[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
OYO File Manager 1.1 iOS&Android - Multiple Vulnerabilities
- To: bugtraq@xxxxxxxxxxxxxxxxx, bugs@xxxxxxxxxxxxxxxxxxx
- Subject: OYO File Manager 1.1 iOS&Android - Multiple Vulnerabilities
- From: Vulnerability Lab <research@xxxxxxxxxxxxxxxxxxxxx>
- Date: Mon, 18 May 2015 10:51:57 +0200
Document Title:
===============
OYO File Manager 1.1 iOS&Android - Multiple Vulnerabilities
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1494
Release Date:
=============
2015-05-18
Vulnerability Laboratory ID (VL-ID):
====================================
1493
Common Vulnerability Scoring System:
====================================
6.9
Product & Service Introduction:
===============================
OYO File Manager, helps you to manage files in your mobile from your computer
over wifi, without USB cable. Also, view your photo albums, play songs and
videos.
Store files in drive page and do all the file operations, such as Create, Move,
Delete, Edit, Copy, Rename, Zip, unzip, and get information about file.
(Copy of the Vendor Homepage:
https://itunes.apple.com/us/app/oyo-file-manager/id981145759 &
https://play.google.com/store/apps/details?id=com.whatbig.filemanager )
Abstract Advisory Information:
==============================
The Vulnerability Laboratory Core Research team discovered multiple
Vulnerabilities in the official OYO File Manager v1.1 iOS & Android mobile
web-application.
Vulnerability Disclosure Timeline:
==================================
2015-05-18: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
Balaji Rajan
Product: OYO File Manager - iOS & Android 1.1
Exploitation Technique:
=======================
Remote
Severity Level:
===============
High
Technical Details & Description:
================================
1.1 Local File Include Vulnerability
A local file include web vulnerability has been discovered in the official OYO
File Manager v1.1 iOS & Android mobile web-application.
The file include vulnerability allows remote attackers to unauthorized include
local file/path requests to compromise the mobile web-application.
The web vulnerability is located in the `filename` value of the
`upload(GCDWebUploader)` module. Attackers are able to inject own files with
malicious
`filename` values in the `upload` POST method request to compromise the mobile
web-application. The local file/path include execution occcurs in
the index file dir listing and sub folders of the wifi interface. The attacker
is able to inject the local file include request by usage of the
`wifi interface` in connection with the vulnerable file upload POST method
request. Injects are also possible via local file sync function.
Local attackers are also able to exploit the filename issue in combination with
persistent injected script code to execute different malicious
attack requests.
The security risk of the local file include vulnerability is estimated as high
with a cvss (common vulnerability scoring system) count of 6.5.
Exploitation of the local file include web vulnerability requires no user
interaction or privileged web-application user account.
Successful exploitation of the local file include vulnerability results in
mobile application compromise or connected device component compromise.
Request Method(s):
[+] [POST]
Vulnerable Module(s):
[+] upload (GCDWebUploader)
Vulnerable Parameter(s):
[+] filename
Affected Module(s):
[+] Index File Dir Listing
(http://localhost:8080/)
1.2 Local Command Injection Vulnerability
A local command inject web vulnerability has been discovered in the official
OYO File Manager v1.1 iOS & Android mobile web-application.
The issue allows remote attackers to inject own commands by usage of stable
device values to compromise the ios or android mobile web-application.
The command inject vulnerability is located in the vulnerable `devicename`
value of the `index` module. Local attackers are able to inject own
own malicious system specific commands to requests the vulnerable `devicename`
value. The devicename value is displayed in the header location
of the file dir index module. The execution point is in the main index context
and the injection point is the local device to app sync.
The attack vector is located on the application-side and the injection requires
physical device access or a local low privileged device user account.
Local attackers are also able to exploit the devicename validation issue in
combination with persistent injected script codes.
The security risk of the local command/path inject vulnerability is estimated
as medium with a cvss (common vulnerability scoring system) count of 5.6.
Exploitation of the command/path inject vulnerability requires a low privileged
ios/android device account with restricted access and no user interaction.
Successful exploitation of the vulnerability results in unauthorized execution
of system specific commands to compromise the mobile Android/iOS application
or the connected device components.
Request Method(s):
[+] [SYNC]
Vulnerable Module(s):
[+] Path Listing
Vulnerable Parameter(s):
[+] devicename
1.3 Remote Path Traversal Vulnerability
A Path Traveral web vulnerability has been discovered in the official OYO File
Manager v1.1 iOS & Android mobile web-application.
The security vulnerability allows remote attackers to unauthorized request
system path variables to compromise the mobile application or device.
The vulnerability is located in the `path` value of the `open and list`
interface module. Remote attackers are able to change the path variable
to unauthorized request device files or directories. The vulnerability can be
exploited by local or remote attackers without user interaction.
The attack vector is located on the application-side of the service and the
request method to execute is GET (client-side).
