mirror of
https://github.com/github/codeql.git
synced 2026-05-01 03:35:13 +02:00
C++ : NULL application name with an unquoted path in call to CreateProcess
Calling a function of the CreatePorcess* family of functions, which may result in a security vulnerability if the path contains spaces.
This commit is contained in:
Raul Garcia
1
.gitignore
vendored
1
.gitignore
vendored
@@ -13,3 +13,4 @@
|
||||
/.vs/ql/v15/Browse.VC.db
|
||||
/.vs/ProjectSettings.json
|
||||
|
||||
/.vs/ql/v15/.suo
|
||||
|
||||
3
cpp/config/suites/security/cwe-428
Normal file
3
cpp/config/suites/security/cwe-428
Normal file
@@ -0,0 +1,3 @@
|
||||
# CWE-428: Unquoted Search Path or Element
|
||||
+ semmlecode-cpp-queries/Security/CWE/CWE-428/UnsafeCreateProcessCall.ql: /CWE/CWE-428
|
||||
@name NULL application name with an unquoted path in call to CreateProcess (CWE-428)
|
||||
@@ -18,6 +18,7 @@
|
||||
@import "cwe-327"
|
||||
@import "cwe-367"
|
||||
@import "cwe-416"
|
||||
@import "cwe-428"
|
||||
@import "cwe-457"
|
||||
@import "cwe-468"
|
||||
@import "cwe-676"
|
||||
|
||||
11
cpp/ql/src/Security/CWE/CWE-428/UnsafeCreateProcessCall.cpp
Normal file
11
cpp/ql/src/Security/CWE/CWE-428/UnsafeCreateProcessCall.cpp
Normal file
@@ -0,0 +1,11 @@
|
||||
STARTUPINFOW si;
|
||||
PROCESS_INFORMATION pi;
|
||||
|
||||
// ...
|
||||
|
||||
CreateProcessW( // BUG
|
||||
NULL, // lpApplicationName
|
||||
(LPWSTR)L"C:\\Program Files\\MyApp", // lpCommandLine
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi);
|
||||
|
||||
// ...
|
||||
@@ -0,0 +1,46 @@
|
||||
<!DOCTYPE qhelp PUBLIC
|
||||
"-//Semmle//qhelp//EN"
|
||||
"qhelp.dtd">
|
||||
<qhelp>
|
||||
|
||||
<overview>
|
||||
<p>This query indicates that there is a call to a function of the <code>CreatePorcess*</code> family of functions, which may result in a security vulnerability if the path contains spaces.</p>
|
||||
</overview>
|
||||
|
||||
<recommendation>
|
||||
<p>Do not use <code>NULL</code> for the <code>lpApplicationName</code> argument to the <code>CreateProcess*</code> function.</p>
|
||||
<p>If you pass <code>NULL</code> for <code>lpApplicationName</code>, use quotation marks around the executable path in <code>lpCommandLine</code>.</p>
|
||||
</recommendation>
|
||||
|
||||
<example>
|
||||
<p>In the following example, <code>CreateProcessW</code> is called with a NULL value for <code>lpApplicationName</code>,
|
||||
and the value for <code>lpCommandLine</code> that represent the application path is not quoted and has spaces int.</p>
|
||||
<p>If an attacker has access to the file system, it is possible to elevate privileges by creating a file such as "C:\Program.exe" that will be executed instead of the intended application.</p>
|
||||
<sample src="UnsafeCreateProcessCall.cpp" />
|
||||
|
||||
<p>To fix this issue, specify a valid string for <code>lpApplicationName</code>, or quote the path for <code>lpCommandLine</code>. For example:</p>
|
||||
<p><code>(LPWSTR)L"\"C:\\Program Files\\MyApp\"", // lpCommandLine</code></p>
|
||||
</example>
|
||||
|
||||
<references>
|
||||
<li>
|
||||
<a href="https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-createprocessa">CreateProcessA function (Microsoft documentation).</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-createprocessw">CreateProcessW function (Microsoft documentation).</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-createprocessasusera">CreateProcessAsUserA function (Microsoft documentation).</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-processthreadsapi-createprocessasuserw">CreateProcessAsUserW function (Microsoft documentation).</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="https://docs.microsoft.com/en-us/windows/desktop/api/winbase/nf-winbase-createprocesswithlogonw">CreateProcessWithLogonW function (Microsoft documentation).</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="https://docs.microsoft.com/en-us/windows/desktop/api/winbase/nf-winbase-createprocesswithtokenw">CreateProcessWithTokenW function (Microsoft documentation).</a>
|
||||
</li>
|
||||
</references>
|
||||
|
||||
</qhelp>
|
||||
135
cpp/ql/src/Security/CWE/CWE-428/UnsafeCreateProcessCall.ql
Normal file
135
cpp/ql/src/Security/CWE/CWE-428/UnsafeCreateProcessCall.ql
Normal file
@@ -0,0 +1,135 @@
|
||||
/**
|
||||
* @name NULL application name with an unquoted path in call to CreateProcess
|
||||
* @description Calling a function of the CreatePorcess* family of functions, which may result in a security vulnerability if the path contains spaces.
