supplier-meesho.webflow 1.0.0

package/MobSF/mobsf/StaticAnalyzer/views/ios/app_transport_security.py

@@ -0,0 +1,222 @@
+import logging
+
+
+logger = logging.getLogger(__name__)
+
+
+def check_transport_security(p_list):
+    """Check info.plist for insecure connection configurations."""
+    ats = []
+    if 'NSAppTransportSecurity' in p_list:
+        ats_dict = p_list['NSAppTransportSecurity']
+        if ats_dict and ats_dict.get('NSAllowsArbitraryLoads'):
+            ats.append({
+                'issue': ('App Transport Security '
+                          'AllowsArbitraryLoads is allowed'),
+                'status': 'insecure',
+                'description': (
+                    'App Transport Security restrictions are disabled '
+                    'for all network connections. Disabling ATS means that '
+                    'unsecured HTTP connections are allowed. HTTPS '
+                    'connections are also allowed, and are still subject '
+                    'to default server trust evaluation. However, '
+                    'extended security checks like requiring a minimum '
+                    'Transport Layer Security (TLS) protocol version—are '
+                    'disabled. This setting is not applicable to domains '
+                    'listed in NSExceptionDomains.'),
+            })
+        if ats_dict and ats_dict.get('NSAllowsArbitraryLoadsForMedia'):
+            ats.append({
+                'issue': 'Insecure media load is allowed',
+                'status': 'insecure',
+                'description': (
+                    'App Transport Security restrictions are disabled for '
+                    'media loaded using the AVFoundation framework, '
+                    'without affecting your URLSession connections. '
+                    'This setting is not applicable to domains '
+                    'listed in NSExceptionDomains.'),
+            })
+        if ats_dict and ats_dict.get('NSAllowsArbitraryLoadsInWebContent'):
+            ats.append({
+                'issue': 'Insecure WebView load is allowed',
+                'status': 'insecure',
+                'description': (
+                    'App Transport Security restrictions are disabled for '
+                    'requests made from WebViews without affecting your '
+                    'URLSession connections. This setting is not applicable '
+                    'to domains listed in NSExceptionDomains.'),
+            })
+        if ats_dict and ats_dict.get('NSAllowsLocalNetworking'):
+            ats.append({
+                'issue': 'Insecure local networking is allowed',
+                'status': 'insecure',
+                'description': (
+                    'App Transport Security restrictions are disabled for '
+                    'requests made from local networking '
+                    'without affecting your '
+                    'URLSession connections. This setting is not applicable '
+                    'to domains listed in NSExceptionDomains.'),
+            })
+
+        # NS Domain Exceptions
+        if ats_dict and ats_dict.get('NSExceptionDomains'):
+            exception_domains = ats_dict.get('NSExceptionDomains')
+            ats.append({
+                'issue': 'NSExceptionDomains',
+                'status': 'info',
+                'description': ', '.join(exception_domains.keys()),
+            })
+            for domain, config in exception_domains.items():
+                if not isinstance(config, dict):
+                    continue
+                old_exp = 'NSTemporaryExceptionAllowsInsecureHTTPLoads'
+                old_exp2 = 'NSThirdPartyExceptionAllowsInsecureHTTPLoads'
+                if (config.get('NSExceptionAllowsInsecureHTTPLoads', False)
+                        or config.get(old_exp, False)
+                        or config.get(old_exp2, False)):
+                    findings = {
+                        'issue': ('Insecure communication'
+                                  ' to {} is allowed'.format(domain)),
+                        'status': 'insecure',
+                        'description': (
+                            'NSExceptionAllowsInsecureHTTPLoads allows '
+                            'insecure HTTP loads to {}, '
+                            'or to be able to loosen the '
+                            'server trust evaluation '
+                            'requirements for HTTPS '
+                            'connections to the domain.'.format(domain)
+                        ),
+                    }
+                    ats.append(findings)
+
+                if config.get('NSIncludesSubdomains', False):
+                    findings = {
+                        'issue': ('NSIncludesSubdomains set to TRUE'
+                                  ' for {}'.format(domain)),
+                        'status': 'insecure',
+                        'description': (
+                            'NSIncludesSubdomains applies the ATS exceptions '
+                            'for the given domain to all '
+                            'subdomains as well. '
+                            'For example, the ATS exceptions in the '
+                            'domain exception dictionary apply to {}, '
+                            'as well as math.{}, history.{}, and so on. '
+                            'Otherwise, if the value is NO, the exceptions '
+                            'apply only to '
+                            '{}.'.format(domain, domain, domain, domain)
+                        ),
+                    }
+                    ats.append(findings)
+                old_tls = 'NSTemporaryExceptionMinimumTLSVersion'
+                inc_min_tls = (config.get('NSExceptionMinimumTLSVersion', None)
