[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-disclosure] Phone Drive Eightythree 4.1.1 iOS - Multiple Vulnerabilities
- To: full-disclosure@xxxxxxxxxxxxxxxxx
- Subject: [Full-disclosure] Phone Drive Eightythree 4.1.1 iOS - Multiple Vulnerabilities
- From: Vulnerability Lab <research@xxxxxxxxxxxxxxxxxxxxx>
- Date: Sun, 15 Dec 2013 20:07:22 +0100
Document Title:
===============
Phone Drive Eightythree 4.1.1 iOS - Multiple Vulnerabilities
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1168
Release Date:
=============
2013-12-11
Vulnerability Laboratory ID (VL-ID):
====================================
1168
Common Vulnerability Scoring System:
====================================
7.6
Product & Service Introduction:
===============================
Phone Drive allows you to store, view and manage files on your iPhone or iPad.
You can connect to Phone Drive from any Mac or
PC over the Wi-Fi network and transfer files by drag & drop files straight from
the Finder or Windows Explorer. Phone Drive
features document viewer, PDF reader, music player, image viewer, voice
recorder, text editor, file manager and support most
of the file operations: like delete, move, copy, email, share, zip, unzip and
more.
(Copy of the Homepage: https://itunes.apple.com/de/app/phone-drive/id431033044 )
Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered multiple web
vulnerabilities in the official Eigthythree Phone Drive v4.1.1 iOS mobile
application.
Vulnerability Disclosure Timeline:
==================================
2013-12-11: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
Eightythree Technologies
Product: Phone Drive - Mobile Application 4.1.1
Exploitation Technique:
=======================
Remote
Severity Level:
===============
High
Technical Details & Description:
================================
1.1
A local command/path injection web vulnerability has been discovered in the
Eigthythree Phone Drive v4.1.1 mobile application for apple iOS.
The remote web vulnerability allows to inject local commands via vulnerable
system values to compromise the apple iOS mobile web-application.
The vulnerability is located in the in the device name value of the index and
sub category list module. Local attackers are
able to inject own script codes as iOS device name. The execute of the injected
script code occurs with persistent attack vector
in the header section of the web interface. The security risk of the
command/path inject vulnerabilities are estimated as high
with a cvss (common vulnerability scoring system) count of 7.0(+)|(-)7.1.
Exploitation of the command/path inject vulnerability requires a local low
privileged iOS device account with restricted access
and no direct user interaction. Successful exploitation of the vulnerability
results in unauthorized execute of system specific
commands or unauthorized path requests.
Request Method(s):
[+] [GET]
Vulnerable Parameter(s):
[+] devicename
Affected Module(s):
[+] Index File Dir List - [Header]
1.2
A local file/path include web vulnerability has been discovered in the
Eigthythree Phone Drive v4.1.1 mobile application for apple iOS.
The file include vulnerability allows remote attackers to include (upload)
local file or path requests to compromise the web-application.
The remote file include web vulnerability is located in the vulnerable filename
value of the file dir list index module (web interface).
Remote attackers can manipulate the filename value in the POST method request
of the file upload form to compromise the mobile application.
Remote attackers are able to include own local files by usage of the file
upload module. The attack vector is persistent and the request
method is POST. The file include execute occcurs in the main file dir index
list. The security risk of the local file include web
vulnerability is estimated as high(+) with a cvss (common vulnerability scoring
system) count of 8.8(+).
Exploitation of the local file include web vulnerability requires no user
interaction or privileged web-application user account with password.
Successful exploitation of the local web vulnerability results in application
or device compromise by unauthorized local file include attacks.
Request Method(s):
[+] [POST]
Vulnerable Module(s):
[+] File Upload
Vulnerable Parameter(s):
[+] filename
Affected Module(s):
[+] Index File Dir Listing (http://localhost:80)
1.3
An arbitrary file upload web vulnerability has been discovered in the
Eigthythree Phone Drive v4.1.1 mobile application for apple iOS.
The arbitrary file upload issue allows remote attackers to upload files with
multiple extensions to bypass the web-server or system validation.
