Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security] CWE-78 Command built from user-controlled sources #298

Closed
tiokim opened this issue May 6, 2021 · 3 comments · Fixed by #315
Closed

[Security] CWE-78 Command built from user-controlled sources #298

tiokim opened this issue May 6, 2021 · 3 comments · Fixed by #315
Assignees
@tdrozdovsky
Labels
high priority It should be resolved ASAP

Comments

@tiokim
Copy link
Contributor

tiokim commented May 6, 2021

CWE-78 security issue is detected by lgtm and CodeQL.
We need a process to check if the input that launches the native app contains a malicious string.
@MoonkiHong
Copy link
Contributor

@tdrozdovsky What do you think of a suggestion from @t25kim?

@tiokim tiokim mentioned this issue May 6, 2021
Closed
8 tasks
@tiokim tiokim added the high priority It should be resolved ASAP label May 7, 2021
@tiokim
Copy link
Contributor Author

tiokim commented May 7, 2021

@tdrozdovsky This issue affects other PRs not related to CWE-78, such as #297 and should be fixed as soon as possible. I put some code for command validation before the code that launches the native app. However, CodeQL still detects CWE-78.
Is there any other way to resolve this issue? Or would it be possible to mark it as False positive with PR #299?

@tdrozdovsky
Copy link
Contributor

Thank you for trying to eliminate this issue. Earlier, I wrote that there is a big vulnerability in the native mode, and then I was surprised that the system does not detect it. But now everything is displayed correctly and the vulnerability is detected.
This problem can be completely solved only at the system level using the mechanisms of protection of the Linux Kernel. But I will try to solve it within our project. As soon as I finish with the TLS, I immediately do this issue.

@tdrozdovsky tdrozdovsky mentioned this issue Jun 10, 2021
Merged
8 tasks
MoonkiHong pushed a commit that referenced this issue Jun 21, 2021
@tdrozdovsky
Fix CWE-78 (#315)
e13d11c 
Signed-off-by: Taras Drozdovskyi <t.drozdovsky@samsung.com>

After analyzing the existing code, it should be noted that sanitization measures have been made in the edge-orchestration:

1. analysis for a command injection using an escape sequence
2. filtering commands that are on the blacklist
3. only those commands that are previously described in the configuration file (ex. ls_srv.conf) can be executed.

Strengthening against attacks of this kind can be:

1. Using the integrity check and digital signature of the configuration file.
2. Applying Linux Kernel protection modules.

All attempts to eliminate the security alert by changing the source code were unsuccessful.
The elimination requires hard-coding the string literals of the commands to be used, but this greatly limits the flexibility of the edge-orchestration and doesn't add a significant increase in security.

Therefore, I propose to mark this alert as a fall positive.

Fixes #298
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tdrozdovsky tdrozdovsky

Labels
high priority It should be resolved ASAP
Projects
None yet
Milestone
No milestone
3 participants
@tiokim @MoonkiHong @tdrozdovsky