+                               or config.get(old_tls, None))
+                if inc_min_tls in ['TLSv1.0', 'TLSv1.1']:
+                    findings = {
+                        'issue': ('NSExceptionMinimumTLSVersion set to {}'
+                                  ' on {}'.format(inc_min_tls, domain)),
+                        'status': 'insecure',
+                        'description': (
+                            'The minimum Transport Layer '
+                            'Security (TLS) version '
+                            'for network connections sent to {} '
+                            'is set to {}. This version is deemed '
+                            'to be insecure'.format(domain, inc_min_tls)
+                        ),
+                    }
+                    ats.append(findings)
+
+                elif inc_min_tls == 'TLSv1.2':
+                    findings = {
+                        'issue': ('NSExceptionMinimumTLSVersion set to {}'
+                                  ' on {}'.format(inc_min_tls, domain)),
+                        'status': 'warning',
+                        'description': (
+                            'The minimum Transport Layer '
+                            'Security (TLS) version '
+                            'for network connections sent to {} '
+                            'is set to {}. '
+                            'This version is vulnerable to '
+                            'attacks such as POODLE, FREAK, '
+                            'or CurveSwap etc.'.format(domain, inc_min_tls)
+                        ),
+                    }
+                    ats.append(findings)
+
+                elif inc_min_tls == 'TLSv1.3':
+                    findings = {
+                        'issue': ('NSExceptionMinimumTLSVersion set to {}'
+                                  ' on {}'.format(inc_min_tls, domain)),
+                        'status': 'secure',
+                        'description': (
+                            'The minimum Transport Layer '
+                            'Security (TLS) version '
+                            'for network connections sent to {} '
+                            'is set to {}.'.format(domain, inc_min_tls)
+                        ),
+                    }
+                    ats.append(findings)
+
+                elif inc_min_tls is None:
+                    pass
+
+                else:
+                    findings = {
+                        'issue': ('NSExceptionMinimumTLSVersion set to {}'
+                                  ' on {}'.format(inc_min_tls, domain)),
+                        'status': 'info',
+                        'description': (
+                            'The minimum Transport Layer '
+                            'Security (TLS) version '
+                            'for network connections sent to {} '
+                            'is set to {}.'.format(domain, inc_min_tls)
+                        ),
+                    }
+                    ats.append(findings)
+                old_fwd = 'NSTemporaryExceptionRequiresForwardSecrecy'
+                old_fwd2 = 'NSThirdPartyExceptionRequiresForwardSecrecy'
+                if not (config.get('NSExceptionRequiresForwardSecrecy', False)
+                        or config.get(old_fwd, False)
+                        or config.get(old_fwd2, False)):
+                    findings = {
+                        'issue': ('NSExceptionRequiresForwardSecrecy '
+                                  'set to NO'
+                                  ' for {}'.format(domain)),
+                        'status': 'insecure',
+                        'description': (
+                            'NSExceptionRequiresForwardSecrecy '
+                            'limits the accepted ciphers to '
+                            'those that support perfect '
+                            'forward secrecy (PFS) through the '
+                            'Elliptic Curve Diffie-Hellman '
+                            'Ephemeral (ECDHE) key exchange. '
+                            'Set the value for this key to NO to override '
+                            'the requirement that a server must support '
+                            'PFS for the given domain. This key is optional. '
+                            'The default value is YES, which limits the '
+                            'accepted ciphers to those that support '
+                            'PFS through Elliptic Curve Diffie-Hellman '
+                            'Ephemeral (ECDHE) key exchange.'),
+                    }
+                    ats.append(findings)
+
+                if config.get('NSRequiresCertificateTransparency', False):
+                    findings = {
+                        'issue': ('NSRequiresCertificateTransparency'
+                                  ' set to YES for {}'.format(domain)),
+                        'status': 'secure',
+                        'description': (
+                            'Certificate Transparency (CT) is a protocol '
+                            'that ATS can use to identify '
+                            'mistakenly or maliciously '
+                            'issued X.509 certificates. '
+                            'Set the value for the '
+                            'NSRequiresCertificateTransparency '
+                            'key to YES to require that for a given domain, '
+                            'server certificates are supported by valid, '
+                            'signed CT timestamps from at least '
+                            'two CT logs trusted by Apple. '
+                            'This key is optional. The default value is NO.'),
+                    }
+                    ats.append(findings)
+
+    return ats