The vulnerability is located in the upload file module. Remote attackers are
able to upload a php or js web-shells by a rename of the file with
multiple extensions to bypass the file restriction mechanism. The attacker
uploads for example a web-shell with the following name and extension
`image.jpg.gif.js.php.jpg`. After the upload the attacker needs to open the
file in the web application. He deletes the .jpg & . gif file
extension and can access the application with elevated access rights. The
security risk of the arbitrary file upload web vulnerability is
estimated as high with a cvss (common vulnerability scoring system) count of
6.6(+).
Exploitation of the arbitrary file upload web vulnerability requires no user
interaction or privilege application user account with password.
Successful exploitation of the vulnerability results in unauthorized file
access because of a compromise after the upload of web-shells.
Request Method(s):
[+] [POST]
Vulnerable Module(s):
[+] File Upload
Vulnerable Parameter(s):
[+] filename (multiple extensions)
Affected Module(s):
[+] Index File Dir Listing (http://localhost:80)
1.4
A persistent input validation web vulnerability has been discovered in the
Eigthythree Phone Drive v4.1.1 mobile application for apple iOS.
The (persistent) vulnerability allows remote attacker to inject own malicious
script code on the application-side of the mobile application.
The persistent input validation vulnerability is located in the foldername
(path) value of the folder/path create web-application module.
Remote attackers can inject own malicious script codes as payload to the create
folder (path) input field. After the client-side inject
in the POSt method request the payload will be saved and the vector turns into
a persistent attack. The persistent execute occurs in the
file dir index- or sub category folder list (http://localhost:8080). Attacker
can also inject the script code by the rename of an
exsisting issue. The second execute occurs in the delete notification popup box
of the item index list. The security risk of the persistent
input validation web vulnerability is estimated as medium(+) with a cvss
(common vulnerability scoring system) count of 3.9(+).
Exploitation of the persistent input validation web vulnerability requires no
privileged mobile application user account but low or medium
user interaction. Successful exploitation of the persistent vulnerability
results in persistent session hijacking (customers) attacks, account
steal via persistent web attacks, persistent phishing or persistent
manipulation of vulnerable module context.
Request Method(s):
[+] [POST]
Vulnerable Input(s):
[+] Create Folder
Vulnerable Parameter(s):
[+] foldername (path)
Affected Module(s):
[+] Index File Dir Listing (http://localhost:80)
Proof of Concept (PoC):
=======================
1.1
The local command inject web vulnerability can be exploited by local attackers
with physical restricted device access and without user interaction.
For security demonstration or to reproduce the vulnerability follow the
provided information and steps below.
PoC: DeviceName - Index File Dir List
<tr>
<td><a href="http://localhost:80/"><img
src="Phone%20Drive%20-%20devicename_files/webicon.png" id="headerImg"
height="57" width="57"></a></td>
<td><h2>device bkm>"<<>"<../[LOCAL COMMAND/PATH INJECT WEB
VULNERABILITY!]"></h2></td>
<td width="170" align="center"><a
href="http://www.eightythreetech.com" target="_blank"><img
src="/webroot/moreapps.png"/></a></td>
</tr>
</table>
1.2
The local file include web vulnerability can be exploited by remote attackers
without privileged web-application user account and user interaction.
For security demonstration or to reproduce the web vulnerability follow the
provided information and steps below.
PoC:
<tr class="c"><td class="e"><input name="selection" value="[LOCAL FILE INCLUDE
VULNERABILITY!]" type="checkbox"></td>
<td class="i"><a href="Help.webarchive"><img
src="/webroot/fileicons/webarchive.png" height="20"
width="20"></a></td><td class="n"><a href="[LOCAL FILE INCLUDE
VULNERABILITY!]">[LOCAL FILE INCLUDE VULNERABILITY!]</a></td><td class="m">
17.09.2015 18:07</td><td class="s">24.7 KB</td><td class="k">Safari Web
Archive</td><td class="e">
<a href="#" title="Download file" onclick="downloadFile("[LOCAL FILE INCLUDE
VULNERABILITY!]");">
<img src="/webroot/webdownload.png" height="15" width="15"></a></td><td
class="e"><a href="#"
title="Rename file" onclick="modalPopup("Help.webarchive", 0, 1);">
<img src="/webroot/webrename.png" height="15" width="15"></a></td><td class="e">
<a href="#" title="Delete file" onclick="modalPopup("Help.webarchive", 2, 1);">
<img src="/webroot/webdelete.png" height="15" width="15"></a></td></tr>
1.3
The arbitrary file upload and restricted upload bypass web vulnerability can be
exploited by remote attackers without user interaction
or privileged web-application user account. For security demonstration or to
reproduce the vulnerability follow the provided information
and steps below.