|
||||
* @id cpp/unsafe-create-process-call
|
||||
* @kind problem
|
||||
* @problem.severity error
|
||||
* @precision medium
|
||||
* @tags security
|
||||
* external/cwe/cwe-428
|
||||
* external/microsoft/C6277
|
||||
*/
|
||||
|
||||
import cpp
|
||||
import semmle.code.cpp.dataflow.DataFlow
|
||||
import semmle.code.cpp.dataflow.DataFlow2
|
||||
|
||||
/**
|
||||
* A function call to CreateProcess (either wide-char or single byte string versions)
|
||||
*/
|
||||
class CreateProcessFunctionCall extends FunctionCall {
|
||||
CreateProcessFunctionCall() {
|
||||
(
|
||||
this.getTarget().hasGlobalName("CreateProcessA") or
|
||||
this.getTarget().hasGlobalName("CreateProcessW") or
|
||||
this.getTarget().hasGlobalName("CreateProcessWithTokenW") or
|
||||
this.getTarget().hasGlobalName("CreateProcessWithLogonW") or
|
||||
this.getTarget().hasGlobalName("CreateProcessAsUserA") or
|
||||
this.getTarget().hasGlobalName("CreateProcessAsUserW")
|
||||
)
|
||||
}
|
||||
|
||||
int getApplicationNameArgumentId() {
|
||||
if(
|
||||
this.getTarget().hasGlobalName("CreateProcessA") or
|
||||
this.getTarget().hasGlobalName("CreateProcessW")
|
||||
) then ( result = 0 )
|
||||
else if (
|
||||
this.getTarget().hasGlobalName("CreateProcessWithTokenW")
|
||||
) then ( result = 2 )
|
||||
else if (
|
||||
this.getTarget().hasGlobalName("CreateProcessWithLogonW")
|
||||
) then ( result = 4 )
|
||||
else if(
|
||||
this.getTarget().hasGlobalName("CreateProcessAsUserA") or
|
||||
this.getTarget().hasGlobalName("CreateProcessAsUserW")
|
||||
) then ( result = 1 )
|
||||
else (result = -1 )
|
||||
}
|
||||
|
||||
int getCommandLineArgumentId() {
|
||||
if(
|
||||
this.getTarget().hasGlobalName("CreateProcessA") or
|
||||
this.getTarget().hasGlobalName("CreateProcessW")
|
||||
) then ( result = 1 )
|
||||
else if (
|
||||
this.getTarget().hasGlobalName("CreateProcessWithTokenW")
|
||||
) then ( result = 3 )
|
||||
else if (
|
||||
this.getTarget().hasGlobalName("CreateProcessWithLogonW")
|
||||
) then ( result = 5 )
|
||||
else if(
|
||||
this.getTarget().hasGlobalName("CreateProcessAsUserA") or
|
||||
this.getTarget().hasGlobalName("CreateProcessAsUserW")
|
||||
) then ( result = 2 )
|
||||
else (result = -1 )
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Dataflow that detects a call to CreateProcess with a NULL value for lpApplicationName argument
|
||||
*/
|
||||
class NullAppNameCreateProcessFunctionConfiguration extends DataFlow::Configuration {
|
||||
NullAppNameCreateProcessFunctionConfiguration() {
|
||||
this = "NullAppNameCreateProcessFunctionConfiguration"
|
||||
}
|
||||
|
||||
override predicate isSource(DataFlow::Node source) {
|
||||
nullValue(source.asExpr())
|
||||
}
|
||||
|
||||
override predicate isSink(DataFlow::Node sink) {
|
||||
exists(
|
||||
CreateProcessFunctionCall call, Expr val |
|
||||
val = sink.asExpr() |
|
||||
val = call.getArgument(call.getApplicationNameArgumentId())
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Dataflow that detects a call to CreateProcess with an unquoted commandLine argument
|
||||
*/
|
||||
class QuotedCommandInCreateProcessFunctionConfiguration extends DataFlow2::Configuration {
