A Plugin for Cross-Language Static Analysis for Vulnerability Detection in Android Applications

Many applications are being written in more than one language to take advantage of the features that different languages provide such as native code support, improved performance, and language-specific libraries. However, there are few static analysis tools currently available to analyze the source code of such multilingual applications. Existing work on cross-language (Java and C/C++) analysis fails to detect cross-language buffer overflow vulnerabilities. In this work, we are addressing how to do cross-language analysis between Java and C/C++. Specifically, we propose an approach to do data flow analysis between Java and C/C++ to detect buffer overflow. We have developed PilaiPidi, a tool that can automatically analyze the data flow in projects written in Java and C/C++. Using our approach, we were able to detect real-world buffer overflow vulnerabilities, which are of cross-language nature, in six different well-known Android applications, and out of these, developers have confirmed 11 vulnerabilities in three applications. This tool is also integrated as a plugin for JetBrains IDEs, specifically for IntelliJ IDEA and Android Studio, due to its practical usefulness in source code analysis for improving Android application security.