Skip to content

Commit 21193bd

Browse files
JLLeitschuhJLLeitschuh
committed
Java: Use of HTTP/FTP to download/upload Maven artifacts
This adds a security alert for the use of HTTP or FTP to download or upload artifacts using Maven.
1 parent 8cca9b0 commit 21193bd

File tree

4 files changed

+203
-0
lines changed

4 files changed

+203
-0
lines changed

‎java/ql/src/Security/CWE/CWE-829/InsecureDependencyResolution.qhelp‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
<p>Using an insecure protocol like HTTP or FTP to download your dependencies leaves your Maven build vulnerable to a
7+
<a href="https://en.wikipedia.org/wiki/Man-in-the-middle_attack">Man in the Middle (MITM)</a>.
8+
This can allow attackers to inject malicious code into the artifacts that you are resolving and infect build artifacts
9+
that are being produced. This can be used by attackers to perform a
10+
<a href="https://en.wikipedia.org/wiki/Supply_chain_attack">Supply chain attack</a>
11+
against your project's users.
12+
</p>
13+
14+
<p>This vulnerability has a
15+
<a href="https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H&version=3.1">
16+
CVSS v3.1 base score of 8.1/10
17+
</a>.</p>
18+
19+
</overview>
20+
<recommendation>
21+
22+
<p>Always use HTTPS or SFTP to download artifacts from artifact servers.</p>
23+
24+
</recommendation>
25+
26+
<example>
27+
28+
<p>These examples show examples of locations in Maven POM files where artifact repository upload/download is configured.
29+
The first shows the use of HTTP, the second shows the use of HTTPS.
30+
</p>
31+
32+
<sample src="insecure-pom.xml" />
33+
34+
<sample src="secure-pom.xml" />
35+
36+
</example>
37+
<references>
38+
<li>
39+
Research:
40+
<a href="https://medium.com/bugbountywriteup/want-to-take-over-the-java-ecosystem-all-you-need-is-a-mitm-1fc329d898fb?source=friends_link&sk=3c99970c55a899ad9ef41f126efcde0e">
41+
Want to take over the Java ecosystem? All you need is a MITM!
42+
</a>
43+
</li>
44+
<li>
45+
Research:
46+
<a href="https://max.computer/blog/how-to-take-over-the-computer-of-any-java-or-clojure-or-scala-developer/">
47+
How to take over the computer of any Java (or Closure or Scala) Developer.
48+
</a>
49+
</li>
50+
<li>
51+
Proof of Concept:
52+
<a href="https://github.com/mveytsman/dilettante">
53+
mveytsman/dilettante
54+
</a>
55+
</li>
56+
<li>
57+
Additional Gradle & Maven plugin:
58+
<a href="https://spring.io/blog/2019/06/10/announcing-nohttp">
59+
Announcing nohttp
60+
</a>
61+
</li>
62+
<li>
63+
Java Ecosystem Announcement:
64+
<a href="https://gist.github.com/JLLeitschuh/789e49e3d34092a005031a0a1880af99">
65+
HTTP Decommission Artifact Server Announcements
66+
</a>
67+
</li>
68+
69+
<!-- LocalWords: CWE maven dependencies artifact
70+
-->
71+
72+
</references>
73+
</qhelp>

‎java/ql/src/Security/CWE/CWE-829/InsecureDependencyResolution.ql‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
/**
2+
* @name Failure to use HTTPS or SFTP URL in Maven artifact upload/download
3+
* @description Non-HTTPS connections can be intercepted by third parties.
4+
* @kind path-problem
5+
* @problem.severity error
6+
* @precision very high
7+
* @id java/maven/non-https-url
8+
* @tags security
9+
* external/cwe/cwe-319
10+
* external/cwe/cwe-494
11+
* external/cwe/cwe-829
12+
*/
13+
14+
import java
15+
import semmle.code.xml.MavenPom
16+
17+
private class DeclaredRepository extends PomElement {
18+
DeclaredRepository() {
19+
this.getName() = "repository" or
20+
this.getName() = "snapshotRepository" or
21+
this.getName() = "pluginRepository"
22+
}
23+
24+
string getUrl() {
25+
result = getAChild("url").(PomElement).getValue()
26+
}
27+
28+
predicate isInsecureRepositoryUsage() {
29+
getUrl().matches("http://%") or
30+
getUrl().matches("ftp://%")
31+
}
32+
}
33+
34+
from DeclaredRepository repository
35+
where repository.isInsecureRepositoryUsage()
36+
select
37+
repository,
38+
"Downloading or uploading artifacts over insecure protocol (eg. http or ftp) to repository " + repository.getUrl()

