[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Full-disclosure] Unauthenticated Remote File Upload via HTTP for perl-Programming language 1.6 on iOS

<html><body><div><b style="font-family: Times; font-size: medium; ">TITLE: 
Unauthenticated Remote File Upload via HTTP for perl-Programming language 1.6 
on iOS</b></div><div><font face="Times" size="3"><b><br></b></font><span 
style="font-family: Times; font-size: medium; "></span><p style="font-family: 
Times; font-size: medium; ">Date: 8/1/2013</p><p style="font-family: Times; 
font-size: medium; ">Author: Larry W. Cashdollar, @_larry0</p><p 
style="font-family: Times; font-size: medium; "><br></p><p style="font-family: 
Times; font-size: medium; ">Download:</p><ol style="font-family: Times; 
font-size: medium; 
"><li>https://itunes.apple.com/us/app/perl-programming-language/id578116006?mt=8&amp;ls=1</li><li>http://www.tayutec.com/indexen.html</li></ol><p
 style="font-family: Times; font-size: medium; ">Description: "This is an ios 
perl app,you can learn,run,share perl script. Features 
:&nbsp;<br>Autocomplate.<br>Auto Indent.<br>Code color.<br>In(the built-in 
browser or the txt editor),Select the text to run.<br>Horizontal screen 
development.</p><p style="font-family: Times; font-size: medium; ">Code 
templates, the contents of the new file is copy from contents of the template 
file.</p><ul style="font-family: Times; font-size: medium; "><li>You can enter 
perl code by keyboard or two-dimensional code, and then you can execut the perl 
code,support the gets function.</li><li>You can adjust the code color and font 
size, and support to move the cursor left and right and up and down , easy to 
read and write.</li><li>You can upload learning materials to the local on the 
computer via wifi, support http and ftp two upload ways. The file system 
supports txt, pdf, chm, mp3,m4v,zip, gif, png, html, rb, doc ...</li><li>You 
can find learning materials by the built-in browser.</li><li>You can save perl 
code and learning materials, and can be modified to the save file and delete 
the save file .</li><li>You can control the background image and color, and 
execution voice, background animation, text color and shadow, switch interface 
animation, the number and the order of the main interface of the tab bar to 
create your learning software.</li><li>You can Learn perl knowledge, the system 
provides some basic learning materials.</li><li>You can use perl code or 
learning materials to generate two-dimensional code , for easy sharing 
.</li><li>You can share code by Email,Weibo,Twitter,Facebook.</li><li>You can 
use the counter,light in the Setting tab."</li></ul><span style="font-family: 
Times; font-size: medium; ">Vulnerabilities: 'iOSftp' &amp; http 
unauthenticated file uplolads. The application is sandboxed, but any remote 
user can read/write to the devices storage.&nbsp;</span><br style="font-family: 
Times; font-size: medium; "><span style="font-family: Times; font-size: medium; 
">The uploaded content is served out of the http servers directory. While the 
http server doesn't process server side scripts it is possible to upload and 
serve malicious / illegal content. I would think it's also possible to fill up 
the devices storage as well but did not test it.</span><pre>larry$ ftp 
192.168.0.31  10000
Connected to 192.168.0.31.
220 iosFtp server ready.
Name (192.168.0.31:larry): anyone
331 Password required for anyone
Password: 
230 User anyone logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp&gt; pwd
Remote directory: 
/private/var/mobile/Applications/311BCF0D-B9D8-4DC0-BE4C-2EC0887EE2CE/Documents/ftp
 *
ftp&gt; cd ../../../../
250 CWD command successful.
ftp&gt; pwd
Remote directory: /private/var/mobile
ftp&gt; cd /
250 CWD command successful.
ftp&gt; pwd
Remote directory: /
ftp&gt; </pre><span style="font-family: Times; font-size: medium; ">* You also 
get path disclosure.&nbsp;</span><br style="font-family: Times; font-size: 
medium; "><span style="font-family: Times; font-size: medium; ">http server 
listening on port 8080 allows arbitrary file writes to storage.</span><br 
style="font-family: Times; font-size: medium; "><span style="font-family: 
Times; font-size: medium; ">You can create directories out side the upload path 
through the file upload web interface and the .. bug.</span><br 
style="font-family: Times; font-size: medium; "><span style="font-family: 
Times; font-size: medium; ">Because the application is sandbox I was unable to 
overwtite application executables and components so impact is limited. As 
stated above you can serve malicious content (javascript/html) via 
http.&nbsp;</span><br style="font-family: Times; font-size: medium; "><img 
src="http://vapid.dhs.org/advisories/webint.gif"; style="font-family: Times; 
font-size: medium; "><span style="font-family: Times; font-size: medium; 
"></span><p style="font-family: Times; font-size: medium; ">Vendor: Notified 
8/1/2013, https://twitter.com/tayutec</p><span style="font-family: Times; 
font-size: medium; ">Advisory: 
http://vapid.dhs.org/advisories/perl-ios-Huang-XiaoWen.html</span></div></body></html>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/