|
||||
QuotedCommandInCreateProcessFunctionConfiguration() {
|
||||
this = "QuotedCommandInCreateProcessFunctionConfiguration"
|
||||
}
|
||||
|
||||
override predicate isSource(DataFlow2::Node source) {
|
||||
exists( string s |
|
||||
s = source.asExpr().getValue().toString()
|
||||
and
|
||||
not isQuotedApplicationNameOnCmd(s)
|
||||
)
|
||||
}
|
||||
|
||||
override predicate isSink(DataFlow2::Node sink) {
|
||||
exists(
|
||||
CreateProcessFunctionCall call, Expr val |
|
||||
val = sink.asExpr() |
|
||||
val = call.getArgument(call.getCommandLineArgumentId())
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
bindingset[s]
|
||||
predicate isQuotedApplicationNameOnCmd(string s){
|
||||
s.regexpMatch("\"([^\"])*\"(\\s|.)*")
|
||||
}
|
||||
|
||||
from CreateProcessFunctionCall call, string msg1, string msg2
|
||||
where
|
||||
exists( Expr source, Expr appName,
|
||||
NullAppNameCreateProcessFunctionConfiguration nullAppConfig |
|
||||
appName = call.getArgument(call.getApplicationNameArgumentId())
|
||||
and nullAppConfig.hasFlow(DataFlow2::exprNode(source), DataFlow2::exprNode(appName))
|
||||
and msg1 = call.toString() + " with lpApplicationName == NULL (" + appName + ")"
|
||||
)
|
||||
and
|
||||
exists( Expr source, Expr cmd,
|
||||
QuotedCommandInCreateProcessFunctionConfiguration quotedConfig |
|
||||
cmd = call.getArgument(call.getCommandLineArgumentId())
|
||||
and quotedConfig.hasFlow(DataFlow2::exprNode(source), DataFlow2::exprNode(cmd))
|
||||
and msg2 = " and with an unquoted lpCommandLine (" + cmd + ") may result in a security vulnerability if the path contains spaces."
|
||||
)
|
||||
select call, msg1 + " " + msg2
|
||||
@@ -0,0 +1,503 @@
|
||||
// semmle-extractor-options: --microsoft
|
||||
#define NULL 0
|
||||
#define FALSE 0
|
||||
#define far
|
||||
#define LOGON_WITH_PROFILE 0x00000001
|
||||
|
||||
typedef char CHAR;
|
||||
typedef unsigned short WCHAR;
|
||||
typedef int BOOL;
|
||||
#define CONST const
|
||||
typedef CHAR *PCHAR, *LPCH, *PCH;
|
||||
typedef CONST CHAR *LPCCH, *PCCH;
|
||||
typedef CHAR *NPSTR, *LPSTR, *PSTR;
|
||||
typedef CONST PSTR *PCZPSTR;
|
||||
typedef CONST CHAR *LPCSTR, *PCSTR;
|
||||
typedef WCHAR *PWCHAR, *LPWCH, *PWCH;
|
||||
typedef CONST WCHAR *LPCWCH, *PCWCH;
|
||||
typedef WCHAR *NWPSTR, *LPWSTR, *PWSTR;
|
||||
typedef PWSTR *PZPWSTR;
|
||||
typedef CONST PWSTR *PCZPWSTR;
|
||||
typedef CONST WCHAR *LPCWSTR, *PCWSTR;
|
||||
typedef unsigned long DWORD;
|
||||
typedef void far *LPVOID;
|
||||
typedef unsigned short WORD;
|
||||
typedef unsigned char BYTE;
|
||||
typedef BYTE far *LPBYTE;
|
||||
typedef void *HANDLE;
|
||||
|
||||
typedef struct _SECURITY_ATTRIBUTES {
|
||||
DWORD nLength;
|
||||
LPVOID lpSecurityDescriptor;
|
||||
BOOL bInheritHandle;
|
||||
} SECURITY_ATTRIBUTES, *PSECURITY_ATTRIBUTES, *LPSECURITY_ATTRIBUTES;
|
||||
|
||||
typedef struct _PROCESS_INFORMATION {
|
||||
HANDLE hProcess;
|
||||
HANDLE hThread;
|
||||
DWORD dwProcessId;
|
||||
DWORD dwThreadId;
|
||||
} PROCESS_INFORMATION, *PPROCESS_INFORMATION, *LPPROCESS_INFORMATION;
|
||||
|
||||
typedef struct _STARTUPINFOA {
|
||||
DWORD cb;
