Penetration Test Report (RadicallyOpenSecurity): 2018 CodeAudit+Pentest F Droid v1.0

Penetration Test Report
Open Tech Fund
V 1.0
Diemen, August 29th, 2018
Confidential
Document Properties
Client Open Tech Fund
Title Penetration Test Report
Targets F-droid Client
F-droid Privileged Extension
F-droid Repomaker
F-droid Server
F-droid Website
Version 1.0
Pentesters Stefan Marsiske, Abhinav Mishra, Mahesh Saptarshi
Authors Stefan Marsiske, Abhinav Mishra, Mahesh Saptarshi, Patricia Piolon
Reviewed by John Sinteur
Approved by Melanie Rieback
Version control
Version Date Author Description
0.1 March 2nd, 2018 Stefan Marsiske Initial draft - python code
audit targets
0.2 April 16th, 2018 Abhinav Mishra, Mahesh Final draft for review after
Saptarshi adding all issues from code
audit and pen-test
0.3 August 29th, 2018 Patricia Piolon Cleaned up xml, fixed some
errors
1.0 August 29th, 2018 Patricia Piolon Finalizing
Contact
For more information about this document and its contents please contact Radically Open Security B.V.
Name Melanie Rieback
Address Overdiemerweg 28
1111 PP Diemen
The Netherlands
Phone +31 (0)20 2621 255
Email info@radicallyopensecurity.com
Radically Open Security B.V. is registered at the trade register of the Dutch chamber of commerce under number 60628081.
Table of Contents
1 Executive Summary 5
1.1 Introduction 5
1.2 Scope of work 5
1.3 Project objectives 5
1.4 Timeline 5
1.5 Results In A Nutshell 5
1.6 Summary of Findings 6
1.7 Summary of Recommendations 8
1.8 Charts 11
1.8.1 Findings by Threat Level 11
1.8.2 Findings by Type 12
2 Methodology 13
2.1 Planning 13
2.2 Risk Classification 13
3 Automated Code Scans 15
3.1 Automated Scan Tools 15
4 Pentest Technical Summary 16
4.1 Findings 16
4.1.1 OTF-001 — Evasion of Bleach Sanitizer in Repomaker 16
4.1.2 OTF-002 — Shell Code Injection Via Malicious Appids Into Fdroidserver 16
4.1.3 OTF-003 — Code Injection in Fdroidserver Metadata Yaml Parsing 19
4.1.4 OTF-004 — Infoleak in Fdroidserver Checkupdates.py 20
4.1.5 OTF-005 — Code Injection in Fdroidserver Checkupdates Through Eval'ed User Supplied Data 22
4.1.6 OTF-006 — Code Injection Via Malicious Appid in Fdroidserver Build.py 22
4.1.7 OTF-007 — Javascript Injection Into HTMLified Descriptions in Fdroidserver Metadata 23
4.1.8 OTF-008 — Unvalidated User Input Included in Response 24
4.1.9 OTF-009 — Applicatioin uses TrustOnFirstUse (TOFU) Usage unverified signing certificate 25
4.1.10 OTF-010 — (fdroid Client) Exploiting "Nearby Swap" Feature to Show Malicious Prompt to
Users or Redirect to Malicious Sites 27
4.1.11 OTF-011 — Weak Regexps Filtering XSS and Unwanted HTML Tags in Fdroidserver/lint.py 30
4.1.12 OTF-012 — Key Alias Collisions Can Lead to DoS of Publishing in Fdroidserver 31
4.1.13 OTF-013 — Image Bomb Can Lead to DoS in Fdroidserver:update.py 32
4.1.14 OTF-014 — Insecure Usage of Temporary File/Directory in Fdroidserver Docker/drozer.py 33
4.1.15 OTF-015 — Parsing Untrusted XML Data in Fdroidserver 34
4.1.16 OTF-016 — Missing file type and size validation 35
4.1.17 OTF-017 — Use of Insecure Communication Mechanism - BluetoothClient.java 36
4.1.18 OTF-018 — Use of Insecure Communication Mechanism - BluetoothServer.java 37
4.1.19 OTF-019 — Potential SQL Injection 38
4.1.20 OTF-020 — Unverified URI redirect 39
4.1.21 OTF-021 — File Deleted Unconditionally 41
4.1.22 OTF-022 — Secure Temp File Usage Recommended 41
4.1.23 OTF-023 — (fdroidclient) App Is Signed With `SHA1withRSA`, Known to Have Collision Issues 43
4.1.24 OTF-024 — (fdroidclient) Raw SQL Query Executions 45
4.1.25 OTF-025 — (fdroid Client) Snooping in Between Clients in "Nearby Swap" 46
4.1.26 OTF-026 — (fdroid Client) Insecure Implementation of SSL 48
4.1.27 OTF-027 — (Privilege Extension) Mobile application package signed with weak algorithm
`SHA1withRSA` 48
4.1.28 OTF-028 — Tabnabbing in Repomaker 50
4.1.29 OTF-029 — Repomaker:apk:_def_get_type Allows for Mime Type Mismatches 52
4.1.30 OTF-030 — Unsafe HTML Rendering of Arbitrary Input 53
