mirror of
https://github.com/github/codeql.git
synced 2025-12-22 03:36:30 +01:00
Java: Use of HTTP/FTP to download/upload Maven artifacts
This adds a security alert for the use of HTTP or FTP to download or upload artifacts using Maven.
This commit is contained in:
Jonathan Leitschuh
@@ -0,0 +1,73 @@
|
||||
<!DOCTYPE qhelp PUBLIC
|
||||
"-//Semmle//qhelp//EN"
|
||||
"qhelp.dtd">
|
||||
<qhelp>
|
||||
<overview>
|
||||
<p>Using an insecure protocol like HTTP or FTP to download your dependencies leaves your Maven build vulnerable to a
|
||||
<a href="https://en.wikipedia.org/wiki/Man-in-the-middle_attack">Man in the Middle (MITM)</a>.
|
||||
This can allow attackers to inject malicious code into the artifacts that you are resolving and infect build artifacts
|
||||
that are being produced. This can be used by attackers to perform a
|
||||
<a href="https://en.wikipedia.org/wiki/Supply_chain_attack">Supply chain attack</a>
|
||||
against your project's users.
|
||||
</p>
|
||||
|
||||
<p>This vulnerability has a
|
||||
<a href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H&version=3.1">
|
||||
CVSS v3.1 base score of 8.1/10
|
||||
</a>.</p>
|
||||
|
||||
</overview>
|
||||
<recommendation>
|
||||
|
||||
<p>Always use HTTPS or SFTP to download artifacts from artifact servers.</p>
|
||||
|
||||
</recommendation>
|
||||
|
||||
<example>
|
||||
|
||||
<p>These examples show examples of locations in Maven POM files where artifact repository upload/download is configured.
|
||||
The first shows the use of HTTP, the second shows the use of HTTPS.
|
||||
</p>
|
||||
|
||||
<sample src="insecure-pom.xml" />
|
||||
|
||||
<sample src="secure-pom.xml" />
|
||||
|
||||
</example>
|
||||
<references>
|
||||
<li>
|
||||
Research:
|
||||
<a href="https://medium.com/bugbountywriteup/want-to-take-over-the-java-ecosystem-all-you-need-is-a-mitm-1fc329d898fb?source=friends_link&sk=3c99970c55a899ad9ef41f126efcde0e">
|
||||
Want to take over the Java ecosystem? All you need is a MITM!
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
Research:
|
||||
<a href="https://max.computer/blog/how-to-take-over-the-computer-of-any-java-or-clojure-or-scala-developer/">
|
||||
How to take over the computer of any Java (or Closure or Scala) Developer.
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
Proof of Concept:
|
||||
<a href="https://github.com/mveytsman/dilettante">
|
||||
mveytsman/dilettante
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
Additional Gradle & Maven plugin:
|
||||
<a href="https://spring.io/blog/2019/06/10/announcing-nohttp">
|
||||
Announcing nohttp
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
Java Ecosystem Announcement:
|
||||
<a href="https://gist.github.com/JLLeitschuh/789e49e3d34092a005031a0a1880af99">
|
||||
HTTP Decommission Artifact Server Announcements
|
||||
</a>
|
||||
</li>
|
||||
|
||||
<!-- LocalWords: CWE maven dependencies artifact
|
||||
-->
|
||||
|
||||
</references>
|
||||
</qhelp>
|
||||
@@ -0,0 +1,38 @@
|
||||
/**
|
||||
* @name Failure to use HTTPS or SFTP URL in Maven artifact upload/download
|
||||
* @description Non-HTTPS connections can be intercepted by third parties.
