1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
|
// Copyright 2022 Code Intelligence GmbH
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package com.code_intelligence.jazzer.sanitizers;
import static java.util.Collections.unmodifiableSet;
import static java.util.stream.Collectors.toSet;
import com.code_intelligence.jazzer.api.FuzzerSecurityIssueCritical;
import com.code_intelligence.jazzer.api.HookType;
import com.code_intelligence.jazzer.api.Jazzer;
import com.code_intelligence.jazzer.api.MethodHook;
import com.code_intelligence.jazzer.api.MethodHooks;
import java.io.IOException;
import java.io.Reader;
import java.lang.invoke.MethodHandle;
import java.util.Arrays;
import java.util.Set;
import java.util.stream.Stream;
import javax.script.ScriptEngineManager;
/**
* Detects Script Engine injection
*
* <p>
* The hooks in this class attempt to detect user input flowing into
* {@link javax.script.ScriptEngine.eval} that might lead to
* remote code executions depending on the scripting engine's capabilities.
* Before JDK 15, the Nashorn Engine
* was registered by default with ScriptEngineManager under several aliases,
* including "js". Nashorn allows
* access to JVM classes, for example {@link java.lang.Runtime} allowing the
* execution of arbitrary OS commands.
* Several other scripting engines can be embedded to the JVM (they must follow
* the <a href="https://www.jcp.org/en/jsr/detail?id=223">JSR-223</a>
* specification).
* </p>
**/
public final class ScriptEngineInjection {
private static final String ENGINE = "js";
private static final String PAYLOAD = "1+1";
private static char[] guideMarkableReaderTowardsEquality(Reader reader, String target, int id)
throws IOException {
final int size = target.length();
char[] current = new char[size];
int n = 0;
if (!reader.markSupported()) {
throw new IllegalStateException("Reader does not support mark - not possible to fuzz");
}
reader.mark(size);
while (n < size) {
int count = reader.read(current, n, size - n);
if (count < 0)
break;
n += count;
}
reader.reset();
Jazzer.guideTowardsEquality(new String(current), target, id);
return current;
}
@MethodHook(type = HookType.REPLACE, targetClassName = "javax.script.ScriptEngineManager",
targetMethod = "registerEngineName")
public static Object
ensureScriptEngine(MethodHandle method, Object thisObject, Object[] arguments, int hookId)
throws Throwable {
return method.invokeWithArguments(Stream
.concat(Stream.of(thisObject),
Stream.concat(Stream.of((Object) ENGINE),
Arrays.stream(arguments, 1, arguments.length)))
.toArray());
}
@MethodHook(type = HookType.REPLACE, targetClassName = "javax.script.ScriptEngineManager",
targetMethod = "getEngineByName",
targetMethodDescriptor = "(Ljava/lang/String;)Ljavax/script/ScriptEngine;")
public static Object
hookEngineName(MethodHandle method, Object thisObject, Object[] arguments, int hookId)
throws Throwable {
String engine = (String) arguments[0];
Jazzer.guideTowardsEquality(engine, ENGINE, hookId);
return method.invokeWithArguments(
Stream.concat(Stream.of(thisObject), Arrays.stream(arguments)).toArray());
}
@MethodHook(type = HookType.BEFORE, targetClassName = "javax.script.ScriptEngine",
targetMethod = "eval", targetMethodDescriptor = "(Ljava/lang/String;)Ljava/lang/Object;")
@MethodHook(type = HookType.BEFORE, targetClassName = "javax.script.ScriptEngine",
targetMethod = "eval", targetMethodDescriptor = "(Ljava/io/Reader;)Ljava/lang/Object;")
public static void
checkScriptEngineExecute(MethodHandle method, Object thisObject, Object[] arguments, int hookId)
throws Throwable {
String script = null;
if (arguments[0] instanceof String) {
script = (String) arguments[0];
Jazzer.guideTowardsEquality(script, PAYLOAD, hookId);
} else {
script =
new String(guideMarkableReaderTowardsEquality((Reader) arguments[0], PAYLOAD, hookId));
}
if (script.equals(PAYLOAD)) {
Jazzer.reportFindingFromHook(new FuzzerSecurityIssueCritical("Possible script execution"));
}
}
}
|
