[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

PhotoSync v2.2 iOS - Command Inject Web Vulnerability

Document Title:
===============
PhotoSync v2.2 iOS - Command Inject Web Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1290


Release Date:
=============
2014-08-05


Vulnerability Laboratory ID (VL-ID):
====================================
1290


Common Vulnerability Scoring System:
====================================
6.5


Product & Service Introduction:
===============================
It`s all about one thing – the best and easiest way to transfer, backup and 
share your photos & videos! PhotoSync allows you to transfer 
your photos & videos between your iPhone, iPad, Mac or PC over your local Wi-Fi 
network. It also supports sending and receiving photos & 
videos to/from popular cloud & photo services, mobile storage devices and NAS.

( Copy of the Homepage: 
https://itunes.apple.com/en/app/photosync-drahtlos-fotos-und/id415850124 & 
http://www.photosync-app.com/ )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered a command inject web 
vulnerability in the official TouchByte PhotoSync v2.2 iOS (apple) mobile 
application.


Vulnerability Disclosure Timeline:
==================================
2014-08-05: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Touchbyte GmbH
Product: PhotoSync - iOS Mobile Web Application 2.2


Exploitation Technique:
=======================
Local


Severity Level:
===============
High


Technical Details & Description:
================================
A local command/path injection web vulnerabilities has been discovered in the 
official TouchByte PhotoSync v2.2 iOS (apple) mobile application.
The vulnerability allows local attackers to inject commands via stored 
system/device values to compromise the apple mobile iOS application.

The vulnerability is located in the vulnerable `albumname` value of the `index 
file dir` module. Local attackers are able to inject own 
malicious system specific commands or path value requests in the vulnerable 
`albumname` value. The execution of the command occurs in the 
`File Dir Index Listing` module of the photosync mobile application. The 
attacker is able to manipulate the local device values with physical 
or restricted acccess to compromise the mobile application by preparing to 
change the albumname. The encoding of the vulnerable values in the 
`File Dir Index Listing` module is broken.

The attack vector is on the application-side and the injection requires 
physical device access or a local low privileged device user account. 
Local attackers are also able to exploit the albumname validation issue in 
combination with persistent injected script codes.

The security risk of the local command/path inject vulnerability is estimated 
as medium with a cvss (common vulnerability scoring system) count of 6.5.
Exploitation of the command/path inject vulnerability requires a low privileged 
iOS device account with restricted access and no user interaction. 
Successful exploitation of the vulnerability results in unauthorized execution 
of system specific commands and unauthorized path value requests to 
compromise the mobile iOS application or the connected device components.

Request Method(s):
                                [+] [POST]

Vulnerable Module(s):
                                [+] File Dir Wifi

Vulnerable Parameter(s):
                                [+] albumname

Affected Module(s):
                                [+] File Dir Index Listing


Proof of Concept (PoC):
=======================
The command inject web vulnerability can be exploited by local attackers with 
physical or restricted device access without user interaction.
For security demonstration or to reproduce the security vulnerability follow 
the provided information and steps below to continue.


Manual steps to reproduce the vulnerability ...
1. Download and Install the PhotoSync mobile application to your iOS device 
(ipad or iphone) > 
https://itunes.apple.com/en/app/photosync-drahtlos-fotos-und/id415850124
2. Open the default iOS Photo/Pictures App and exchange one of the albumnames 
to the local command inject string
3. Save the settings and close the default iOS photo/pictures app 
4. Now, we start the photosync app
Note: After the start at the bottom of the app is the local wifi web-server ip 
(localhost:8080)
5. Open the local IP
6. The execution directly occurs in the main directory of the file dir index 
listing service
7. Successful reproduce of the local command inject vulnerability!


