[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-disclosure] Transferable Remote v1.1 iPad iPhone - Multiple Web Vulnerabilities
- To: full-disclosure@xxxxxxxxxxxxxxxxx
- Subject: [Full-disclosure] Transferable Remote v1.1 iPad iPhone - Multiple Web Vulnerabilities
- From: Vulnerability Lab <research@xxxxxxxxxxxxxxxxxxxxx>
- Date: Wed, 13 Feb 2013 02:46:52 +0100
Title:
======
Transferable Remote v1.1 iPad iPhone - Multiple Web Vulnerabilities
Date:
=====
2013-02-09
References:
===========
http://www.vulnerability-lab.com/get_content.php?id=863
VL-ID:
=====
863
Common Vulnerability Scoring System:
====================================
8.5
Introduction:
=============
Transferable is the easiest way to download photos from your iPhone, iPad or
iPod Touch to your Mac or PC!
Transferable let`s you download your photos and albums using just a web browser
- no need for iTunes or even
plugging your device in! As soon as the app launches it displays a web address,
simply type this into a web
browser on your PC or Mac and you will be able to browse, download or upload
photos and albums!
- Easy to use interface
- Wifi Transfer - iTunes not required
- Download single pictures or whole albums!
- Upload photos from your PC/Mac to your iPhone, iPad or iPod Touch
- Star your favorite photos for download
- No limit on number of photos that can be downloaded
- Works with any web browser - no installation required!
- View Thumbnails and full resolution pictures
- Download photos as a zip
Transferable requires a wifi connection and an iphone or ipad device with iOS.
(Copy of the Homepage:
https://itunes.apple.com/us/app/transferable-pro-wifi-photo/id518154149)
Abstract:
=========
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities
in the mobile Transferable Remote v1.01 app for the apple ipad & iphone.
Report-Timeline:
================
2013-02-09: Public Disclosure
Status:
========
Published
Affected Products:
==================
Apple AppStore
Product: Transferable Remote 1.01
Exploitation-Technique:
=======================
Remote
Severity:
=========
Critical
Details:
========
1.1
A local file include web vulnerability via POST request method is detected in
the mobile Transferable Remote v1.01 app for the apple ipad & iphone.
The vulnerability allows remote attackers via POST method to inject local app
webserver folders to request unauthorized local webserver files.
The vulnerbility is located in the downloadPhoto module of the webserver
(http://192.168.0.10:80) when processing to load a manipulated
`assets-library` url parameter. The execution of the injected path or file
request will occur when the attacker is processing to reload
to index listing of the affected module.
Exploitation of the web vulnerability does not require a privileged application
user account (standard) or user interaction.
Successful exploitation of the vulnerability results in unauthorized path or
file access via local file or path include attack.
Vulnerable Application(s):
[+] Transferable Remote v1.0 - ITunes or
AppStore (Apple)
Vulnerable Module(s):
[+] downloadPhoto
Vulnerable Parameter(s):
[+] assets-library
Affected Module(s):
[+] Index Listing
1.2
A local command injection web vulnerability is detected in the mobile
Transferable Remote v1.01 app for the apple ipad & iphone.
The vulnerability allows to inject local commands via vulnerable system values
to compromise the apple mobile application.
The vulnerbility is located in the index module when processing to load the
ipad or iphone device name. Local attackers can change the
ipad or iphone device name to system specific commands and file/path requests
to provoke the execution when processing to watch the index listing.
Exploitation of the web vulnerability does not require a privileged application
user account (standard) or user interaction.
Successful exploitation of the vulnerability results unauthorized execution of
system specific commands and path requests.
Vulnerable Application(s):
[+] Transferable Remote v1.0 - ITunes or
AppStore (Apple)
Vulnerable Module(s):
[+] Index
Vulnerable Parameter(s):
[+] device name - iPad or iPone
Affected Module(s):
[+] Index Listing (Device Name)
1.3
A persistent input validation vulnerability is detected in the mobile
Transferable Remote v1.01 app for the apple ipad & iphone.
The bug allows an attacker (remote) to implement/inject malicious script code
on the application side (persistent) of the app web service.
The vulnerability is located in the downloadCollection module of the webserver
(http://192.168.0.10:80) when processing to request
via POST manipulated name, ext and url parameters. The persistent script code
will be executed out of the downloadcollection module listing.
Exploitation of the vulnerability requires low or medium user interaction and
with low or medium privileged application user account.
Successful exploitation of the vulnerability can lead to persistent session
hijacking (customers), account steal via persistent web
attacks, persistent phishing or stable (persistent) certificate mail
notification context manipulation.
