cobol-shield

Security auditing toolkit for COBOL legacy systems

Part of VTR Research Methodology | DOI: 10.5281/zenodo.22063208 Status: Reproducible | License: MIT | Track: Critical Infrastructure

What it does

Detects compilation context divergences, invisible Unicode attacks, and unsafe COBOL patterns in GnuCOBOL sources. The same source file compiled with -fixed vs -free produces different programs — this tool makes that divergence observable and reproducible.

How to reproduce in 3 commands

git clone https://github.com/LuisCastellanos-dev/cobol-shield
cd cobol-shield
bash tools/poc_compiler_flag.sh

What it is NOT

This tool does not claim or demonstrate remote code execution, privilege escalation, or network exploitation. Findings are classified as CONFIRMADO, PROBABLE, or OBSERVADO per VTR methodology — classification reflects strength of evidence, not severity of impact.

Security auditing toolkit for COBOL legacy systems

Detects invisible Unicode attacks, unsafe COBOL patterns, and format transformation integrity issues in GnuCOBOL sources. Validated with GnuCOBOL 3.1.2. Behavior on IBM Enterprise COBOL or Micro Focus not verified — compiler-specific flag semantics may differ.

PIC X accepts everything. Your batch shouldn't.

Scope

cobol-shield covers two distinct threat surfaces:

1. Unicode Invisible Characters — CVE-2021-42574 and Glassworm-class vectors that bypass visual code review and corrupt PIC X fields silently.

2. COBOL Static Analysis — unsafe patterns in legacy sources: uninitialized working-storage, unchecked STRING/UNSTRING overflow, REDEFINES size mismatches, and fixed-format positional conditions that change meaning under transformation.

Tools

Static Analysis Rules

Each rule produces a VTR Finding Schema v1 output compatible with cryptofault and vtr-forensic-img via context_loader.

R-01 — UNINITIALIZED_WS Detects Working-Storage variables declared without a VALUE clause and without INITIALIZE or MOVE in the PROCEDURE DIVISION. Silent undefined behavior risk in batch and CICS environments.

R-02 — UNSTRING_NO_OVERFLOW Detects STRING/UNSTRING statements without ON OVERFLOW handling. Silent truncation when input exceeds target field length.

R-03 — REDEFINES_SIZE_MISMATCH Detects REDEFINES where the redefined field declares more bytes than its base. Memory boundary violation risk — compiler-dependent behavior.

R-04 — FORMAT_BOUNDARY_ANALYSIS (Phase 1 — observations only) Detects positional conditions in fixed-format COBOL sources:

• COL73_NONEMPTY — non-space content in identification area (cols 73–80)
• COL7_VERB — COBOL executable verb in a commented line (col7 = * / / / D)
• SOURCE_BOUNDARY — content beyond col 80

R-04 produces severity=info, classification=PROYECCION. It documents format conditions — not vulnerabilities. Impact requires transformation differential analysis (Phase 2).

Compiler Flag Semantic Divergence — Definitive PoC

The central thesis: a COBOL fixed-format file has different semantics depending on the compiler flag used to build it — and that flag lives outside the source file.

Demonstrated with GnuCOBOL 3.1.2, single artifact, no modification:

bash tools/poc_compiler_flag.sh

cobc -x -fixed poc-same-file.cbl → compiles → output: 0000001000
cobc -x -free  poc-same-file.cbl → 10 compilation errors

Under -fixed: line 6 col7=* is the comment indicator — MOVE 999999 is dormant, program executes and displays 1000.

Under -free: sequence numbers 000100...001000 are parsed as numeric literals — PROGRAM-ID header is reported missing, every line produces an error. The same file is syntactically invalid.

The compiler flag is not inside the source file. It lives in the Makefile, CI configuration, or operator invocation. Changing it — intentionally or accidentally — changes whether the program is valid and what it does.

Evidence: corpus/fixed-format/poc-evidence.md
SHA-256 and full error log documented.