4.1.31 OTF-031 — Dangerous Deserialization Using Python Pickle in Fdroidserver:update.py 54
4.1.32 OTF-032 — Starting a Process With a Partial Executable Path 55
4.1.33 OTF-033 — Maliciously Crafted Appid Code Injection in Fdroidserver Build.py 58
4.1.34 OTF-034 — Missing file type and size validation 59
4.1.35 OTF-035 — Hardcoded root CA keys 60
4.1.36 OTF-036 — Use of weak methods for data protection 60
4.1.37 OTF-037 — Untrusted External Links 61
4.1.38 OTF-038 — Weak pattern matching filter 62
4.2 Non-Findings 63
4.2.1 NF-001 — (fdroid Client) Exploiting the Local Web Server of "Nearby Swap" to Navigate
Directories 63
4.2.2 NF-002 — (fdroid Client) Exploiting Exported Activities and Broadcasts 63
4.2.3 NF-003 — (Privilege Extension) Static Analysis of APK 63
5 Future Work 64
6 Conclusion 65
Appendix 1 Testing team 66
1 Executive Summary
1.1 Introduction
Between February 12, 2018 and April 8, 2018, Radically Open Security B.V. carried out a code audit for Open Tech Fund
This report contains our findings as well as detailed explanations of exactly how ROS performed the code audit.
1.2 Scope of work
The scope of the penetration test was limited to the following target:
• F-droid Client
• F-droid Privileged Extension
• F-droid Repomaker
• F-droid Server
• F-droid Website
1.3 Project objectives
The project objective was to identify vulnerabilities in Fdroid web application and mobile app. This was to be achieved
by performing code audit and pen-test of Fdroid app hosting server application, the Fdroid app for browsing and
downloading apps from Fdroid repositories, and code to create and register app repositories as part of Fdroid
community.
1.4 Timeline
The Security Audit took place between Febuary 12 and April 8, 2018.
1.5 Results In A Nutshell
In all, we report 10 high impact, 18 moderate impact and 10 low impact issues during the course of the code audit and
pen-test.
Some limited impact issues have been found in the code audit of repomaker. Some high impact code execution and
infoleak issues have been found in fdroidserver which allow an adversary to run code in the host running fdroidserver
and the users browsers visiting fdroid.org.
Executive Summary 5
Potentially significant impact issues have been found during the Fdroid client code review, ranging from unverified trust
through use of TOFU to insecure communication leading to MiTM.
During the pen-test, the request-swap functionality of the app potentially allows mailicious requests/messages to be
accepted, and also redirect users to malicious sites. In addition, weaknesses in cryptography usage and potential for
MiTM was discovered.
1.6 Summary of Findings
ID Type Description Threat level
OTF-001 Code Execution The user input sanitizer bleach can be circumvented and High
thus code can be injected into browsers which display the
descriptions of apps.
OTF-002 Code Execution It is possible to craft malicious APK files which contain an High
appid which is being used as a shell injection, allowing
arbitrary code execution.
OTF-003 Code Execution Maliciously crafted metadata can be used to run arbitrary High
code on the fdroidserver host.
OTF-004 Infoleak Attacker controlled URLs can be used first to run a High
regular expression on a local file, then depending on a
match of the expression a second URL can be accessed
or not. This can be used to leak information from the
fdroid host.
OTF-005 Code Execution The value of VercodeOperation supplied in the metadata High
of the app by the adversary is eval-ed in the fdroidserver
script checkupdates.py.
OTF-006 Code Execution A maliciously crafted appid can be used to inject code in High
fdroidserver build.py:1274
OTF-007 Code Execution The linkify function of DescriptionFormatter in fdroidserver High
metadata.py allows for injection of javascript into the
description of packages.
OTF-008 html/JavaScript BluetoothServer.java: Request URI Included in Response High
Injection
OTF-009 Unverified trust Applicatioin uses TrustOnFirstUse (TOFU) potentially High
using unverified signing certificate.
OTF-010 Malicious Use of T