Skip to content

Commit b9cdd1f

Browse files
ajinabrahamajinabraham
committed
Security: Fix for LFI found by thongngo
1 parent 0458e21 commit b9cdd1f

File tree

4 files changed

+46
-22
lines changed

4 files changed

+46
-22
lines changed

‎APITester/views.py

+3-3
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ def APIFuzzer(request):
4848
try:
4949
if request.method == 'GET':
5050
MD5=request.GET['md5']
51-
m=re.match('[0-9a-f]{32}',MD5)
51+
m=re.match('^[0-9a-f]{32}$',MD5)
5252
if m:
5353
URLS = getListOfURLS(MD5,False)
5454
if (len(URLS)) == 0:
@@ -71,7 +71,7 @@ def APIFuzzer(request):
7171
return HttpResponseRedirect('/error/')
7272
elif request.method =="POST":
7373
MD5=request.POST['md5']
74-
m=re.match('[0-9a-f]{32}',MD5)
74+
m=re.match('^[0-9a-f]{32}$',MD5)
7575
if m:
7676
SCOPE_URLS = [] #All DOMAINS that needs to be tested
7777
SCOPE_TESTS = [] #All TESTS that needs to be executed
@@ -128,7 +128,7 @@ def StartScan(request):
128128
try:
129129
if request.method =="POST":
130130
MD5=request.POST['md5']
131-
m=re.match('[0-9a-f]{32}',MD5)
131+
m=re.match('^[0-9a-f]{32}$',MD5)
132132
if m:
133133
#Scan Mode
134134
SCAN_MODE=request.POST['scanmode']

‎DynamicAnalyzer/views.py

+9-9
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ def DynamicAnalyzer(request):
3838
if re.findall(";|\$\(|\|\||&&",PKG) or re.findall(";|\$\(|\|\||&&",LNCH):
3939
print "[ATTACK] Possible RCE"
4040
return HttpResponseRedirect('/error/')
41-
m=re.match('[0-9a-f]{32}',MD5)
41+
m=re.match('^[0-9a-f]{32}$',MD5)
4242
if m:
4343
# Delete ScreenCast Cache
4444
SCREEN_FILE=os.path.join(settings.SCREEN_DIR, 'screen.png')
@@ -82,7 +82,7 @@ def GetEnv(request):
8282
if re.findall(";|\$\(|\|\||&&",PKG) or re.findall(";|\$\(|\|\||&&",LNCH):
8383
print "[ATTACK] Possible RCE"
8484
return HttpResponseRedirect('/error/')
85-
m=re.match('[0-9a-f]{32}',MD5)
85+
m=re.match('^[0-9a-f]{32}$',MD5)
8686
if m:
8787
DIR=settings.BASE_DIR
8888
APP_DIR=os.path.join(settings.UPLD_DIR, MD5+'/') #APP DIRECTORY
@@ -113,7 +113,7 @@ def TakeScreenShot(request):
113113
try:
114114
if request.method == 'POST':
115115
MD5=request.POST['md5']
116-
m=re.match('[0-9a-f]{32}',MD5)
116+
m=re.match('^[0-9a-f]{32}$',MD5)
117117
if m:
118118
data = {}
119119
r=random.randint(1, 1000000)
@@ -263,7 +263,7 @@ def FinalTest(request):
263263
if re.findall(";|\$\(|\|\||&&",PACKAGE):
264264
print "[ATTACK] Possible RCE"
265265
return HttpResponseRedirect('/error/')
266-
m=re.match('[0-9a-f]{32}',MD5)
266+
m=re.match('^[0-9a-f]{32}$',MD5)
267267
if m:
268268
#Stop ScreenCast Client if it is running
269269
tcp_server_mode = "off"
@@ -307,7 +307,7 @@ def DumpData(request):
307307
data = {}
308308
PACKAGE=request.POST['pkg']
309309
MD5=request.POST['md5']
310-
m=re.match('[0-9a-f]{32}',MD5)
310+
m=re.match('^[0-9a-f]{32}$',MD5)
311311
if m:
312312
if re.findall(";|\$\(|\|\||&&",PACKAGE):
313313
print "[ATTACK] Possible RCE"
@@ -353,7 +353,7 @@ def ExportedActivityTester(request):
353353
try:
354354
MD5=request.POST['md5']
355355
PKG=request.POST['pkg']
356-
m=re.match('[0-9a-f]{32}',MD5)
356+
m=re.match('^[0-9a-f]{32}$',MD5)
357357
if m:
358358
if re.findall(";|\$\(|\|\||&&",PKG):
359359
print "[ATTACK] Possible RCE"
@@ -410,7 +410,7 @@ def ActivityTester(request):
410410
try:
411411
MD5=request.POST['md5']
412412
PKG=request.POST['pkg']
413-
m=re.match('[0-9a-f]{32}',MD5)
413+
m=re.match('^[0-9a-f]{32}$',MD5)
414414
if m:
415415
if re.findall(";|\$\(|\|\||&&",PKG):
416416
print "[ATTACK] Possible RCE"
@@ -473,7 +473,7 @@ def Report(request):
473473
if re.findall(";|\$\(|\|\||&&",PKG):
474474
print "[ATTACK] Possible RCE"
475475
return HttpResponseRedirect('/error/')
476-
m=re.match('[0-9a-f]{32}',MD5)
476+
m=re.match('^[0-9a-f]{32}$',MD5)
477477
if m:
478478
DIR=settings.BASE_DIR
479479
APP_DIR=os.path.join(settings.UPLD_DIR, MD5+'/') #APP DIRECTORY
@@ -891,7 +891,7 @@ def View(request):
891891
fil=''
892892
rtyp=''
893893
dat=''
894-
m=re.match('[0-9a-f]{32}',request.GET['md5'])
894+
m=re.match('^[0-9a-f]{32}$',request.GET['md5'])
895895
if m:
896896
fil=request.GET['file']
897897
MD5=request.GET['md5']