package/MobSF/mobsf/StaticAnalyzer/views/ios/appstore.py

@@ -0,0 +1,54 @@
+# -*- coding: utf_8 -*-
+import logging
+
+import requests
+
+from django.conf import settings
+
+from mobsf.MobSF.utils import upstream_proxy
+
+logger = logging.getLogger(__name__)
+
+
+def app_search(app_id):
+    """IOS Get App Details from App Store."""
+    logger.info('Fetching Details from App Store: %s', app_id)
+    lookup_url = settings.ITUNES_URL
+    req_url = '{}?bundleId={}&country={}&entity=software'.format(
+        lookup_url, app_id, 'us')
+    headers = {
+        'User-Agent': ('Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) '
+                       'AppleWebKit/537.36 (KHTML, like Gecko) '
+                       'Chrome/39.0.2171.95 Safari/537.36')}
+    try:
+        det = {}
+        proxies, verify = upstream_proxy('https')
+        req = requests.get(req_url, headers=headers,
+                           proxies=proxies, verify=verify)
+        resp = req.json()
+        if resp['results']:
+            det = resp['results'][0]
+            return {
+                'features': det['features'] or [],
+                'icon': (det['artworkUrl512']
+                         or det['artworkUrl100']
+                         or det['artworkUrl60'] or ''),
+                'developer_id': det['artistId'],
+                'developer': det['artistName'],
+                'developer_url': det['artistViewUrl'],
+                'developer_website': det['sellerUrl'],
+                'supported_devices': det['supportedDevices'],
+                'title': det['trackName'],
+                'app_id': det['bundleId'],
+                'category': det['genres'] or [],
+                'description': det['description'],
+                'price': det['price'],
+                'itunes_url': det['trackViewUrl'],
+                'score': det['averageUserRating'],
+                'error': False,
+            }
+        logger.warning('Unable to get app details.')
+        return {'error': True}
+    except Exception:
+        logger.warning('Unable to get app details')
+        return {'error': True}

