[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Full-disclosure] eFile Wifi Transfer Manager 1.0 iOS - Multiple Vulnerabilities

Title:
======
eFile Wifi Transfer Manager 1.0 iOS - Multiple Vulnerabilities


Date:
=====
2013-06-24


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=982


VL-ID:
=====
982


Common Vulnerability Scoring System:
====================================
6.8


Introduction:
=============
eFile is the File Manager for ios device. You can use your device as a Wi-Fi 
flash disk. You can connect to iPhone 
from a Mac, Windows, or Linux computer (on the same Wi-Fi network). No special 
software required on your computer. 
You can transfer mp3 files via bluetooth, Wi-Fi or iTunes. Support most of the 
document formats. Folder Password 
Protected: Provide password protection for each folder Http Pasword Protected: 
Provide Password protection for Http 
file transfer. File Operations: New Folder, delete, move, copy, email, share 
with bluetooth or Wi-Fi, zip,unzip ...

File sharing with other ios devices via Bluetooth or Wi-Fi
File upload via your PC/Mac/Linux web browser or USB via iTunes.
Provide download email attachments
Provide download Safari browser attachments
Save and Get images to and from Photos
iWork (Pages, Numbers, Keynote)
Microsoft Office (Word, Excel, PowerPoint)
PDF, RTF, RTFD, TXT
MP3, MP4, MOV, MPV, M4V
JPG, PNG, GIF, BMP, TIF, TIFF, ICO
ZIP,RAR
TXT,C,CPP,H,M

(Copy of the Homepage: 
https://itunes.apple.com/de/app/efile-lite-file-sharing-file/id606822182 )


Abstract:
=========
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities 
in the eFile Wifi Manager v1.0 iOS mobile application.


Report-Timeline:
================
2013-06-24:     Public Disclosure


Status:
========
Published


Exploitation-Technique:
=======================
Remote


Severity:
=========
Critical


Details:
========
1.1
A local file include and an arbitrary file upload web vulnerability via POST 
request method is detected in the eFile Wifi Manager v1.0 
iOS mobile application for the apple ipad & iphone. The vulnerability allows 
remote attackers via POST method to inject local app webserver 
folders to request unauthorized local webserver files.

The vulnerbility is located in the upload file module of the webserver 
(http://localhost/x) when processing to request a manipulated 
filename via POST. The execution of the injected path or file request will 
occur when the attacker is processing to reload to index listing 
of the affected module after the file include attack via upload. Remote 
attackers can exchange the filename with a tripple extension to bypass 
the filter and execute the files from the little webserver of the application.

Exploitation of the vulnerability requires no user interaction and also without 
application user account (no password standard).
Successful exploitation of the vulnerability results in unauthorized path or 
file access via local file include or arbitrary file upload.

Vulnerable Application(s):
                                [+] eFile v1.0 - ITunes or AppStore (Apple)

Vulnerable Module(s):
                                [+] File Upload  (Web Server) [Remote]

Vulnerable Parameter(s):
                                [+] filename
                                [+] file extensions

Affected Module(s):
                                [+] eFile Index Listing


1.2
A persistent input validation vulnerability is detected in the eFile Wifi 
Manager v1.0 iOS mobile application for the apple ipad & iphone.
The bug allows an attacker (remote) to implement/inject malicious script code 
on the application side (persistent) of the app web service. 

The vulnerability is located in the index file dir listing module of the 
webserver (http://localhost/foldername) when processing to display
via POST request method injected manipulated `foldernames`. The persistent 
script code will be executed in the main index file dir 
listing module when the service is processing to list the new malicious 
injected foldername as item.

Exploitation of the persistent web vulnerability requires low or medium user 
interaction without application user account.
Successful exploitation of the vulnerability can lead to persistent session 
hijacking (customers), account steal via persistent web 
attacks, persistent phishing or stable (persistent) certificate mail 
notification context manipulation.

Vulnerable Application(s):
                                [+] eFile v1.0 - ITunes or AppStore (Apple)

Vulnerable Module(s):
                                [+] Add or Edit Foldername

Vulnerable Parameter(s):
                                [+] foldername

Affected Module(s):
                                [+] eFile Index Listing


Proof of Concept:
=================
1.1
The arbitrary file upload vulnerability and restriction bypass can be exploited 
by remote attackers without privilege application user account 
and also without required user interaction. For demonstration or reproduce ...


File Upload ...