‎MalwareAnalyzer/malwaredb/malwaredomainlist

+25-1
Original file line numberDiff line numberDiff line change
@@ -3038,4 +3038,28 @@
30383038
"2016/05/12_08:01","oceanviewfootmassage.com/js/BKTbCv.html","192.254.225.146","-","Compromised site, leads to Locky","Registrar Abuse Contact [email protected]","46606","0","US",
30393039
"2016/05/12_08:36","www.airsonett.se","193.44.13.93","193-44-13-93.net.tnm.se.","pseudo darkleech on compromised site leads to Angler EK","-","3301","0","SE",
30403040
"2016/05/12_09:49","chashmawala.com/mn3yhds","142.4.1.197","142-4-1-197.unifiedlayer.com.","Locky ransomware","-","46606","0","US",
3041-
"2016/05/12_10:40","lojasrana.com:7080/ujh3jmd","186.202.183.138","pleskcl0243.hospedagemdesites.ws."
3041+
"2016/05/12_10:40","lojasrana.com:7080/ujh3jmd","186.202.183.138","pleskcl0243.hospedagemdesites.ws.","Locky ransomware","-","27715","0","BR",
3042+
"2016/05/12_10:40","scrubs.dresscool.co/zcv3hhs","107.180.25.1","ip-107-180-25-1.ip.secureserver.net.","Locky ransomware","[email protected]","26496","0","US",
3043+
"2016/05/12_12:39","www.jobbainorge.nu/","195.74.38.95","cl-11.atm.binero.net.","pseudo darkleech on compromised site leads to Angler EK","-","41528","0","SE",
3044+
"2016/05/12_12:39","microencapsulation.readmyweather.com/satire/pairing/58798892_pkfpfGESM","69.162.126.172","172-126-162-69.static.reverse.lstn.net.","Angler EK","Registrar Abuse Contact [email protected]","46475","0","US",
3045+
"2016/05/12_14:22","www.autoappassionati.it/","109.233.126.14","cpanel01.infinitynet.it.","pseudo darkleech on compromised site leads to Angler EK","-","48815","0","IT",
3046+
"2016/05/12_14:23","tannpastnevicher.themakershop.co.uk/mj/o/3557/","69.162.126.172","172-126-162-69.static.reverse.lstn.net.","Angler EK","Colyton Industrial Designs ltd / -","46475","0","US",
3047+
"2016/05/13_13:23","www.imageprecision.com/","188.121.41.53","n1nw8shg125.shr.prod.ams1.secureserver.net.","pseudo darkleech on compromised site leads to Angler EK","-","26496","0","NL",
3048+
"2016/05/13_13:23","arbeiderspartij.be-spry.co.uk/NTQBuUVxO/gXyyX/IobVvqD-pRXCfMd/","85.25.41.91","static-ip-85-25-41-91.inaddr.ip-pool.com.","Angler EK","H R Searle / -","8972","0","DE",
3049+
"2016/05/15_15:23","meuble-ligansadaequabat.thepinkskip.co.uk/hoteliers/6719/66/01/511758321.html","188.165.167.255","-","Angler EK","Brian Barr / -","16276","0","FR",
3050+
"2016/05/16_10:40","sign.cdrn70.xyz/hfziso4.html","93.190.140.154","-","gateway to Angler EK","-","49981","0","NL",
3051+