package/MobSF/mobsf/StaticAnalyzer/views/ios/binary_analysis.py

@@ -0,0 +1,119 @@
+# -*- coding: utf_8 -*-
+"""Module for iOS IPA Binary Analysis."""
+
+import logging
+from pathlib import Path
+
+from macholib.mach_o import (CPU_TYPE_NAMES, MH_CIGAM_64, MH_MAGIC_64,
+                             get_cpu_subtype)
+from macholib.MachO import MachO
+
+from mobsf.StaticAnalyzer.views.ios.classdump import (
+    get_class_dump,
+)
+from mobsf.StaticAnalyzer.views.ios.macho_analysis import (
+    macho_analysis,
+)
+from mobsf.StaticAnalyzer.views.ios.binary_rule_matcher import (
+    binary_rule_matcher,
+)
+from mobsf.StaticAnalyzer.tools.strings import (
+    strings_util,
+)
+
+logger = logging.getLogger(__name__)
+
+
+def detect_bin_type(libs):
+    """Detect IPA binary type."""
+    if any('libswiftCore.dylib' in itm for itm in libs):
+        return 'Swift'
+    else:
+        return 'Objective C'
+
+
+def strings_on_ipa(bin_path):
+    """Extract Strings from IPA."""
+    try:
+        logger.info('Running strings against the Binary')
+        unique_str = []
+        unique_str = list(set(strings_util(bin_path.as_posix())))
+        return unique_str
+    except Exception:
+        logger.exception('Running strings against the Binary')
+
+
+def get_bin_info(bin_file):
+    """Get Binary Information."""
+    logger.info('Getting Binary Information')
+    m = MachO(bin_file.as_posix())
+    for header in m.headers:
+        if header.MH_MAGIC == MH_MAGIC_64 or header.MH_MAGIC == MH_CIGAM_64:
+            sz = '64-bit'
+        else:
+            sz = '32-bit'
+        arch = CPU_TYPE_NAMES.get(
+            header.header.cputype, header.header.cputype)
+        subarch = get_cpu_subtype(
+            header.header.cputype, header.header.cpusubtype)
+        return {'endian': header.endian,
+                'bit': sz,
+                'arch': arch,
+                'subarch': subarch}
+
+
+def binary_analysis(src, tools_dir, app_dir, executable_name):
+    """Binary Analysis of IPA."""
+    bin_dict = {
+        'checksec': {},
+        'libraries': [],
+        'bin_code_analysis': {},
+        'strings': [],
+        'bin_info': {},
+        'bin_type': '',
+    }
+    try:
+        binary_findings = {}
+        logger.info('Starting Binary Analysis')
+        dirs = Path(src).glob('*')
+        dot_app_dir = ''
+        bin_name = ''
+        for dir_ in dirs:
+            if dir_.suffix == '.app':
+                dot_app_dir = dir_.as_posix()
+                break
+        # Bin Dir - Dir/Payload/x.app/
+        bin_dir = Path(src) / dot_app_dir
+        if not executable_name:
+            bin_name = dot_app_dir.replace('.app', '')
+        else:
+            _bin = bin_dir / executable_name
+            if _bin.exists():
+                bin_name = executable_name
+        # Bin Path - Dir/Payload/x.app/x
+        bin_path = bin_dir / bin_name
+        if not (bin_path.exists() or bin_path.is_file()):
+            logger.warning(
+                'MobSF Cannot find binary in %s', bin_path.as_posix())
+            logger.warning('Skipping Binary analysis')
+        else:
+            macho = macho_analysis(bin_path)
+            bin_info = get_bin_info(bin_path)
+            bin_type = detect_bin_type(macho['libraries'])
+            classdump = get_class_dump(
+                tools_dir,
+                bin_path,
+                app_dir, bin_type)
+            binary_rule_matcher(
+                binary_findings,
+                macho['symbols'], classdump)
+            strings_in_ipa = strings_on_ipa(bin_path)
+            bin_dict['checksec'] = macho['checksec']
+            bin_dict['libraries'] = macho['libraries']
+            bin_dict['bin_code_analysis'] = binary_findings
+            bin_dict['strings'] = strings_in_ipa
+            bin_dict['bin_info'] = bin_info
+            bin_dict['bin_type'] = bin_type
+    except Exception:
+        logger.exception('IPA Binary Analysis')
+    return bin_dict

package/MobSF/mobsf/StaticAnalyzer/views/ios/binary_rule_matcher.py

@@ -0,0 +1,58 @@
+# -*- coding: utf_8 -*-
+"""Binary Analysis - Rule Matcher."""
+import re
+import logging
+
+from mobsf.StaticAnalyzer.views.ios.rules import (
+    ipa_rules,
+)
+
+logger = logging.getLogger(__name__)
+
+
+def get_desc(desc_str, match):
+    """Generate formatted detailed description with matches."""
+    return desc_str.format(
+        b', '.join(list(set(match))).decode('utf-8', 'ignore'))
+
+
+def _add_bfindings(findings, desc, detailed_desc, rule):
+    """Add Binary Analysis Findings."""
+    findings[desc] = {'detailed_desc': detailed_desc,
+                      'severity': rule['severity'],
+                      'cvss': rule['cvss'],
+                      'cwe': rule['cwe'],
+                      'owasp-mobile': rule['owasp-mobile'],
+                      'masvs': rule['masvs']}
+
+
+def binary_rule_matcher(findings, symbols, classdump):
+    """Static Analysis Rule Matcher."""
+    try:
+        data = classdump + '\n'.join(symbols).encode('utf-8')
+        for rule in ipa_rules.IPA_RULES:
+
+            # CASE CHECK
+            if rule['input_case'] == 'lower':
+                tmp_data = data.lower()
+            elif rule['input_case'] == 'upper':
+                tmp_data = data.upper()
+            elif rule['input_case'] == 'exact':
+                tmp_data = data
+
+            # MATCH TYPE
+            if rule['type'] == 'Regex':
+                matched = re.findall(rule['pattern'], tmp_data)
+                if matched:
+                    detailed_desc = get_desc(
+                        rule['detailed_desc'],
+                        matched)
+                    _add_bfindings(findings,
+                                   rule['description'],
+                                   detailed_desc,
+                                   rule)
+
+            else:
+                logger.error('Binary rule Error\n%s', rule)
+    except Exception:
+        logger.exception('Error in Binary Rule Processing')