Vulnerable Application(s):
[+] Transferable Remote v1.0 - ITunes or
AppStore (Apple)
Vulnerable Module(s):
[+] downloadCollection
Vulnerable Parameter(s):
[+] url & ext
Affected Module(s):
[+] Index Listing (Device Name)
1.4
A non-persistent cross site scripting vulnerability is detected in the mobile
Transferable Remote v1.01 app for the apple ipad & iphone.
The vulnerability allows remote attackers to form manipulated request to hijack
employeerss, moderator or admin sessions via client side
browser attack.
The vulnerability is located in the appliance invalid Exception Handling module
and the not secure parsed path & id variables.
Successful exploitation of the vulnerability result in account steal via client
side session hijacking, client site phishing, or
client-side content request manipulation.
Vulnerable Application(s):
[+] Transferable Remote v1.0 - ITunes or
AppStore (Apple)
Vulnerable Module(s):
[+] Index
Vulnerable Module(s):
[+] page and bound id
Affected Module(s):
[+] Exception Handling (Error) Listing
Proof of Concept:
=================
1.1
The local File Include web vulnerability can be exploited by remote attacker
without required application user account (no password: standard)
and also without user interaction. For demonstration or reproduce ...
Local Path Include Vulnerability
PoC:
http://192.168.0.10/downloadPhoto/assets-library://[INCLUDE FILE, PATH OR
URL]<(POST)
Reference(s):
http://192.168.0.10/downloadPhoto/
1.2
The command injection web vulnerability can be exploited by local attacker with
required device application user account and with
low user interaction. For demonstration or reproduce ...
Command Injection via Devicename
PoC:
{"devcname":"IPad360 ¥337","devctype":"ipad","pro":"false"}
...
{"devcname":"[COMMAND INJECTION VIA
DEVICENAME]","devctype":"ipad","pro":"false"<OR true;)}
Reference(s):
http://192.168.0.10/getSettings
http://192.168.0.10/
1.3
The persistent validation web vulnerability can be exploited by remote
attackers with required application user account and with
low or medium user interaction. For demonstration or reproduce ...
POST Inject via Download marked (star) files
PoC: (POST)
input=%5B%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DF102FE64-1463-4150-8FF8-0A512E7EB278%26
ext%3DJPG%22%2C%22name%22%3A%22<[INJECTED SCRIPT CODE!]")
<.JPG%22%2C%22search%22%3A%22<[INJECTED SCRIPT CODE!]")
<JPG%22%7D%2C%7B%22url%22%3A%22
assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D7A40B84F-CE2A-40C7-87C9-C66927626F66%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0004.JPG%22%2C%22search
%22%3A%22IMG0004JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D11E8FF27-B3A4-46B9-B320-74EFBDF9760D%26ext%3DJPG%22%2C
%22name%22%3A%22IMG_0008.JPG%22%2C%22search%22%3A%22IMG0008JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG
%3Fid%3D8EC135C1-D1DF-458F-B7B5-75DF2EB87B06%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0010.JPG%22%2C%22search%22%3A%22IMG0010JPG%22%7D%2C%7B%22url
%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DAD9CA73F-1ED4-4708-83DB-AC27441D9CC5%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0011.JPG%22
%2C%22search%22%3A%22IMG0011JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D2DF297C4-1EC7-4B96-8B74-F4923AF9FBDA%26
ext%3DJPG%22%2C%22name%22%3A%22IMG_0012.JPG%22%2C%22search%22%3A%22IMG0012JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG
%3Fid%3D7A8B8F5B-B524-44E3-8C99-6DB2AB258E66%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0013.JPG%22%2C%22search%22%3A%22IMG0013JPG%22%7D%2C%7B%22url%22
%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D76E366E9-AAF2-41A5-8D9C-599F1242001D%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0014.JPG%22%2C%22
search%22%3A%22IMG0014JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D27000044-675B-4C67-A4ED-2EA38B8318E5%26ext%3D
JPG%22%2C%22name%22%3A%22IMG_0015.JPG%22%2C%22search%22%3A%22IMG0015JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D
4C0729AE-7BBC-4DC6-BDF4-62E7D48AE167%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0016.JPG%22%2C%22search%22%3A%22IMG0016JPG%22%7D%2C%7B%22url%22%3A%22
assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D5457AD21-66CD-4CF4-8F3E-1ACE66761742%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0017.JPG%22%2C%22search
%22%3A%22IMG0017JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DCA15604D-4344-4739-9B7D-4B2B87BFC04E%26ext%3DJPG%22
%2C%22name%22%3A%22IMG_0018.JPG%22%2C%22search%22%3A%22IMG0018JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D
