[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[FD] iVault Private P&V 1.1 iOS - Path Traversal Vulnerability

Document Title:
===============
iVault Private P&V 1.1 iOS - Path Traversal Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1253


Release Date:
=============
2014-04-09


Vulnerability Laboratory ID (VL-ID):
====================================
1253


Common Vulnerability Scoring System:
====================================
6.8


Product & Service Introduction:
===============================
The BEST and MOST convenient private Photo&Video App! It provides multiple 
security mechanisms, and perfectly keeps your privacy 
away from peeping eyes. First, you need to add your ‘SPECIAL’ photos&videos 
into iVault, it provides many convenient features.
Second, you may concern about the security things. Third, iVault can provide 
more than you can imagine.

(Copy of the Homepage: 
https://itunes.apple.com/us/app/ivault-private-photo.s-video.s/id780124144 )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities 
in the official iVault Private Photos & Videos v1.1 iOS mobile application.


Vulnerability Disclosure Timeline:
==================================
2014-04-09:     Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Arvin Brook
Product: iVault - Private Photos & Videos Vault + Secrets Folders Manager 1.1


Exploitation Technique:
=======================
Remote


Severity Level:
===============
High


Technical Details & Description:
================================
The application-side path/directory traversal web vulnerability has been 
discovered in the official iVault Private Photos & Videos v1.1 iOS mobile 
application.
The vulnerability allows an local attacker to unauthorized access path- or 
directories values to leak information or compromise the mobile application 
privacy.

The first vulnerability is located in the `path & directory` value of the wifi 
web-access module. Remote attackers are able to request the via vulnerable path 
value any application content even if protected. The attackers are able to 
include local frames as path value to request an internal application path to 
unauthorized access stored private images/files. The issue can be combined with 
script-code attacks but is not limited to the condition only. The attack vector 
is located on the application-side and the method to include the malicious path 
value request is a sync (device). The security risk of the 
directory traversal vulnerability is estimated as medium with a cvss (common 
vulnerability scoring system) count of 6.8(+)|(-)6.9.

Exploitation of the local `path & directory` vulnerability requires a low 
privileged device user account with physical device access and without user 
interaction.
Successful exploitation of the vulnerability results in unauthorized picture or 
file access, information disclosure and further application-side attacks.

Vulnerable Input(s):
                                [+] Path

Vulnerable Module(s):
                                [+] Directory

Vulnerable Parameter(s):
                                [+] Oberverzeichnis > aktuell:(x)

Affected Module(s):
                                [+] Path Dir Listing (each WiFi web access side)


Proof of Concept (PoC):
=======================
The application-side vulnerability can be exploited by local attackers with 
physical device access and low privileged user account.
User interaction is not required. For security demonstration or to reproduce 
the vulnerability follow the provided information 
and steps below to continue.

PoC: Source

            <script language="javascript">
                var currentFolderPath = 
'/"<../../var/mobile/Applications[PATH/DIRECTORY TRAVERSAL VULNERABILITY!]';
                var alertMessage = "%%ALERT_MESSAGE%%";
                var actionType = "Show";
                var submitting = false;
                var tipHiddenTop = -200;
                var tipShownTop = -80;
                var lastShownTipDate;
                
                var maxNumberOfImageCurrentEvent = 48;
                var maxNumberOfVideoCurrentEvent = 5;
                var limitationMsg = "Die Anzahl deiner Dokumente hat schon an 
der Grenze der freien Edition (maximal 50 Bilder oder Fotos, 5 Videos) 
erreicht. 
                Möchtest du nicht eine volle Edition bekommen und damit alle 
Einschränkungen weglassen? No thanks ;) -bkm";
                
                var videoTypes = ["MOV", "MP4", "MPV", "M4V"];
                
                function tippable() {
                    var currentTop = document.getElementById("tip").style.top;
                    currentTop = currentTop.substring(0, currentTop.length-2);
                    currentTop = Number(currentTop);
                    
                    var not = ((currentTop > tipHiddenTop) && (currentTop < 
tipShownTop))
                    return !not;


PoC: Execution

<div id="content" onselectstart="return false;">
<a href="/logout.html" style="float:right; margin:10px;">outloggen</a>
            
<h1 style="padding:0 15px 0">WiFi web access</h1>
<div id="buttons" style="position:relative; left:10px; height:60px; 
padding-top:10x;">
                
<a href="/back.html" style="text-decoration:none; top:0; left:0;"><img 
src="/Web/back2.png" style="width:30px; height:30px; 
border:none; margin:-9px 6px;">Oberverzeichnis 
[aktuell:/>"<../../var/mobile/Applications[PATH/DIRECTORY TRAVERSAL 
VULNERABILITY!]>]</a>


Reference(s):
http://localhost:9900/


Solution - Fix & Patch:
=======================
The vulnerability can be patched by a secure restriction and filter process of 
the `path` and `directory` value request.
Parse and encode also the vulnerable `Oberverzeichnis > aktuell:(x)` output 
values on each wifi web access page to prevent directory traversal attacks.


Security Risk:
==============
The security risk of the local directory/path traversal web vulnerability is 
estimated as high(-).


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri 
(bkm@xxxxxxxxxxxxxxxxx) [www.vulnerability-lab.com]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any 
warranty. Vulnerability Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and 
capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, 
indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have 
been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential 
or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor 
licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com           - www.vuln-lab.com              
               - www.evolution-sec.com
Contact:    admin@xxxxxxxxxxxxxxxxxxxxx         - 
research@xxxxxxxxxxxxxxxxxxxxx               - admin@xxxxxxxxxxxxxxxxx
Section:    www.vulnerability-lab.com/dev       - forum.vulnerability-db.com    
               - magazine.vulnerability-db.com
Social:     twitter.com/#!/vuln_lab             - facebook.com/VulnerabilityLab 
               - youtube.com/user/vulnerability0lab
Feeds:      vulnerability-lab.com/rss/rss.php   - 
vulnerability-lab.com/rss/rss_upcoming.php   - 
vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file 
requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is 
granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All 
pictures, texts, advisories, source code, videos and 
other information on this website is trademark of vulnerability-lab team & the 
specific authors or managers. To record, list (feed), 
modify, use or edit our material contact (admin@xxxxxxxxxxxxxxxxxxxxx or 
research@xxxxxxxxxxxxxxxxxxxxx) to get a permission.

                                Copyright © 2014 | Vulnerability Laboratory 
[Evolution Security]



-- 
VULNERABILITY LABORATORY RESEARCH TEAM
DOMAIN: www.vulnerability-lab.com
CONTACT: research@xxxxxxxxxxxxxxxxxxxxx



_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/