|
||||
LPSTR lpReserved;
|
||||
LPSTR lpDesktop;
|
||||
LPSTR lpTitle;
|
||||
DWORD dwX;
|
||||
DWORD dwY;
|
||||
DWORD dwXSize;
|
||||
DWORD dwYSize;
|
||||
DWORD dwXCountChars;
|
||||
DWORD dwYCountChars;
|
||||
DWORD dwFillAttribute;
|
||||
DWORD dwFlags;
|
||||
WORD wShowWindow;
|
||||
WORD cbReserved2;
|
||||
LPBYTE lpReserved2;
|
||||
HANDLE hStdInput;
|
||||
HANDLE hStdOutput;
|
||||
HANDLE hStdError;
|
||||
} STARTUPINFOA, *LPSTARTUPINFOA;
|
||||
typedef struct _STARTUPINFOW {
|
||||
DWORD cb;
|
||||
LPWSTR lpReserved;
|
||||
LPWSTR lpDesktop;
|
||||
LPWSTR lpTitle;
|
||||
DWORD dwX;
|
||||
DWORD dwY;
|
||||
DWORD dwXSize;
|
||||
DWORD dwYSize;
|
||||
DWORD dwXCountChars;
|
||||
DWORD dwYCountChars;
|
||||
DWORD dwFillAttribute;
|
||||
DWORD dwFlags;
|
||||
WORD wShowWindow;
|
||||
WORD cbReserved2;
|
||||
LPBYTE lpReserved2;
|
||||
HANDLE hStdInput;
|
||||
HANDLE hStdOutput;
|
||||
HANDLE hStdError;
|
||||
} STARTUPINFOW, *LPSTARTUPINFOW;
|
||||
|
||||
typedef STARTUPINFOW STARTUPINFO;
|
||||
typedef LPSTARTUPINFOW LPSTARTUPINFO;
|
||||
|
||||
|
||||
BOOL
|
||||
CreateProcessA(
|
||||
LPCSTR lpApplicationName,
|
||||
LPSTR lpCommandLine,
|
||||
LPSECURITY_ATTRIBUTES lpProcessAttributes,
|
||||
LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
||||
BOOL bInheritHandles,
|
||||
DWORD dwCreationFlags,
|
||||
LPVOID lpEnvironment,
|
||||
LPCSTR lpCurrentDirectory,
|
||||
LPSTARTUPINFOA lpStartupInfo,
|
||||
LPPROCESS_INFORMATION lpProcessInformation
|
||||
);
|
||||
|
||||
BOOL
|
||||
CreateProcessW(
|
||||
LPCWSTR lpApplicationName,
|
||||
LPWSTR lpCommandLine,
|
||||
LPSECURITY_ATTRIBUTES lpProcessAttributes,
|
||||
LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
||||
BOOL bInheritHandles,
|
||||
DWORD dwCreationFlags,
|
||||
LPVOID lpEnvironment,
|
||||
LPCWSTR lpCurrentDirectory,
|
||||
LPSTARTUPINFOW lpStartupInfo,
|
||||
LPPROCESS_INFORMATION lpProcessInformation
|
||||
);
|
||||
|
||||
#define CreateProcess CreateProcessW
|
||||
|
||||
BOOL
|
||||
CreateProcessWithTokenW(
|
||||
HANDLE hToken,
|
||||
DWORD dwLogonFlags,
|
||||
LPCWSTR lpApplicationName,
|
||||
LPWSTR lpCommandLine,
|
||||
DWORD dwCreationFlags,
|
||||
LPVOID lpEnvironment,
|
||||
LPCWSTR lpCurrentDirectory,
|
||||
LPSTARTUPINFOW lpStartupInfo,
|
||||
LPPROCESS_INFORMATION lpProcessInformation
|
||||
);
|
||||
|
||||
BOOL
|
||||
CreateProcessWithLogonW(
|
||||
LPCWSTR lpUsername,
|
||||
LPCWSTR lpDomain,
|
||||
LPCWSTR lpPassword,
|
||||
DWORD dwLogonFlags,
|
||||
LPCWSTR lpApplicationName,
|
||||
LPWSTR lpCommandLine,
|
||||
DWORD dwCreationFlags,
|
||||
LPVOID lpEnvironment,
|
||||
LPCWSTR lpCurrentDirectory,
|
||||
LPSTARTUPINFOW lpStartupInfo,
|
||||
LPPROCESS_INFORMATION lpProcessInformation
|
||||
);
|
||||
|
||||
BOOL
|
||||
CreateProcessAsUserA(
|
||||
HANDLE hToken,
|
||||
LPCSTR lpApplicationName,
|
||||
LPSTR lpCommandLine,
|
||||
LPSECURITY_ATTRIBUTES lpProcessAttributes,
|
||||
LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
||||
BOOL bInheritHandles,
|
||||
DWORD dwCreationFlags,
|
||||
LPVOID lpEnvironment,
|
||||
LPCSTR lpCurrentDirectory,
|
||||
LPSTARTUPINFOA lpStartupInfo,
|
||||