The security risk of the path traversal web vulnerability is estimated as high
with a cvss (common vulnerability scoring system) count of 6.9.
Exploitation of the directory traversal web vulnerability requires no
privileged application user account or user interaction.
Successful exploitation of the vulnerability results in mobile application
compromise.
Request Method(s):
[+] GET
Vulnerable Module(s):
[+] open
[+] list
Vulnerable Parameter(s):
[+] path
Affected Module(s):
[+] Index File Dir Listing
(http://localhost:8080/)
Proof of Concept (PoC):
=======================
1.1
The file include web vulnerability can be exploited by local attackers without
privileged application user account or user interaction.
For security demonstration or to reproduce the vulnerability follow the
provided information and steps below to continue.
Manual steps to reproduce the vulnerability ...
1. Open the interface
2. Start a session tamper
3. Upload a reandom file
4. Change in the upload POST method request the vulnerable filename to a local
file variable
Note: The website reloads
5. The execution occurs in the main file dir index were the upload has been
replaced
6. Successful reproduce of the mobile web vulnerability!
--- PoC Session Logs [POST] ---
Status: 200[OK]
POST http://localhost/upload
Load Flags[LOAD_BYPASS_CACHE ] Größe des Inhalts[2] Mime Type[application/json]
Request Header:
Host[localhost]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:37.0) Gecko/20100101
Firefox/37.0]
Accept[application/json, text/javascript, */*; q=0.01]
Accept-Language[de,en-US;q=0.7,en;q=0.3]
Accept-Encoding[gzip, deflate]
X-Requested-With[XMLHttpRequest]
Referer[http://localhost/]
Content-Length[831]
Content-Type[multipart/form-data;
boundary=---------------------------33361466725643]
Connection[keep-alive]
Pragma[no-cache]
Cache-Control[no-cache]
POST-Daten:
POST_DATA[-----------------------------33361466725643
Content-Disposition: form-data; name="path"/test23/
-----------------------------33361466725643
Content-Disposition: form-data; name="files[]"; filename="../[LOCAL FILE
INCLUDE VULNERABILITY!]testfile.png"
Content-Type: image/png
- Response
Status=OK - 200
Server=GCDWebUploader
Cache-Control=no-cache
Content-Length=2
Content-Type=application/json
Connection=Close
Date=Tue, 12 May 2015 12:24:23 GMT
Reference(s):
http://localhost/upload
1.2
The local command inject web vulnerability can be exploited by local attackers
with low privilege application user account and low user interaction.
For security demonstration or to reproduce the vulnerability follow the
provided information and steps below to continue.
Manual steps to reproduce the vulnerability ...
1. Install the android or ios application to your device
2. Start the application
3. Change the local devicename value in the ios settings to a own payload
string (local command inject)
4. Save the settings
5. Open the wifi interface and watch the index webserver site
6. The execution occurs in the header location of the webpage were the
devicename value is visible
6. Successful reproduce of the mobile web vulnerability!
PoC:
<spna><img src="img/OYO.png" alt="OYO" style="margin-left:-30px;" height="87"
width="87"><span> </span>
<span style="font-size:20px;">[LOCAL COMMAND INJECT VULNERABILITY!]23</span>
<span style="font-size: 15px;color: #CCCCCC;">IOS Version 8.3</span>
<span style="float:right;font-size:18px;width:400px;">
<div class="progress">
<div class="progress-bar progress-bar-success"
role="progressbar" aria-valuenow="1394098176.00" aria-valuemin="0"
aria-valuemax="12.74" style="width:95.22%">
25.89 GB used</div>
<!-- <span
style="font-size:10px;padding-left:20px;padding-bottom:5px;"> 1.30 GB Free
Space</span>-->
<!-- Drag & drop files OR Just upload your Files-->
<div class="progress-bar progress-bar-warning"
role="progressbar" aria-valuenow="25.89 GB" aria-valuemin="0"
aria-valuemax="12.74" style="width:4.78%">
1.30 GB free space
</div></div></span></spna>
1.3
the path traversal web vulnerability can be exploited by remote attackers
without user interaction or privilege web application user account.
For security demonstration or to reproduce the vulnerability follow the
provided information and steps below to continue.