Host=localhost:8080
User-Agent=Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 
Firefox/21.0
Accept=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language=en-US,en;q=0.5
Accept-Encoding=gzip, deflate
DNT=1
X-Requested-With=XMLHttpRequest
X-File-Name=1234.png.txt.iso.php.gif
Content-Type=application/octet-stream
Referer=http://localhost:8080/
Content-Length=98139
POSTDATA =?PNG[X]


+ double extensions

http://localhost:8080/[PATH NAME (x) VALUE].png.txt.iso.php


// return false to cancel submit
onSubmit: function(id, fileName){},
onProgress: function(id, fileName, loaded, total){},
onComplete: function(id, fileName, responseJSON){},
onCancel: function(id, fileName){},
// messages                
    
messages: {
typeError: "{file} has invalid extension. Only {extensions} are allowed.",
sizeError: "{file} is too large, maximum file size is {sizeLimit}.",
minSizeError: "{file} is too small, minimum file size is {minSizeLimit}.",
emptyError: "{file} is empty, please select files again without it.",
onLeave: "The files are being uploaded, if you leave now the upload will be 
cancelled."},
...   ...
// added to list item when upload completes
// used in css to hide progress spinner
success: 'qq-upload-success',
...


1.2
The persistent input validation web vulnerability can be exploited by remote 
attackers without privileged application user account 
and with low required user interaction. For demonstration or reproduce ...

New Folder ...

POST http://localhost:8080/# Load Flags[LOAD_DOCUMENT_URI  
LOAD_INITIAL_DOCUMENT_URI  ] 
Content Size[-1] Mime Type[application/x-unknown-content-type]
Request Headers:
Host[localhost:8080]
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 
Firefox/21.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[en-US,en;q=0.5]
Accept-Encoding[gzip, deflate]
DNT[1]
Referer[http://localhost:8080/]
Connection[keep-alive]
Post Data:
newFolder[%2520%3E%22%3C[PERSISTENT INJECTED SCRIPT CODE!]+src%3Da%3E]
submitButton[Create]

Response Headers:
Transfer-Encoding[chunked]
Accept-Ranges[bytes]
Date[Sun, 23 Jun 2013 10:16:41 GMT]


http://localhost:8080/[PATH NAME (x) VALUE]

function newFolder()
{
var title = document.getElementById("formTitle");
title.innerText = "eFile";
title.textContent = "eFile";
title.setAttribute("id","formTitle");
                
... ...
var message = document.getElementById("formMessage");
message.innerText = "Enter new folder name";
message.textContent = "Enter new folder name";
message.setAttribute("id","formMessage");
...


Reference(s):
                        ../pagescript.js


Solution:
=========
1.1
The arbitrary file upload vulnerability can be patched by a secure parse and 
restriction in the file upload module and the bound listing access.

1.2
The persistent input validation web vulnerability can be patched by a secure 
parse of the foldername. 
Parse the input fields of new folder and also the index output listing to 
prevent persistent injections or script code executions.


Risk:
=====
1.1
The security risk of the multiple arbitrary file upload vulnerability and 
restriction bypass is estimated as critical.

1.2
The security risk of the persistent input validation web vulnerability is 
estimated as high.


Credits:
========
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri 
(bkm@xxxxxxxxxxxxxxxxx)


Disclaimer:
===========
The information provided in this advisory is provided as it is without any 
warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and 
capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, 
indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have 
been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential 
or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor 
licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com           - www.vuln-lab.com              
               - www.vulnerability-lab.com/register
Contact:    admin@xxxxxxxxxxxxxxxxxxxxx         - support@xxxxxxxxxxxxxxxxxxxxx 
               - research@xxxxxxxxxxxxxxxxxxxxx
Section:    video.vulnerability-lab.com         - forum.vulnerability-lab.com   
               - news.vulnerability-lab.com
Social:     twitter.com/#!/vuln_lab             - facebook.com/VulnerabilityLab 
               - youtube.com/user/vulnerability0lab
Feeds:      vulnerability-lab.com/rss/rss.php   - 
vulnerability-lab.com/rss/rss_upcoming.php   - 
vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file 
requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is 
granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All 
pictures, texts, advisories, source code, videos and 
other information on this website is trademark of vulnerability-lab team & the 
specific authors or managers. To record, list (feed), 
modify, use or edit our material contact (admin@xxxxxxxxxxxxxxxxxxxxx or 
support@xxxxxxxxxxxxxxxxxxxxx) to get a permission.

                                        Copyright © 2013 | Vulnerability 
Laboratory



-- 
VULNERABILITY LABORATORY RESEARCH TEAM
DOMAIN: www.vulnerability-lab.com
CONTACT: research@xxxxxxxxxxxxxxxxxxxxx


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/