LPPROCESS_INFORMATION lpProcessInformation
|
||||
);
|
||||
|
||||
BOOL
|
||||
CreateProcessAsUserW(
|
||||
HANDLE hToken,
|
||||
LPCWSTR lpApplicationName,
|
||||
LPWSTR lpCommandLine,
|
||||
LPSECURITY_ATTRIBUTES lpProcessAttributes,
|
||||
LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
||||
BOOL bInheritHandles,
|
||||
DWORD dwCreationFlags,
|
||||
LPVOID lpEnvironment,
|
||||
LPCWSTR lpCurrentDirectory,
|
||||
LPSTARTUPINFOW lpStartupInfo,
|
||||
LPPROCESS_INFORMATION lpProcessInformation
|
||||
);
|
||||
|
||||
#define CreateProcessAsUser CreateProcessAsUserW
|
||||
|
||||
void positiveTestCases()
|
||||
{
|
||||
LPCWSTR lpCommandLine = (LPCWSTR)L"C:\\Program Files\\MyApp";
|
||||
HANDLE h = 0;
|
||||
LPWSTR lpApplicationName = NULL;
|
||||
|
||||
// CreatePorcessA
|
||||
CreateProcessA( //BUG
|
||||
NULL,
|
||||
(LPSTR)"C:\\Program Files\\MyApp",
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreatePorcessW
|
||||
CreateProcessW( //BUG
|
||||
NULL,
|
||||
(LPWSTR)L"C:\\Program Files\\MyApp",
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreatePorcess
|
||||
CreateProcess( //BUG
|
||||
NULL,
|
||||
(LPWSTR)L"C:\\Program Files\\MyApp",
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// lpCommandLine as hardcoded variable
|
||||
CreateProcess( //BUG
|
||||
NULL,
|
||||
(LPWSTR)lpCommandLine,
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreateProcessWithTokenW
|
||||
CreateProcessWithTokenW( //BUG
|
||||
h,
|
||||
LOGON_WITH_PROFILE,
|
||||
NULL,
|
||||
(LPWSTR)L"C:\\Program Files\\MyApp",
|
||||
0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreateProcessWithLogonW
|
||||
CreateProcessWithLogonW( //BUG
|
||||
(LPCWSTR)L"UserName",
|
||||
(LPCWSTR)L"CONTOSO",
|
||||
(LPCWSTR)L"<fake_password!>",
|
||||
LOGON_WITH_PROFILE,
|
||||
NULL,
|
||||
(LPWSTR)L"C:\\Program Files\\MyApp",
|
||||
0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreateProcessAsUserA
|
||||
CreateProcessAsUserA( //BUG
|
||||
h,
|
||||
NULL,
|
||||
(LPSTR)"C:\\Program Files\\MyApp",
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreateProcessAsUserW
|
||||
CreateProcessAsUserW( //BUG
|
||||
h,
|
||||
NULL,
|
||||
(LPWSTR)L"C:\\Program Files\\MyApp",
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreateProcessAsUser
|
||||
CreateProcessAsUser( //BUG
|
||||
h,
|
||||
NULL,
|
||||
(LPWSTR)L"C:\\Program Files\\MyApp",
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreatePorcess with a hardcoded variable for application Name (NULL)
|
||||
CreateProcess( //BUG
|
||||
lpApplicationName,
|
||||
(LPWSTR)L"C:\\Program Files\\MyApp",
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
}
|
||||
|
||||
void PositiveTestCasesWithCmdLineParameter(LPWSTR lpCommandLine)
|
||||
{
|
||||
// lpCommandLine as variable
|
||||
CreateProcess( //BUG - Depends on the caller
|
||||
NULL,
|
||||
lpCommandLine,
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
}
|
||||
|
||||
void PositiveTestCasesWithCmdLineParameter_caller()
|
||||
{
|
||||
PositiveTestCasesWithCmdLineParameter((LPWSTR)L"C:\\Program Files\\MyApp");
|
||||
}
|
||||
|
||||
// NOTE: This function will not be flagged as having a bug by this rule.