20BDBEC2-3B0E-435E-87B5-5DF1228D8164%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0019.JPG%22%2C%22search%22%3A%22IMG0019JPG%22%7D%2C%7B%22url%22%3A%22
assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DD69EDCA7-632F-417B-895A-88B6900282EE%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0020.JPG%22%2C%22search
%22%3A%22IMG0020JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D0207435E-10A3-4F4E-8B49-05E891C4BC0A%26ext%3DJPG
%22%2C%22name%22%3A%22IMG_0021.JPG%22%2C%22search%22%3A%22IMG0021JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3F
id%3D4A9763CC-8EB3-4B12-802F-3C3E5A092CD2%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0022.JPG%22%2C%22search%22%3A%22IMG0022JPG%22%7D%2C%7B%22url%22
%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D5AF6F15B-6F68-48E8-9ACB-8D424A3C8AEB%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0023.JPG%22%2C
%22search%22%3A%22IMG0023JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D3477F60C-DD79-4022-B1FB-37F1038E89C2%26
ext%3DJPG%22%2C%22name%22%3A%22IMG_0024.JPG%22%2C%22search%22%3A%22IMG0024JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG
%3Fid%3D1A072B2E-8869-4845-A9DF-EB1C5BAA6728%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0025.JPG%22%2C%22search%22%3A%22IMG0025JPG%22%7D%2C%7B%22url
%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DA7611789-4D0B-42D0-91CA-8D268C0D9721%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0026.JPG%22
%2C%22search%22%3A%22IMG0026JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DF0D4C1E7-9318-46F3-A539-B2140BD5A10A%26
ext%3DJPG%22%2C%22name%22%3A%22IMG_0027.JPG%22%2C%22search%22%3A%22IMG0027JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG
%3Fid%3D2433465E-2C1E-4133-8FA0-D4800BF334A8%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0028.JPG%22%2C%22search%22%3A%22IMG0028JPG%22%7D%2C%7B%22url%22
%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D712872C7-7A34-452A-816D-57DB34ABD3F3%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0029.JPG%22%2C%22
search%22%3A%22IMG0029JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D3874F42F-5AB7-4E3E-8913-C5EAC4E9FED5%26ext%3D
JPG%22%2C%22name%22%3A%22IMG_0030.JPG%22%2C%22search%22%3A%22IMG0030JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D
6C2CA643-C80D-455C-BC35-3705E8EFAF3D%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0031.JPG%22%2C%22search%22%3A%22IMG0031JPG%22%7D%2C%7B%22url%22%3A%22
assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DDA8CE2BD-9F39-4037-B82A-DDFBF32D42C3%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0032.JPG%22%2C%22search
%22%3A%22IMG0032JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DCA7E8330-FB0B-4F04-8E78-899DA951F003%26ext%3DJPG%22
%2C%22name%22%3A%22IMG_0033.JPG%22%2C%22search%22%3A%22IMG0033JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D
B0D24A45-61B9-4181-B6C7-D5F012D2FC57%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0034.JPG%22%2C%22search%22%3A%22IMG0034JPG%22%7D%2C%7B%22url%22%3A%22
assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D012F05C9-AE5B-423B-AE00-A112FCBE9897%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0035.JPG%22%2C%22search
%22%3A%22IMG0035JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DD19E01E0-B803-4ACB-A2AE-259C1247916A%26ext%3DJPG
%22%2C%22name%22%3A%22IMG_0036.JPG%22%2C%22search%22%3A%22IMG0036JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid
%3DA9F743E5-9D18-4236-A666-AE890431F738%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0037.JPG%22%2C%22search%22%3A%22IMG0037JPG%22%7D%2C%7B%22url%22%3A
%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D970D6C1D-99F8-4B5B-963C-F60931B910A9%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0038.JPG%22%2C%22
search%22%3A%22IMG0038JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DDA5B327A-8016-4574-AF37-4AD9F13533B3%26ext
%3DJPG%22%2C%22name%22%3A%22IMG_0039.JPG%22%2C%22search%22%3A%22IMG0039JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG
%3Fid%3DAEE85816-B08F-44D2-8F21-18209C6A37EE%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0040.JPG%22%2C%22search%22%3A%22IMG0040JPG%22%7D%2C%7B%22url
%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DB3CBB8B4-1323-4EB6-A029-8C2D17FC9FDC%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0041.JPG%22
%2C%22search%22%3A%22IMG0041JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.PNG%3Fid%3D2C37BCB2-820C-4884-8126-5CD71FD4D7B6%26ext
%3DPNG%22%2C%22name%22%3A%22IMG_0042.PNG%22%2C%22search%22%3A%22IMG0042PNG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.PNG