‎java/ql/src/Security/CWE/CWE-829/insecure-pom.xml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
5+
6+
<modelVersion>4.0.0</modelVersion>
7+
8+
<groupId>com.semmle</groupId>
9+
<artifactId>parent</artifactId>
10+
<version>1.0</version>
11+
<packaging>pom</packaging>
12+
13+
<name>Security Testing</name>
14+
<description>An example of insecure download and upload of dependencies</description>
15+
16+
<distributionManagement>
17+
<repository>
18+
<id>insecure-releases</id>
19+
<name>Insecure Repository Releases</name>
20+
<!-- BAD! Use HTTPS -->
21+
<url>http://insecure-repository.example</url>
22+
</repository>
23+
<snapshotRepository>
24+
<id>insecure-snapshots</id>
25+
<name>Insecure Repository Snapshots</name>
26+
<!-- BAD! Use HTTPS -->
27+
<url>http://insecure-repository.example</url>
28+
</snapshotRepository>
29+
</distributionManagement>
30+
<repositories>
31+
<repository>
32+
<id>insecure</id>
33+
<name>Insecure Repository</name>
34+
<!-- BAD! Use HTTPS -->
35+
<url>http://insecure-repository.example</url>
36+
</repository>
37+
</repositories>
38+
<pluginRepositories>
39+
<pluginRepository>
40+
<id>insecure-plugins</id>
41+
<name>Insecure Repository Releases</name>
42+
<!-- BAD! Use HTTPS -->
43+
<url>http://insecure-repository.example</url>
44+
</pluginRepository>
45+
</pluginRepositories>
46+
</project>

‎java/ql/src/Security/CWE/CWE-829/secure-pom.xml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
5+
6+
<modelVersion>4.0.0</modelVersion>
7+
8+
<groupId>com.semmle</groupId>
9+
<artifactId>parent</artifactId>
10+
<version>1.0</version>
11+
<packaging>pom</packaging>
12+
13+
<name>Security Testing</name>
14+
<description>An example of secure download and upload of dependencies</description>
15+
16+
<distributionManagement>
17+
<repository>
18+
<id>insecure-releases</id>
19+
<name>Secure Repository Releases</name>
20+
<!-- GOOD! Use HTTPS -->
21+
<url>https://insecure-repository.example</url>
22+
</repository>
23+
<snapshotRepository>
24+
<id>insecure-snapshots</id>
25+
<name>Secure Repository Snapshots</name>
26+
<!-- GOOD! Use HTTPS -->
27+
<url>https://insecure-repository.example</url>
28+
</snapshotRepository>
29+
</distributionManagement>
30+
<repositories>
31+
<repository>
32+
<id>insecure</id>
33+
<name>Secure Repository</name>
34+
<!-- GOOD! Use HTTPS -->
35+
<url>https://insecure-repository.example</url>
36+
</repository>
37+
</repositories>
38+
<pluginRepositories>
39+
<pluginRepository>
40+
<id>insecure-plugins</id>
41+
<name>Secure Repository Releases</name>
42+
<!-- GOOD! Use HTTPS -->
43+
<url>https://insecure-repository.example</url>
44+
</pluginRepository>
45+
</pluginRepositories>
46+
</project>

0 commit comments

Comments
 (0)