|
||||
// but as it is, the function can still be misused
|
||||
void FalseNegativeTestCasesWithCmdLineParameter(LPWSTR lpCommandLine)
|
||||
{
|
||||
// lpCommandLine as variable
|
||||
CreateProcess( //Depends on the caller, this time the caller will quote
|
||||
NULL,
|
||||
lpCommandLine,
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
}
|
||||
|
||||
void FalseNegativeTestCasesWithCmdLineParameter_caller()
|
||||
{
|
||||
// No bug - escaped command line
|
||||
// But compare with "PositiveTestCasesWithCmdLineParameter"
|
||||
FalseNegativeTestCasesWithCmdLineParameter((LPWSTR)L"\"C:\\Program Files\\MyApp\"");
|
||||
}
|
||||
|
||||
void PositiveTestCasesWithAppNameParameter(LPWSTR lpApplicationName)
|
||||
{
|
||||
HANDLE h = 0;
|
||||
|
||||
CreateProcessWithTokenW( //BUG - Depends on the caller. In this case the caller sends NULL
|
||||
h,
|
||||
LOGON_WITH_PROFILE,
|
||||
lpApplicationName,
|
||||
(LPWSTR)L"C:\\Program Files\\MyApp",
|
||||
0, NULL, NULL, NULL, NULL);
|
||||
}
|
||||
|
||||
void PositiveTestCasesWithAppNameParameter_caller()
|
||||
{
|
||||
PositiveTestCasesWithAppNameParameter(NULL);
|
||||
}
|
||||
|
||||
// NOTE: This function will not be flagged as having a bug by this rule.
|
||||
// but as it is, the function can still be misused
|
||||
void FalseNegativeTestCasesWithAppNameParameter(LPWSTR lpApplicationName)
|
||||
{
|
||||
HANDLE h = 0;
|
||||
|
||||
CreateProcessWithTokenW( // Depends on the caller. In this case the caller sends an ApplicatioName
|
||||
h,
|
||||
LOGON_WITH_PROFILE,
|
||||
lpApplicationName,
|
||||
(LPWSTR)L"C:\\Program Files\\MyApp",
|
||||
0, NULL, NULL, NULL, NULL);
|
||||
}
|
||||
|
||||
void FalseNegativeTestCasesWithAppNameParameter_caller()
|
||||
{
|
||||
// No bug - escaped command line
|
||||
// But compare with "PositiveTestCasesWithAppNameParameter"
|
||||
FalseNegativeTestCasesWithAppNameParameter((LPWSTR)L"MyApp.exe");
|
||||
}
|
||||
|
||||
bool MayReturnFalse()
|
||||
{
|
||||
// return ((rand() % 2) == 0);
|
||||
return true;
|
||||
}
|
||||
|
||||
void TestCaseProbablyBug()
|
||||
{
|
||||
LPCWSTR lpApplicationName = NULL;
|
||||
|
||||
if (!MayReturnFalse())
|
||||
{
|
||||
lpApplicationName = (LPCWSTR)L"app.exe";
|
||||
}
|
||||
|
||||
CreateProcessWithLogonW( // BUG (Probably - depends on a condition that may be false)
|
||||
(LPCWSTR)L"UserName",
|
||||
(LPCWSTR)L"CONTOSO",
|
||||
(LPCWSTR)L"<fake_password!>",
|
||||
LOGON_WITH_PROFILE,
|
||||
(LPWSTR)lpApplicationName,
|
||||
(LPWSTR)L"C:\\Program Files\\MyApp",
|
||||
0, NULL, NULL, NULL, NULL);
|
||||
|
||||
if (lpApplicationName)
|
||||
{
|
||||
delete[] lpApplicationName;
|
||||
}
|
||||
}
|
||||
|
||||
void negativeTestCases_quotedCommandLine()
|
||||
{
|
||||
LPCWSTR lpCommandLine = (LPCWSTR)L"\"C:\\Program Files\\MyApp\" with additional params";
|
||||
HANDLE h = 0;
|
||||
LPWSTR lpApplicationName = NULL;
|
||||
|
||||
// CreatePorcessA
|
||||
CreateProcessA(
|
||||
NULL,
|
||||
(LPSTR)"\"C:\\Program Files\\MyApp\"",
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreatePorcessW
|
||||
CreateProcessW(
|
||||
NULL,
|
||||
(LPWSTR)L"\"C:\\Program Files\\MyApp\"",
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreatePorcess
|
||||
CreateProcess(
|
||||
NULL,
|
||||
(LPWSTR)L"\"C:\\Program Files\\MyApp\"",
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// lpCommandLine as hardcoded variable
|
||||
CreateProcess(
|
||||
NULL,
|
||||
(LPWSTR)lpCommandLine,
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreateProcessWithTokenW
|
||||
CreateProcessWithTokenW(
|
||||