package/MobSF/mobsf/StaticAnalyzer/views/ios/classdump.py

@@ -0,0 +1,112 @@
+# -*- coding: utf_8 -*-
+"""Handle Classdump for iOS binaries."""
+
+import logging
+import os
+import platform
+import stat
+import subprocess
+
+from django.conf import settings
+
+from mobsf.MobSF.utils import is_file_exists
+
+
+logger = logging.getLogger(__name__)
+
+
+def classdump_mac(clsdmp_bin, tools_dir, ipa_bin):
+    """Run Classdump for Objective-C/Swift."""
+    if clsdmp_bin == 'class-dump-swift':
+        logger.info('Running class-dump-swift against binary')
+        external = settings.CLASSDUMP_SWIFT_BINARY
+    else:
+        logger.info('Running class-dump against binary')
+        external = settings.CLASSDUMP_BINARY
+    if (len(external) > 0
+            and is_file_exists(external)):
+        class_dump_bin = external
+    else:
+        class_dump_bin = os.path.join(
+            tools_dir, clsdmp_bin)
+    # Execute permission check
+    if not os.access(class_dump_bin, os.X_OK):
+        os.chmod(class_dump_bin, stat.S_IEXEC)
+    return subprocess.check_output(
+        [class_dump_bin, ipa_bin],
+        stderr=subprocess.DEVNULL)
+
+
+def classdump_linux(tools_dir, ipa_bin):
+    """Run Classdump on Linux."""
+    try:
+        if (len(settings.JTOOL_BINARY) > 0
+                and is_file_exists(settings.JTOOL_BINARY)):
+            jtool_bin = settings.JTOOL_BINARY
+        else:
+            jtool_bin = os.path.join(tools_dir, 'jtool.ELF64')
+        if not os.access(jtool_bin, os.X_OK):
+            os.chmod(jtool_bin, stat.S_IEXEC)
+        logger.info('Running jtool against the binary for dumping classes')
+        args = [jtool_bin, '-arch', 'arm', '-d', 'objc', '-v', ipa_bin]
+        # timeout to handle possible deadlock from jtool1
+        return subprocess.check_output(
+            args,
+            stderr=subprocess.DEVNULL,
+            timeout=60)
+    except Exception:
+        return b''
+
+
+def get_class_dump(tools_dir, bin_path, app_dir, bin_type):
+    """Running Classdump on binary."""
+    try:
+        bin_path = bin_path.as_posix()
+        cdump = b''
+        logger.info('Dumping classes')
+        if platform.system() == 'Darwin':
+            if bin_type == 'Swift':
+                try:
+                    cdump = classdump_mac(
+                        'class-dump-swift',
+                        tools_dir,
+                        bin_path,
+                    )
+                except Exception:
+                    cdump = classdump_mac(
+                        'class-dump',
+                        tools_dir,
+                        bin_path,
+                    )
+            else:
+                try:
+                    cdump = classdump_mac(
+                        'class-dump',
+                        tools_dir,
+                        bin_path,
+                    )
+                except Exception:
+                    cdump = classdump_mac(
+                        'class-dump-swift',
+                        tools_dir,
+                        bin_path,
+                    )
+            if b'Source: (null)' in cdump:
+                # Run failsafe if classdump failed
+                logger.info('Running fail safe class-dump-swift')
+                cdump = classdump_mac(
+                    'class-dump-swift',
+                    tools_dir,
+                    bin_path,
+                )
+        elif platform.system() == 'Linux':
+            cdump = classdump_linux(tools_dir, bin_path)
+        else:
+            # Platform not supported
+            logger.warning('class-dump is not supported in this platform')
+        with open(os.path.join(app_dir, 'classdump.txt'), 'wb') as flip:
+            flip.write(cdump)
+        return cdump
+    except Exception:
+        logger.error('class-dump/class-dump-swift failed on this binary')
+    return cdump

