Cypher query

[ksecurity45]

I am looking for a working Cypher query that calls the procedure tabby.algo.findPath. Can you help me with that?

When defining the source, I want to include all methods that take a String as a parameter and extend java.rmi.Remote. So all methods which can be called in RMI and take atlest one string parameter are my source The sink method should be executeQuery.

Please fill in the following template:

name: "web_to_code"
type: "web"
source:
type: "source"
endpoint: true
sink:
type: "sink"
sink: true
vul: "CODE"
depth: 8
limit: 10
procedure: "tabby.algo.findPath"
sourceBlacklists: []
pathBlacklists:

• "java.lang.Iterable#forEach"

[ksecurity45]

For example i know

getFunctionByCode is a method which is in class which extends remote and sink is called but this does not return any data.

match (source:Method {NAME:"getFunctionByCode"})
match (sink:Method {NAME:"executeQuery"})
call tabby.algo.findPath(source, "-", sink, 8, false) YIELD path
return path

[wh1t3p1g]

First, try to confirm the cypher you provided will return correct data. Then, try to use cypher configuration to set a more custom usage. The case like https://github.com/wh1t3p1g/tabby-vul-finder/blob/main/rules/benchmark/cc4-aj.yml#L6
According you provided, use yaml like

name: "web_to_sql"
enable: true
type: "web"
source:
  type: "source"
  cypher: "match (source:Method {NAME:\"getFunctionByCode\"})"
sink:
  type: "sink"
  sink: true
  name: "executeQuery"
depth: 10
limit: 1
direct: "-"
procedure: "tabby.algo.findPath"
sourceBlacklists: []
pathBlacklists: []

Also, use a more simple usage, like

name: "web_to_sql"
enable: true
type: "web"
source:
  type: "source"
  name: "getFunctionByCode"
sink:
  type: "sink"
  sink: true
  name: "executeQuery"
depth: 10
limit: 1
direct: "-"
procedure: "tabby.algo.findPath"
sourceBlacklists: []
pathBlacklists: []

[ksecurity45]

I have tested this one.

The file : cyphers.yml

name: "web_to_sql"
enable: true
type: "web"
source:
  type: "source"
  name: "getFunctionByCode"
sink:
  type: "sink"
  sink: true
  name: "executeQuery"
depth: 10
limit: 1
direct: "-"
procedure: "tabby.algo.findPath"
sourceBlacklists: []
pathBlacklists: []

Using command : java -jar tabby-vul-finder.jar query khan rules/cyphers.yml

Output: Found 0 path for web_to_sql

I tried to test using neo4j browser.

Any idea why this procedure tabby.algo.findPath is not working ?

match (source:Method {HAS_PARAMETERS:true}) where source.NAME = "getFunctionByCode" 
match (sink:Method {HAS_PARAMETERS:true}) where sink.NAME = "executeQuery" 
CALL tabby.algo.findPath(source, "-", sink, 10, false) YIELD path
return path 

[wh1t3p1g]

That maybe the analysis was not correct to this case which means the taint propagation stop on somewhere. But the v1.x version of taint algorithm do not maintain anymore. I will release v2.x after blackhat eu, before this release you can find the point where stop the propagation, then add manual rule to system.json which will re-connect the propagation.

[ksecurity45]

Any idea how i can debug and find where the propagation stoped and example of rule which will re-connect the propagation. . Thanks alot :)

[wh1t3p1g]

1. collate the actual propagate path about your case.
2. using neo4j browser, search the start node, and then open all related nodes
3. compare to the path you collated, check the data on Call edge (POLLUTED_POSITION) which if the taint propagate correctly. The propagation rule can find at https://blog.0kami.cn/blog/2023/%E5%9F%BA%E4%BA%8E%E4%BB%A3%E7%A0%81%E5%B1%9E%E6%80%A7%E5%9B%BE%E7%9A%84%E8%87%AA%E5%8A%A8%E5%8C%96%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98%E5%AE%9E%E8%B7%B5/#2

[wh1t3p1g]

But i suggest to wait the v2 of tabby. If v2 also can't get the right path, you can provide the jar file to me. I will debug and find why stopped.

[ksecurity45]

Hi Did you already released the version 2 ? ALso you have any new Talk or blackhat eu video for talk related to Tabby ?

[wh1t3p1g]

I'm preparing to release a new version, v2 will be released this week.