h,
|
||||
LOGON_WITH_PROFILE,
|
||||
NULL,
|
||||
(LPWSTR)L"\"C:\\Program Files\\MyApp\"",
|
||||
0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreateProcessWithLogonW
|
||||
CreateProcessWithLogonW(
|
||||
(LPCWSTR)L"UserName",
|
||||
(LPCWSTR)L"CONTOSO",
|
||||
(LPCWSTR)L"<fake_password!>",
|
||||
LOGON_WITH_PROFILE,
|
||||
NULL,
|
||||
(LPWSTR)L"\"C:\\Program Files\\MyApp\"",
|
||||
0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreateProcessAsUserA
|
||||
CreateProcessAsUserA(
|
||||
h,
|
||||
NULL,
|
||||
(LPSTR)"\"C:\\Program Files\\MyApp\"",
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreateProcessAsUserW
|
||||
CreateProcessAsUserW(
|
||||
h,
|
||||
NULL,
|
||||
(LPWSTR)L"\"C:\\Program Files\\MyApp\"",
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreateProcessAsUser
|
||||
CreateProcessAsUser(
|
||||
h,
|
||||
NULL,
|
||||
(LPWSTR)L"\"C:\\Program Files\\MyApp\"",
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreatePorcess with a hardcoded variable for application Name (NULL)
|
||||
CreateProcess(
|
||||
lpApplicationName,
|
||||
(LPWSTR)L"\"C:\\Program Files\\MyApp\"",
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
}
|
||||
|
||||
void negativeTestCases_AppNameSet()
|
||||
{
|
||||
LPCWSTR lpCommandLine = (LPCWSTR)L"C:\\Program Files\\MyApp";
|
||||
HANDLE h = 0;
|
||||
LPCWSTR lpApplicationName = (LPCWSTR)L"MyApp.exe";
|
||||
|
||||
// CreatePorcessA
|
||||
CreateProcessA(
|
||||
(LPSTR)"MyApp.exe",
|
||||
(LPSTR)"C:\\Program Files\\MyApp",
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreatePorcessW
|
||||
CreateProcessW(
|
||||
(LPWSTR)L"MyApp.exe",
|
||||
(LPWSTR)L"C:\\Program Files\\MyApp",
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreatePorcess
|
||||
CreateProcess(
|
||||
(LPWSTR)L"MyApp.exe",
|
||||
(LPWSTR)L"C:\\Program Files\\MyApp",
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// lpCommandLine as hardcoded variable
|
||||
CreateProcess(
|
||||
(LPWSTR)L"MyApp.exe",
|
||||
(LPWSTR)lpCommandLine,
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreateProcessWithTokenW
|
||||
CreateProcessWithTokenW(
|
||||
h,
|
||||
LOGON_WITH_PROFILE,
|
||||
(LPWSTR)L"MyApp.exe",
|
||||
(LPWSTR)L"C:\\Program Files\\MyApp",
|
||||
0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreateProcessWithLogonW
|
||||
CreateProcessWithLogonW(
|
||||
(LPCWSTR)L"UserName",
|
||||
(LPCWSTR)L"CONTOSO",
|
||||
(LPCWSTR)L"<fake_password!>",
|
||||
LOGON_WITH_PROFILE,
|
||||
(LPWSTR)L"MyApp.exe",
|
||||
(LPWSTR)L"C:\\Program Files\\MyApp",
|
||||
0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreateProcessAsUserA
|
||||
CreateProcessAsUserA(
|
||||
h,
|
||||
(LPSTR)"MyApp.exe",
|
||||
(LPSTR)"C:\\Program Files\\MyApp",
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreateProcessAsUserW
|
||||
CreateProcessAsUserW(
|
||||
h,
|
||||
(LPWSTR)L"MyApp.exe",
|
||||
(LPWSTR)L"C:\\Program Files\\MyApp",
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreateProcessAsUser
|
||||
CreateProcessAsUser(
|
||||
h,
|
||||
(LPWSTR)L"MyApp.exe",
|
||||
(LPWSTR)L"C:\\Program Files\\MyApp",
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
|
||||
// CreatePorcess with a hardcoded variable for application Name (NULL)
|
||||
CreateProcess(
|
||||
(LPWSTR)lpApplicationName,
|
||||
(LPWSTR)L"C:\\Program Files\\MyApp",
|
||||
NULL, NULL, FALSE, 0, NULL, NULL, NULL, NULL);
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
| UnsafeCreateProcessCall.cpp:184:5:184:18 | call to CreateProcessA | call to CreateProcessA with lpApplicationName == NULL (0) and with an unquoted lpCommandLine (C:\\Program Files\\MyApp) may result in a security vulnerability if the path contains spaces. |