"2016/05/16_11:15","inclination.cdrn70.xyz/brhsc4.html","93.190.140.219","s10.sheermail.com.","gateway to Angler EK","-","49981","0","NL",
3052+
"2016/05/16_11:51","no-id.eu/987t5t7g","83.137.194.81","server6.hosting2go.nl.","trojan","NOT DISCLOSED! / -","34233","0","NL",
3053+
"2016/05/16_11:55","press.centraljoias.com/brhsc4.html","93.190.140.219","s10.sheermail.com.","gateway to Angler EK","Registrant [email protected]","49981","0","NL",
3054+
"2016/05/16_12:00","gutter.celebway.net/brhsc4.html","93.190.140.219","s10.sheermail.com.","gateway to Angler EK","Registrar Abuse Contact [email protected]","49981","0","NL",
3055+
"2016/05/16_12:35","charge.cenzorate-expertize.ro/brhsc4.html","93.190.140.219","s10.sheermail.com.","gateway to Angler EK","-","49981","0","NL",
3056+
"2016/05/16_12:40","excitable.charmedmultimedia.eu/brhsc4.html","93.190.140.219","s10.sheermail.com.","gateway to Angler EK","NOT DISCLOSED! / -","49981","0","NL",
3057+
"2016/05/16_18:05","sunlite.com.au/j76jn5nbv","27.124.119.225","server-69-r12.ipv4.au.syrahost.com.","Locky ransomware","Wayne Hughes / Visit whois.ausregistry.com.au for Web based WhoIs","38719","0","AU",
3058+
"2016/05/17_07:17","uwzorg.info/k76gf34g4g","89.105.197.30","mail.teurlings.biz.","Locky ransomware","MAM Teurlings / [email protected]","24875","0","NL",
3059+
"2016/05/17_09:54","actinomorphous.excelwood.co.uk/euNsbCci/FAUk/Olvp/82749/SAitPlttYB-35817144-hgs.png","37.130.229.104","uk.server.","Angler EK","Decora Blind Systems / -","13213","0","GB",
3060+
"2016/05/17_10:32","www.gptecno.it/","178.255.186.250","www010.avanzati.it.","pseudo darkleech on compromised site leads to Angler EK","-","42425","0","IT",
3061+
"2016/05/17_10:32","armstrongcreekgeleedpotig.imber.me.uk/VDBGs/ftPRd/ZXyG-lBfzftj/","37.130.229.104","uk.server.","Angler EK","Nominet UK / -","13213","0","GB",
3062+
"2016/05/17_13:34","passagegoldtravel.com/678y8h","23.229.182.198","ip-23-229-182-198.ip.secureserver.net.","Locky ransomware","-","26496","0","US",
3063+
"2016/05/18_07:28","spreadware.com/09jhg54g","162.244.95.27","-","Locky ransomware","Registrar Abuse Contact [email protected]","53667","0","US",
3064+
"2016/05/18_15:05","www.cafecalluna.nl/","193.239.186.142","sweb02.plinq.nl.","pseudo darkleech on compromised site leads to Angler EK","-","35224","0","NL",
3065+
"2016/05/18_15:05","brunowtrahoque-miagola.unishadeverticalsystem.com/1331481-positivity-misdiagnosis-refrigerants-slim-twinkles-array.png","63.143.54.198","198-54-143-63.static.reverse.lstn.