%3Fid%3D7A039467-1507-4031-ACCD-F5E327763DB7%26ext%3DPNG%22%2C%22name%22%3A%22IMG_0043.PNG%22%2C%22search%22%3A%22IMG0043PNG%22%7D%2C%7B%22url
%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.PNG%3Fid%3D109F6B8A-1B7E-4371-AFBE-C58E924347C0%26ext%3DPNG%22%2C%22name%22%3A%22IMG_0044.PNG
%22%2C%22search%22%3A%22IMG0044PNG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.PNG%3Fid%3D870C9313-4069-41A2-A274-C37D29ED9D16%26ext
%3DPNG%22%2C%22name%22%3A%22IMG_0045.PNG%22%2C%22search%22%3A%22IMG0045PNG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG
%3Fid%3DAB71436A-9D20-4B18-92FB-F7E54293E082%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0007.JPG%22%2C%22search%22%3A%22IMG0007JPG%22%7D%2C%7B%22url
%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DA1611D33-B9C0-4F56-BFE0-F219AE129EAF%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0006.JPG
%22%2C%22search%22%3A%22IMG0006JPG%22%7D%5D
Reference(s):
http://192.168.0.10/downloadCollection
1.4
The client side cross site scripting web vulnerability can be exploited by
remote attacker without privileged application user account and
with medium or high required user interaction. For demonstration or reproduce
...
Client Side Cross Site Scripting - Exception Handling
PoC:
http://137.168.0.10:15555/0/-x[CLIENT SIDE INJECTED SCRIPT CODE! XSS]
Manually steps to reproduce ...
1. Install the service application on your mobile ipad or iphone device
2. Start the software and open http://192.168.0.10:15555/
3. Include the following path `0/-1` to provoke the an invalid application
error (Example: http://137.168.0.10:15555/0/-1)
4. The -1 will be displayed with the path in a script bound to the invalid
value exception
5. Now, the attacker can include his script code and request the same script
via GET again
6. The script will be executed on client side in the browser when processing to
load the manipulated link
7. Successful reproduce ... done!
Reference(s):
http://137.168.0.10:15555/0/
http://137.168.0.10:15555/1/
http://137.168.0.10:15555/2
http://137.168.0.10:15555/3/
Risk:
=====
1.1
The security risk of the file include web vulnerability is estimated as
critical.
1.2
The security risk of the local command inject vulnerability via devicename is
estimated as high(-).
1.3
The security risk of the persistent input validation web vulnerability is
estimated as medium(+).
1.4
The security risk of the client side cross site scripting web vulnerability is
estimated as low(+).
Credits:
========
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri
(bkm@xxxxxxxxxxxxxxxxxxxxx)
Vulnerability Laboratory [Research Team] - Chokri Ben Achour
(meister@xxxxxxxxxxxxxxxxxxxxx)
Disclaimer:
===========
The information provided in this advisory is provided as it is without any
warranty. Vulnerability-Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability and
capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct,
indirect, incidental, consequential loss of business
profits or special damages, even if Vulnerability-Lab or its suppliers have
been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for consequential
or incidental damages so the foregoing limitation
may not apply. We do not approve or encourage anybody to break any vendor
licenses, policies, deface websites, hack into databases
or trade with fraud/stolen material.
Domains: www.vulnerability-lab.com - www.vuln-lab.com
- www.vulnerability-lab.com/register
Contact: admin@xxxxxxxxxxxxxxxxxxxxx - support@xxxxxxxxxxxxxxxxxxxxx
- research@xxxxxxxxxxxxxxxxxxxxx
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com
- news.vulnerability-lab.com
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab
- youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php -
vulnerability-lab.com/rss/rss_upcoming.php -
vulnerability-lab.com/rss/rss_news.php
Any modified copy or reproduction, including partially usages, of this file
requires authorization from Vulnerability Laboratory.
Permission to electronically redistribute this alert in its unmodified form is
granted. All other rights, including the use of other
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All
pictures, texts, advisories, sourcecode, videos and
other information on this website is trademark of vulnerability-lab team & the
specific authors or managers. To record, list (feed),
modify, use or edit our material contact (admin@xxxxxxxxxxxxxxxxxxxxx or
support@xxxxxxxxxxxxxxxxxxxxx) to get a permission.
Copyright © 2012 | Vulnerability
Laboratory
--
VULNERABILITY RESEARCH LABORATORY
LABORATORY RESEARCH TEAM
CONTACT: research@xxxxxxxxxxxxxxxxxxxxx
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/