|
||||
| UnsafeCreateProcessCall.cpp:190:5:190:18 | call to CreateProcessW | call to CreateProcessW with lpApplicationName == NULL (0) and with an unquoted lpCommandLine (C:\\Program Files\\MyApp) may result in a security vulnerability if the path contains spaces. |
|
||||
| UnsafeCreateProcessCall.cpp:196:5:196:17 | call to CreateProcessW | call to CreateProcessW with lpApplicationName == NULL (0) and with an unquoted lpCommandLine (C:\\Program Files\\MyApp) may result in a security vulnerability if the path contains spaces. |
|
||||
| UnsafeCreateProcessCall.cpp:202:5:202:17 | call to CreateProcessW | call to CreateProcessW with lpApplicationName == NULL (0) and with an unquoted lpCommandLine (lpCommandLine) may result in a security vulnerability if the path contains spaces. |
|
||||
| UnsafeCreateProcessCall.cpp:208:5:208:27 | call to CreateProcessWithTokenW | call to CreateProcessWithTokenW with lpApplicationName == NULL (0) and with an unquoted lpCommandLine (C:\\Program Files\\MyApp) may result in a security vulnerability if the path contains spaces. |
|
||||
| UnsafeCreateProcessCall.cpp:216:5:216:27 | call to CreateProcessWithLogonW | call to CreateProcessWithLogonW with lpApplicationName == NULL (0) and with an unquoted lpCommandLine (C:\\Program Files\\MyApp) may result in a security vulnerability if the path contains spaces. |
|
||||
| UnsafeCreateProcessCall.cpp:226:5:226:24 | call to CreateProcessAsUserA | call to CreateProcessAsUserA with lpApplicationName == NULL (0) and with an unquoted lpCommandLine (C:\\Program Files\\MyApp) may result in a security vulnerability if the path contains spaces. |
|
||||
| UnsafeCreateProcessCall.cpp:233:5:233:24 | call to CreateProcessAsUserW | call to CreateProcessAsUserW with lpApplicationName == NULL (0) and with an unquoted lpCommandLine (C:\\Program Files\\MyApp) may result in a security vulnerability if the path contains spaces. |
|
||||
| UnsafeCreateProcessCall.cpp:240:5:240:23 | call to CreateProcessAsUserW | call to CreateProcessAsUserW with lpApplicationName == NULL (0) and with an unquoted lpCommandLine (C:\\Program Files\\MyApp) may result in a security vulnerability if the path contains spaces. |
|
||||
| UnsafeCreateProcessCall.cpp:247:5:247:17 | call to CreateProcessW | call to CreateProcessW with lpApplicationName == NULL (lpApplicationName) and with an unquoted lpCommandLine (C:\\Program Files\\MyApp) may result in a security vulnerability if the path contains spaces. |
|
||||
| UnsafeCreateProcessCall.cpp:256:5:256:17 | call to CreateProcessW | call to CreateProcessW with lpApplicationName == NULL (0) and with an unquoted lpCommandLine (lpCommandLine) may result in a security vulnerability if the path contains spaces. |
|
||||
| UnsafeCreateProcessCall.cpp:289:5:289:27 | call to CreateProcessWithTokenW | call to CreateProcessWithTokenW with lpApplicationName == NULL (lpApplicationName) and with an unquoted lpCommandLine (C:\\Program Files\\MyApp) may result in a security vulnerability if the path contains spaces. |
|
||||
| UnsafeCreateProcessCall.cpp:338:5:338:27 | call to CreateProcessWithLogonW | call to CreateProcessWithLogonW with lpApplicationName == NULL (lpApplicationName) and with an unquoted lpCommandLine (C:\\Program Files\\MyApp) may result in a security vulnerability if the path contains spaces. |
|
||||
@@ -0,0 +1 @@
|
||||
Security/CWE/CWE-428/UnsafeCreateProcessCall.ql
|
||||
Reference in New Issue
Block a user