path
+            attack_result = nil
+            attack_result = super(context, path) if infilter?(context)
+            attack_result = check_rep_features(context, path, attack_result)
+            attack_result
+          end
+
+          # Build a subclass of the RaspRuleSample using the query string and the
+          # evaluation
+          def build_sample context, input_analysis_result, path, **_kwargs
+            sample = build_base_sample(context, input_analysis_result)
+            sample.path_traversal = Contrast::Api::Dtm::PathTraversalDetails.new
+            path ||= input_analysis_result.value
+            sample.path_traversal.path = Contrast::Utils::StringUtils.protobuf_safe_string(path)
+            sample
+          end
+
+          private
+
+          # Build a subclass of the RaspRuleSample if the sample matches
+          # TODO: SPEED-? delete me when implemented in Speedracer.
+          #   this implementation duplicates logic that is moving to Speedracer
+          #   the reason it is still here is Speedracer doesn't yet have a method to correlate
+          #   and (update) attack results that are generated because the evaluation results
+          #   from REP, it can only forward the attack results are generated by the agent.
+          def build_rep_sample context, path
+            sample = build_base_sample(context, nil)
+            sample.path_traversal_semantic = Contrast::Api::Dtm::PathTraversalSemanticAnalysisDetails.new
+            path = Contrast::Utils::StringUtils.protobuf_safe_string(path)
+            sample.path_traversal_semantic.path = path
+
+            if custom_code_access_sysfile_enabled? && custom_code_accessing_system_file?(path)
+              sample.path_traversal_semantic.findings << :CUSTOM_CODE_ACCESSING_SYSTEM_FILES
+              return sample
+            end
+
+            if common_file_exploits_enabled? && contains_known_attack_signatures?(path)
+              sample.path_traversal_semantic.findings << :COMMON_FILE_EXPLOITS
+              return sample
+            end
+
+            nil
+          end
+
+          def check_rep_features context, path, attack_result
+            rep_sample = build_rep_sample(context, path)
+            if rep_sample
+              attack_result = build_attack_result(context) if attack_result.nil?
+              build_attack_with_match(context, nil, attack_result, path)
+            end
+            attack_result
+          end
+
+          def custom_code_access_sysfile_enabled?
+            AGENT.report_custom_code_sysfile_access?
+          end
+
+          def custom_code_accessing_system_file? input
+            system_file?(input) && Contrast::Utils::StackTraceUtils.custom_code_context?
+          end
+
+          def system_file? path
+            return false unless path
+
+            SYSTEM_PATHS.any? { |sys_path| sys_path.include?(path) }
+          end
+
+          def common_file_exploits_enabled?
+            false
+          end
+
+          def contains_known_attack_signatures? input
+            utf8 = Contrast::Utils::StringUtils.force_utf8(input)
+            _ = CGI.unescape(utf8)
+            # TODO: RUBY-318 implement REP for known attack signatures
+            #   try:
+            #     realpath = os.path.realpath(unescaped).lower().rstrip('/')
+            #   except ValueError as e:
+            #     return 'embedded null byte' == str(e)
+            #   except TypeError as e:
+            #     return 'NUL' in str(e) or 'null byte' in str(e) or (PY34 and 'embedded NUL character' == str(e))
+            #   except Exception as e:
+            #     return 'null byte' in str(e).lower()
+            #   return return any([bypass_markers.lower().rstrip('/') in realpath for bypass_markers in PathTraversalREPMixin.KNOWN_SECURITY_BYPASS_MARKERS])
+            false
+          end
+        end
+      end
+    end
+  end
+end