|
||||
* @kind path-problem
|
||||
* @problem.severity error
|
||||
* @precision very high
|
||||
* @id java/maven/non-https-url
|
||||
* @tags security
|
||||
* external/cwe/cwe-319
|
||||
* external/cwe/cwe-494
|
||||
* external/cwe/cwe-829
|
||||
*/
|
||||
|
||||
import java
|
||||
import semmle.code.xml.MavenPom
|
||||
|
||||
private class DeclaredRepository extends PomElement {
|
||||
DeclaredRepository() {
|
||||
this.getName() = "repository" or
|
||||
this.getName() = "snapshotRepository" or
|
||||
this.getName() = "pluginRepository"
|
||||
}
|
||||
|
||||
string getUrl() {
|
||||
result = getAChild("url").(PomElement).getValue()
|
||||
}
|
||||
|
||||
predicate isInsecureRepositoryUsage() {
|
||||
getUrl().matches("http://%") or
|
||||
getUrl().matches("ftp://%")
|
||||
}
|
||||
}
|
||||
|
||||
from DeclaredRepository repository
|
||||
where repository.isInsecureRepositoryUsage()
|
||||
select
|
||||
repository,
|
||||
"Downloading or uploading artifacts over insecure protocol (eg. http or ftp) to repository " + repository.getUrl()
|
||||
46
java/ql/src/Security/CWE/CWE-829/insecure-pom.xml
Normal file
46
java/ql/src/Security/CWE/CWE-829/insecure-pom.xml
Normal file
@@ -0,0 +1,46 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
<groupId>com.semmle</groupId>
|
||||
<artifactId>parent</artifactId>
|
||||
<version>1.0</version>
|
||||
<packaging>pom</packaging>
|
||||
|
||||
<name>Security Testing</name>
|
||||
<description>An example of insecure download and upload of dependencies</description>
|
||||
|
||||
<distributionManagement>
|
||||
<repository>
|
||||
<id>insecure-releases</id>
|
||||
<name>Insecure Repository Releases</name>
|
||||
<!-- BAD! Use HTTPS -->
|
||||
<url>http://insecure-repository.example</url>
|
||||
</repository>
|
||||
<snapshotRepository>
|
||||
<id>insecure-snapshots</id>
|
||||
<name>Insecure Repository Snapshots</name>
|
||||
<!-- BAD! Use HTTPS -->
|
||||
<url>http://insecure-repository.example</url>
|
||||
</snapshotRepository>
|
||||
</distributionManagement>
|
||||
<repositories>
|
||||
<repository>
|
||||
<id>insecure</id>
|
||||
<name>Insecure Repository</name>
|
||||
<!-- BAD! Use HTTPS -->
|
||||
<url>http://insecure-repository.example</url>
|
||||
</repository>
|
||||
</repositories>
|
||||
<pluginRepositories>
|
||||
<pluginRepository>
|
||||
<id>insecure-plugins</id>
|
||||
<name>Insecure Repository Releases</name>
|
||||
<!-- BAD! Use HTTPS -->
|
||||
<url>http://insecure-repository.example</url>
|
||||
</pluginRepository>
|
||||
</pluginRepositories>
|
||||
</project>
|
||||
46
java/ql/src/Security/CWE/CWE-829/secure-pom.xml
Normal file
46
java/ql/src/Security/CWE/CWE-829/secure-pom.xml
Normal file
@@ -0,0 +1,46 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
<groupId>com.semmle</groupId>
|
||||
<artifactId>parent</artifactId>
|
||||
<version>1.0</version>
|
||||
<packaging>pom</packaging>
|
||||
|
||||
<name>Security Testing</name>
|
||||
<description>An example of secure download and upload of dependencies</description>
|
||||
|
||||
<distributionManagement>
|
||||
<repository>
|
||||
<id>insecure-releases</id>
|
||||
<name>Secure Repository Releases</name>
|
||||
<!-- GOOD! Use HTTPS -->
|
||||
<url>https://insecure-repository.example</url>
|
||||
</repository>
|
||||
<snapshotRepository>
|
||||
<id>insecure-snapshots</id>
|
||||
<name>Secure Repository Snapshots</name>
|
||||
<!-- GOOD! Use HTTPS -->
|
||||
<url>https://insecure-repository.example</url>
|
||||
</snapshotRepository>
|
||||
</distributionManagement>
|
||||
<repositories>
|
||||
<repository>
|
||||
<id>insecure</id>
|
||||
<name>Secure Repository</name>
|
||||
<!-- GOOD! Use HTTPS -->
|
||||
<url>https://insecure-repository.example</url>
|
||||
</repository>
|
||||
</repositories>
|
||||
<pluginRepositories>
|
||||
<pluginRepository>
|
||||
<id>insecure-plugins</id>
|
||||
<name>Secure Repository Releases</name>
|
||||
<!-- GOOD! Use HTTPS -->
|
||||
<url>https://insecure-repository.example</url>
|
||||
</pluginRepository>
|
||||
</pluginRepositories>
|
||||
</project>
|
||||
Reference in New Issue
Block a user