package/MobSF/mobsf/StaticAnalyzer/views/ios/code_analysis.py

@@ -0,0 +1,103 @@
+import logging
+from pathlib import Path
+from enum import Enum
+
+from django.conf import settings
+
+from mobsf.MalwareAnalyzer.views.MalwareDomainCheck import (
+    MalwareDomainCheck,
+)
+from mobsf.StaticAnalyzer.views.shared_func import (
+    url_n_email_extract,
+)
+from mobsf.StaticAnalyzer.views.sast_engine import scan
+
+logger = logging.getLogger(__name__)
+
+
+class _SourceType(Enum):
+    swift = 'Swift'
+    objc = 'Objective-C'
+    swift_and_objc = 'Swift, Objective-C'
+    nocode = 'No Code'
+
+
+def ios_source_analysis(src):
+    """IOS Objective-C and Swift Code Analysis."""
+    try:
+        logger.info('Starting iOS Source Code and PLIST Analysis')
+        root = Path(settings.BASE_DIR) / 'StaticAnalyzer' / 'views'
+        swift_rules = root / 'ios' / 'rules' / 'swift_rules.yaml'
+        objective_c_rules = root / 'ios' / 'rules' / 'objective_c_rules.yaml'
+        api_rules = root / 'ios' / 'rules' / 'ios_apis.yaml'
+        code_findings = {}
+        api_findings = {}
+        email_n_file = []
+        url_n_file = []
+        url_list = []
+        domains = {}
+        source_type = ''
+        source_types = set()
+
+        # Code and API Analysis
+        code_findings = scan(
+            objective_c_rules.as_posix(),
+            {'.m'},
+            [src],
+            settings.SKIP_CLASS_PATH)
+        if code_findings:
+            source_types.add(_SourceType.objc)
+        code_findings.update(scan(
+            swift_rules.as_posix(),
+            {'.swift'},
+            [src],
+            settings.SKIP_CLASS_PATH))
+        if code_findings:
+            source_types.add(_SourceType.swift)
+        api_findings = scan(
+            api_rules.as_posix(),
+            {'.m', '.swift'},
+            [src],
+            settings.SKIP_CLASS_PATH)
+
+        # Extract URLs and Emails
+        skp = settings.SKIP_CLASS_PATH
+        for pfile in Path(src).rglob('*'):
+            if (
+                (pfile.suffix in ('.m', '.swift')
+                    and any(skip_path in pfile.as_posix()
+                            for skip_path in skp) is False
+                    and pfile.is_dir() is False)
+            ):
+                relative_java_path = pfile.as_posix().replace(src, '')
+                urls, urls_nf, emails_nf = url_n_email_extract(
+                    pfile.read_text('utf-8', 'ignore'), relative_java_path)
+                url_list.extend(urls)
+                url_n_file.extend(urls_nf)
+                email_n_file.extend(emails_nf)
+
+        if not source_types:
+            source_type = _SourceType.nocode.value
+        elif len(source_types) > 1:
+            source_type = _SourceType.swift_and_objc.value
+        else:
+            source_type = source_types.pop().value
+
+        urls_list = list(set(url_list))
+        # Domain Extraction and Malware Check
+        logger.info('Performing Malware Check on extracted Domains')
+        domains = MalwareDomainCheck().scan(urls_list)
+        logger.info('Finished Code Analysis, Email and URL Extraction')
+        code_analysis_dict = {
+            'api': api_findings,
+            'code_anal': code_findings,
+            'urls_list': urls_list,
+            'urlnfile': url_n_file,
+            'domains': domains,
+            'emailnfile': email_n_file,
+            'source_type': source_type,
+        }
+        return code_analysis_dict
+
+    except Exception:
+        logger.exception('iOS Source Code Analysis')