Transformation Differential — Phase 2 (manual migration)

An earlier PoC demonstrates the same thesis via manual migration:

SOURCE A (fixed-format, col7='*' dormant):   output → 0000001000
SOURCE B (free-format,  code active):         output → 0000999999

SHA-256 A: b70a948a0df5e8f685e82f5bffc9c4710f2c0a7a23b6294e7ca20092c2d25d37
SHA-256 B: f5fd80f79ed3e5be97628f89790256d6fba80605dce2b7985b729b5fef6f26d5

Limitation: SOURCE B is a manual representation of incorrect migration, not the output of IBM Z Open Editor or IBM SCU under real renumbering. The compiler flag PoC above does not have this limitation.

Unicode Detection

Detected ranges:

# Byte-level inspection
hexdump -C source.cob | grep -E "e2 80 (8b|ae)"

Usage

# Unicode CI check — exits 1 on detection
python3 tools/check-invisibles.py .

# Sanitize with forensic audit log
python3 tools/clean-invisibles.py . --report audit-$(date +%Y%m%d).log

# Run static analysis rules
python3 -c "
from tools.cobol_rules import scan_path_r01, scan_path_r02, scan_path_r03, scan_path_r04
import json
for f in scan_path_r02('your-source.cbl'):
    print(f.to_json())
"

# Transformation differential PoC
bash tools/poc_differential.sh

GitHub Action

- name: Check for invisible Unicode
  run: python3 tools/check-invisibles.py .

Why COBOL

PIC X(n) is a raw byte buffer. It accepts any byte sequence without validation. When a Zowe API layer passes JSON to a COBOL copybook via MOVE, invisible Unicode enters the record silently.

Fixed-format COBOL adds a second surface: positional column semantics (col 7 as indicator area, cols 73–80 as identification area) are format-dependent. A migration tool that does not preserve these semantics can activate dormant code or silently corrupt program structure.

The shared mechanism with CVE-2021-42574 is the detection gap — content that bypasses visual inspection. The data-field truncation vector and the format transformation vector are distinct from the source-code semantic flip described in CVE-2021-42574.

Test Suite

pip install pytest
python -m pytest tests/ -q
# 159 tests, 0 failures

References

• CVE-2021-42574 — Trojan Source
• Glassworm — Aikido Security, March 2026
• IBM Enterprise COBOL Programming Guide — Source Format
• GnuCOBOL Programmer's Guide
• Open Mainframe Project — Zowe
• VTR Finding Schema v1 — tools/vtr_finding.py

Known Limitations

Compiler scope: All rules validated against GnuCOBOL 3.1.2 only. IBM Enterprise COBOL and Micro Focus COBOL have different flag semantics, column boundary behavior, and extension support. Results on those compilers are unverified — classify as INFERENCIA until tested.

R-04 keyword matching (COL7_VERB): Detection of COBOL verbs in commented lines uses a fixed keyword list. A commented line containing a security-relevant verb not in the list produces a false negative. R-04 is classified PROYECCION for this reason — it documents conditions, not confirmed vulnerabilities.

cfg-shield analog — feature name dependency: The cross-language methodology documented in METHODOLOGY.md assumes feature/flag names follow recognizable conventions. A security-relevant flag with a non-descriptive name (e.g., legacy, compat) may not be classified correctly without manual review.

Single-compiler PoC: The definitive PoC (poc-same-file.cbl) demonstrates divergence under GnuCOBOL. The same divergence class is expected but not yet verified under other COBOL compilers.

License

MIT

Luis F. Castellanos — Applied Cryptography & Systems Engineering · FreeBSD / Rust · COBOL Legacy Auditing · Founder @ Vector Telemetry Research

Traction

• FreeBSD commit rGa841961da752 merged into base system
• IBM Bank-of-Z Issue #205 — systemic timestamp defect identified and reported upstream
• SCaLE 24x submission: Same Source, Different Program: Compilation Context as a Security Variable — pending November 2026
• Preprint: DOI 10.5281/zenodo.22063208 — v2.0.0 (2026-08-23)