PoC: Payload(s)
http://localhost/list?path=%2F%22%3E%3C../../../../../[DIRECTORY TRAVERSAL]%3E/
http://localhost/open?path=%2F%22%3E%3C../../../../../[DIRECTORY TRAVERSAL]%3E/
http://localhost/download?path=%2F%22%3E%3C../../../../../[DIRECTORY
TRAVERSAL]%3E/
--- PoC Session Logs [GET] ---
Status: 200[OK]
GET http://localhost/list?path=%2F%22%3E%3C../../../../../[DIRECTORY
TRAVERSAL]%3E/PENG.png
Load Flags[LOAD_BACKGROUND ] Größe des Inhalts[59] Mime Type[application/json]
Request Header:
Host[localhost]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:37.0) Gecko/20100101
Firefox/37.0]
Accept[application/json, text/javascript, */*; q=0.01]
Accept-Language[de,en-US;q=0.7,en;q=0.3]
Accept-Encoding[gzip, deflate]
X-Requested-With[XMLHttpRequest]
Referer[http://localhost/]
Connection[keep-alive]
Response Header:
Server[GCDWebUploader]
Cache-Control[no-cache]
Content-Length[59]
Content-Type[application/json]
Connection[Close]
Date[Tue, 12 May 2015 12:24:25 GMT]
14:21:43.214[9ms][total 9ms] Status: 200[OK]
GET http://localhost/open?path=/%22%3E%3C../../../../../[DIRECTORY
TRAVERSAL]%3E/PENG.png Load Flags[LOAD_NORMAL] Größe des Inhalts[538] Mime
Type[image/png]
Request Header:
Host[localhost]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:37.0) Gecko/20100101
Firefox/37.0]
Accept[image/png,image/*;q=0.8,*/*;q=0.5]
Accept-Language[de,en-US;q=0.7,en;q=0.3]
Accept-Encoding[gzip, deflate]
Referer[http://localhost/]
Connection[keep-alive]
Response Header:
Etag[8831597/1431433463/0]
Last-Modified[Tue, 12 May 2015 12:24:23 GMT]
Server[GCDWebUploader]
Content-Type[image/png]
Content-Length[538]
Connection[Close]
Date[Tue, 12 May 2015 12:24:25 GMT]
Cache-Control[no-cache]
Reference(s):
http://localhost/list?path=
http://localhost/open?path=
http://localhost/download?path=
Solution - Fix & Patch:
=======================
1.1
The local file include web vulnerability can be patched by a secure parse and
encode of the vulnerable filename value in the upload POST method request.
Restrict the input and disallow special chars. Parse the output in the file dir
index list to prevent local file include attacks via upload.
1.2
Restrict the devicename value and disallow special chars. Encode the devicename
value to prevent local command injection attacks.
1.3
The directory traversal web vulnerability can be patched by a secure
restriction and parse of the path name value in the open and list module
context.
Encode the input of files to folders and disallow special chars. Implement a
whitelist or a exception to prevent unauthorized path value requests via GET
method.
Security Risk:
==============
1.1
The security risk of the local file include web vulnerability in the filename
value of the manager is estimated as high. (CVSS 6.5)
1.2
The security risk of the local command inject web vulnerability in the
devicename value of the manager is estimated as high. (CVSS 5.6)
1.3
The security risk of the path traversal web vulnerability in the path value of
the manager is estimated as high. (CVSS 6.9)
Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri
(bkm@xxxxxxxxxxxxxxxxx) [www.vulnerability-lab.com]
Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any
warranty. Vulnerability Lab disclaims all warranties, either expressed
or implied, including the warranties of merchantability and capability for a
particular purpose. Vulnerability-Lab or its suppliers are not liable
in any case of damage, including direct, indirect, incidental, consequential
loss of business profits or special damages, even if Vulnerability-Lab
or its suppliers have been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for
consequential or incidental damages so the foregoing limitation may not apply.
We do not approve or encourage anybody to break any vendor licenses,
policies, deface websites, hack into databases or trade with fraud/stolen
material.
Domains: www.vulnerability-lab.com - www.vuln-lab.com
- www.evolution-sec.com
Contact: admin@xxxxxxxxxxxxxxxxxxxxx -
research@xxxxxxxxxxxxxxxxxxxxx - admin@xxxxxxxxxxxxxxxxx
Section: magazine.vulnerability-db.com -
vulnerability-lab.com/contact.php -
evolution-sec.com/contact
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab
- youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php -
vulnerability-lab.com/rss/rss_upcoming.php -
vulnerability-lab.com/rss/rss_news.php
Programs: vulnerability-lab.com/submit.php -
vulnerability-lab.com/list-of-bug-bounty-programs.php -
vulnerability-lab.com/register/
Any modified copy or reproduction, including partially usages, of this file
requires authorization from Vulnerability Laboratory. Permission to
electronically redistribute this alert in its unmodified form is granted. All
other rights, including the use of other media, are reserved by
Vulnerability-Lab Research Team or its suppliers. All pictures, texts,
advisories, source code, videos and other information on this website
is trademark of vulnerability-lab team & the specific authors or managers. To
record, list (feed), modify, use or edit our material contact
(admin@xxxxxxxxxxxxxxxxxxxxx or research@xxxxxxxxxxxxxxxxxxxxx) to get a
permission.
Copyright © 2015 | Vulnerability Laboratory -
[Evolution Security GmbH]™
--
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
CONTACT: research@xxxxxxxxxxxxxxxxxxxxx
PGP KEY:
http://www.vulnerability-lab.com/keys/admin@xxxxxxxxxxxxxxxxxxxxx%280x198E9928%29.txt