PoC: File Dir Index Listing (albumname)

<div class="albumentries"><div class="albumentry"><div class="imagepreview"><a 
href="/listAlbum/0">
<img src="/posterImage/0" alt="thumbnail"></a></div><div class="description"><a 
href="/listAlbum/0">
Aufnahmen <span class="count">(24)</span></a></div><div 
class="disclosure"></div></div><div class="section">
<div class="sectiontitle">Alben</div></div><div class="albumentry"><div 
class="imagepreview"><a href="/listAlbum/1">
<img src="/posterImage/1" alt="thumbnail"></a></div><div class="description">
<a href="/listAlbum/1">>"<./[LOCAL COMMAND INJECT VULNERABILITY VIA ALBUMNAME 
VALUE!]"> <span class="count">(0)</span></a></div>
<div class="disclosure"></div></div><div class="albumentry"><div 
class="imagepreview"><a href="/listAlbum/2">
<img src="/posterImage/2" alt="thumbnail" /></a></div><div 
class="description"><a href="/listAlbum/2">
Wallpaper Society <span class="count">(4)</span></a></div><div 
class="disclosure"></div></div></div></div>
</div></div></div></body>
</html></iframe></a></div></div></div>


--- PoC Session Logs [GET] (Execution) ---
Status: 200[OK]
 GET http://localhost:8080/./[LOCAL COMMAND INJECT VULNERABILITY VIA ALBUMNAME 
VALUE!] Load Flags[LOAD_DOCUMENT_URI  ] Größe des Inhalts[0] Mime 
Type[application/x-unknown-content-type]
   Request Header:
      Host[localhost:8080]
      User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:31.0) Gecko/20100101 
Firefox/31.0]
      Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
      Accept-Language[de,en-US;q=0.7,en;q=0.3]
      Accept-Encoding[gzip, deflate]
      Referer[http://localhost:8080/]
      Connection[keep-alive]
   Response Header:
      Accept-Ranges[bytes]
      Content-Length[0]
      Date[Di., 05 Aug. 2014 08:54:54 GMT]


Solution - Fix & Patch:
=======================
The command inject web vulnerability can be patched by a secure parse and 
encode of the local stored albumnames.
Restrict the input and encode on imports to prevent local command injection 
attacks via stored device values.
Encode also the output listing were the context becomes visible to the user and 
use a own exception-handling to block.


Security Risk:
==============
The security risk of the local command inject web vulnerability in the 
albumname value is estimated as high.


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - LariX4 (research@xxxxxxxxxxxxxxxxx) 
[www.vulnerability-lab.com]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any 
warranty. Vulnerability Lab disclaims all warranties, either 
expressed or implied, including the warranties of merchantability and 
capability for a particular purpose. Vulnerability-Lab or its suppliers 
are not liable in any case of damage, including direct, indirect, incidental, 
consequential loss of business profits or special damages, even 
if Vulnerability-Lab or its suppliers have been advised of the possibility of 
such damages. Some states do not allow the exclusion or limitation 
of liability for consequential or incidental damages so the foregoing 
limitation may not apply. We do not approve or encourage anybody to break 
any vendor licenses, policies, deface websites, hack into databases or trade 
with fraud/stolen material.

Domains:    www.vulnerability-lab.com           - www.vuln-lab.com              
                        - www.evolution-sec.com
Contact:    admin@xxxxxxxxxxxxxxxxxxxxx         - 
research@xxxxxxxxxxxxxxxxxxxxx                        - admin@xxxxxxxxxxxxxxxxx
Section:    dev.vulnerability-db.com            - forum.vulnerability-db.com    
                        - magazine.vulnerability-db.com
Social:     twitter.com/#!/vuln_lab             - facebook.com/VulnerabilityLab 
                        - youtube.com/user/vulnerability0lab
Feeds:      vulnerability-lab.com/rss/rss.php   - 
vulnerability-lab.com/rss/rss_upcoming.php            - 
vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php    - 
vulnerability-lab.com/list-of-bug-bounty-programs.php - 
vulnerability-lab.com/register/

Any modified copy or reproduction, including partially usages, of this file 
requires authorization from Vulnerability Laboratory. Permission to 
electronically redistribute this alert in its unmodified form is granted. All 
other rights, including the use of other media, are reserved by 
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, 
advisories, source code, videos and other information on this website 
is trademark of vulnerability-lab team & the specific authors or managers. To 
record, list (feed), modify, use or edit our material contact 
(admin@xxxxxxxxxxxxxxxxxxxxx or research@xxxxxxxxxxxxxxxxxxxxx) to get a 
permission.

                                Copyright © 2014 | Vulnerability Laboratory 
[Evolution Security]



-- 
VULNERABILITY LABORATORY RESEARCH TEAM
DOMAIN: www.vulnerability-lab.com
CONTACT: research@xxxxxxxxxxxxxxxxxxxxx