PoC Session Logs: qqfile
Status: 200 OK
POST
http://localhost:80/qqfile=arbitrary-file-upload.png.txt.iso.js.html.php.jpg
Load Flags[LOAD_BYPASS_CACHE ]
Content Size[unknown] Mime Type[unknown]
Request Headers:
Host[192.168.2.106]
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101
Firefox/25.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[en-US,en;q=0.5]
Accept-Encoding[gzip, deflate]
DNT[1]
X-Requested-With[XMLHttpRequest]
X-File-Name[arbitrary-file-upload.png.txt.iso.js.html.php.jpg]
Content-Type[application/octet-stream]
Referer[http://192.168.2.106/]
Content-Length[98139]
Post Data:
POST_DATA[‰PNG
1.4
The persistent input validation web vulnerability can be exploited by remote
attackers without privileged web application user account
and low user interaction. For security demonstration or to reproduce the
vulnerability follow the provided information and steps below.
PoC: Creat Folder - Index File Dir List & Sub Category List
<tr class="c"><td class="e"><input name="selection"
value="%3E%22%3Cx%20src=a%3E" type="checkbox"></td><td class="i">
<a href="http://localhost/%3E%22%3Ciframe%20src=a%3E/"><img
src="Phone%20Drive%20-%20pathname_files/folder.png"
height="20" width="20"></a></td><td class="n"><a
href="http://localhost/%3E%22%3Cx%3E/">
>"<[PERSISTENT INJECTED SCRIPT CODE!]"></a></td><td
class="m">11.12.2013 13:29</td><td
Solution - Fix & Patch:
=======================
1.1
The first vulnerability can be patched by a secure encode of the devicename
value in the ehader section of the index module.
1.2 - 1.3
Restrict the filename input and parse the context with a filter mechanism.
Disallow multiple file extensions and implement
a own exception-handling to prevent arbitrary file uploads or restricted file
uploads.
Security Risk:
==============
1.1
The security risk of the local command inject web vulnerability is estimated as
high(-).
1.2 - 1.3
The security risk of the local file include web vulnerability via file and
folder name value is estimated as high(+).
Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri
(bkm@xxxxxxxxxxxxxxxxx) [www.vulnerability-lab.com]
Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any
warranty. Vulnerability Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability and
capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct,
indirect, incidental, consequential loss of business
profits or special damages, even if Vulnerability-Lab or its suppliers have
been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for consequential
or incidental damages so the foregoing limitation
may not apply. We do not approve or encourage anybody to break any vendor
licenses, policies, deface websites, hack into databases
or trade with fraud/stolen material.
Domains: www.vulnerability-lab.com - www.vuln-lab.com
- www.evolution-sec.com
Contact: admin@xxxxxxxxxxxxxxxxxxxxx -
research@xxxxxxxxxxxxxxxxxxxxx - admin@xxxxxxxxxxxxxxxxx
Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com
- magazine.vulnerability-db.com
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab
- youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php -
vulnerability-lab.com/rss/rss_upcoming.php -
vulnerability-lab.com/rss/rss_news.php
Any modified copy or reproduction, including partially usages, of this file
requires authorization from Vulnerability Laboratory.
Permission to electronically redistribute this alert in its unmodified form is
granted. All other rights, including the use of other
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All
pictures, texts, advisories, source code, videos and
other information on this website is trademark of vulnerability-lab team & the
specific authors or managers. To record, list (feed),
modify, use or edit our material contact (admin@xxxxxxxxxxxxxxxxxxxxx or
research@xxxxxxxxxxxxxxxxxxxxx) to get a permission.
Copyright © 2013 | Vulnerability Laboratory
[Evolution Security]
--
VULNERABILITY LABORATORY RESEARCH TEAM
DOMAIN: www.vulnerability-lab.com
CONTACT: research@xxxxxxxxxxxxxxxxxxxxx
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/