‎StaticAnalyzer/views.py

+9-9
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ def PDF(request):
3434
try:
3535
MD5=request.GET['md5']
3636
TYP=request.GET['type']
37-
m=re.match('[0-9a-f]{32}',MD5)
37+
m=re.match('^[0-9a-f]{32}$',MD5)
3838
if m:
3939
if (TYP=='APK' or TYP=='ANDZIP'):
4040
DB=StaticAnalyzerAndroid.objects.filter(MD5=MD5)
@@ -159,7 +159,7 @@ def PDF(request):
159159
pass
160160
def Java(request):
161161
try:
162-
m=re.match('[0-9a-f]{32}',request.GET['md5'])
162+
m=re.match('^[0-9a-f]{32}$',request.GET['md5'])
163163
typ=request.GET['type']
164164
if m:
165165
MD5=request.GET['md5']
@@ -198,7 +198,7 @@ def Java(request):
198198
return HttpResponseRedirect('/error/')
199199
def Smali(request):
200200
try:
201-
m=re.match('[0-9a-f]{32}',request.GET['md5'])
201+
m=re.match('^[0-9a-f]{32}$',request.GET['md5'])
202202
if m:
203203
MD5=request.GET['md5']
204204
SRC=os.path.join(settings.UPLD_DIR, MD5+'/smali_source/')
@@ -224,7 +224,7 @@ def Smali(request):
224224
return HttpResponseRedirect('/error/')
225225
def Find(request):
226226
try:
227-
m=re.match('[0-9a-f]{32}',request.POST['md5'])
227+
m=re.match('^[0-9a-f]{32}$',request.POST['md5'])
228228
if m:
229229
MD5=request.POST['md5']
230230
q=request.POST['q']
@@ -265,7 +265,7 @@ def Find(request):
265265
def ViewSource(request):
266266
try:
267267
fil=''
268-
m=re.match('[0-9a-f]{32}',request.GET['md5'])
268+
m=re.match('^[0-9a-f]{32}$',request.GET['md5'])
269269
if m and (request.GET['file'].endswith('.java') or request.GET['file'].endswith('.smali')):
270270
fil=request.GET['file']
271271
MD5=request.GET['md5']
@@ -304,7 +304,7 @@ def ManifestView(request):
304304
MD5=request.GET['md5'] #MD5
305305
TYP=request.GET['type'] #APK or SOURCE
306306
BIN=request.GET['bin']
307-
m=re.match('[0-9a-f]{32}',MD5)
307+
m=re.match('^[0-9a-f]{32}$',MD5)
308308
if m and (TYP=='eclipse' or TYP=='studio' or TYP=='apk') and (BIN=='1' or BIN=='0'):
309309
APP_DIR=os.path.join(settings.UPLD_DIR, MD5+'/') #APP DIRECTORY
310310
TOOLS_DIR=os.path.join(DIR, 'StaticAnalyzer/tools/') #TOOLS DIR
@@ -326,7 +326,7 @@ def StaticAnalyzer(request):
326326
try:
327327
#Input validation
328328
TYP=request.GET['type']
329-
m=re.match('[0-9a-f]{32}',request.GET['checksum'])
329+
m=re.match('^[0-9a-f]{32}$',request.GET['checksum'])
330330
if ((m) and (request.GET['name'].lower().endswith('.apk') or request.GET['name'].lower().endswith('.zip')) and ((TYP=='zip') or (TYP=='apk'))):
331331
DIR=settings.BASE_DIR #BASE DIR
332332
APP_NAME=request.GET['name'] #APP ORGINAL NAME
@@ -1754,7 +1754,7 @@ def StaticAnalyzer_iOS(request):
17541754
print "[INFO] iOS Static Analysis Started"
17551755
TYP=request.GET['type']
17561756
RESCAN= str(request.GET.get('rescan', 0))
1757-
m=re.match('[0-9a-f]{32}',request.GET['checksum'])
1757+
m=re.match('^[0-9a-f]{32}$',request.GET['checksum'])
17581758
if ((m) and (request.GET['name'].lower().endswith('.ipa') or request.GET['name'].lower().endswith('.zip')) and ((TYP=='ipa') or (TYP=='ios'))):
17591759
DIR=settings.BASE_DIR #BASE DIR
17601760
APP_NAME=request.GET['name'] #APP ORGINAL NAME
@@ -1963,7 +1963,7 @@ def ViewFile(request):
19631963
typ=request.GET['type']
19641964
MD5=request.GET['md5']
19651965
mode=request.GET['mode']
1966-
m=re.match('[0-9a-f]{32}',MD5)
1966+
m=re.match('^[0-9a-f]{32}$',MD5)
19671967
ext=fil.split('.')[-1]
19681968
f=re.search("plist|db|sqlitedb|sqlite|txt|m",ext)
19691969
if m and f and re.findall('xml|db|txt|m',typ) and re.findall('ios|ipa',mode):

0 commit comments

Comments
 (0)