diff --git a/files.csv b/files.csv index 4f17aa67f..7fc1e7d8a 100755 --- a/files.csv +++ b/files.csv @@ -18087,7 +18087,7 @@ id,file,description,date,author,platform,type,port 20812,platforms/windows/remote/20812.c,"FreeBSD 2.x,HP-UX 9/10/11,kernel 2.0.3,Windows NT 4.0/Server 2003,NetBSD 1 loopback (land.c) DoS (3)",1997-11-20,m3lt,windows,remote,0 20813,platforms/multiple/remote/20813.c,"FreeBSD 2.x,HP-UX 9/10/11,kernel 2.0.3,Windows NT 4.0/Server 2003,NetBSD 1 loopback (land.c) DoS (4)",1997-11-20,MondoMan,multiple,remote,0 20814,platforms/windows/remote/20814.c,"FreeBSD 2.x,HP-UX 9/10/11,kernel 2.0.3,Windows NT 4.0/Server 2003,NetBSD 1 loopback (land.c) DoS (5)",1997-11-20,"Dejan Levaja",windows,remote,0 -20815,platforms/windows/remote/20815.pl,"Microsoft IIS 5.0 .printer ISAPI Extension Buffer Overflow Vulnerability (1)",2001-05-01,storm,windows,remote,0 +20815,platforms/windows/remote/20815.pl,"Microsoft IIS 5.0 - .printer ISAPI Extension Buffer Overflow Vulnerability (1)",2001-05-01,storm,windows,remote,0 20816,platforms/windows/remote/20816.c,"Microsoft IIS 5.0 .printer ISAPI Extension Buffer Overflow Vulnerability (2)",2001-05-01,"dark spyrit",windows,remote,0 20817,platforms/windows/remote/20817.c,"Microsoft IIS 5.0 .printer ISAPI Extension Buffer Overflow Vulnerability (3)",2005-02-02,styx,windows,remote,0 20818,platforms/windows/remote/20818.txt,"Microsoft IIS 5.0 .printer ISAPI Extension Buffer Overflow Vulnerability (4)",2001-05-01,"Cyrus The Great",windows,remote,0 @@ -30295,3 +30295,20 @@ id,file,description,date,author,platform,type,port 33623,platforms/linux/local/33623.txt,"Accellion Secure File Transfer Appliance Multiple Command Restriction Weakness Local Privilege Escalation",2010-02-10,"Tim Brown",linux,local,0 33624,platforms/php/webapps/33624.txt,"vBulletin <= 3.5.4 Multiple Cross Site Scripting Vulnerabilities",2010-02-11,ROOT_EGY,php,webapps,0 33625,platforms/php/dos/33625.php,"PHP <= 5.3.1 'session_save_path()' 'safe_mode' Restriction-Bypass Vulnerability",2010-02-11,"Grzegorz Stachowiak",php,dos,0 +33626,platforms/php/webapps/33626.txt,"PHPBTTracker+ 2.2 - SQL Injection",2014-06-03,"BackBox Linux Team",php,webapps,80 +33627,platforms/ios/webapps/33627.txt,"NG WifiTransfer Pro 1.1 - Local File Inclusion",2014-06-03,Vulnerability-Lab,ios,webapps,8080 +33628,platforms/ios/webapps/33628.txt,"Files Desk Pro v1.4 iOS - Local File Inclusion",2014-06-03,Vulnerability-Lab,ios,webapps,8081 +33629,platforms/ios/webapps/33629.txt,"Privacy Pro v1.2 HZ iOS - Local File Inclusion",2014-06-03,Vulnerability-Lab,ios,webapps,56380 +33630,platforms/ios/webapps/33630.txt,"TigerCom My Assistant 1.1 iOS - Local File Inclusion",2014-06-03,Vulnerability-Lab,ios,webapps,8080 +33631,platforms/ios/webapps/33631.txt,"AllReader 1.0 iOS - Multiple Vulnerabilities",2014-06-03,Vulnerability-Lab,ios,webapps,8080 +33632,platforms/ios/webapps/33632.txt,"Bluetooth Photo-File Share 2.1 iOS - Multiple Vulnerabilities",2014-06-03,Vulnerability-Lab,ios,webapps,8080 +33634,platforms/php/webapps/33634.txt,"CommodityRentals CD Rental Software 'index.php' SQL Injection Vulnerability",2010-02-11,"Don Tukulesto",php,webapps,0 +33635,platforms/linux/dos/33635.c,"Linux Kernel 2.6.x 'net/ipv6/ip6_output.c' NULL Pointer Dereference Denial of Service Vulnerability",2008-07-31,"Rémi Denis-Courmont",linux,dos,0 +33636,platforms/php/webapps/33636.sh,"Interspire Knowledge Manager 5 'callback.snipshot.php' Arbitrary File Creation Vulnerability",2010-02-03,"Cory Marsh",php,webapps,0 +33637,platforms/php/webapps/33637.txt,"Webee Comments Component 1.1/1.2 for Joomla! index2.php articleId SQL Injection",2009-11-15,"Jeff Channell",php,webapps,0 +33638,platforms/php/webapps/33638.txt,"Webee Comments Component 1.1/1.2 for Joomla! Multiple BBCode Tags XSS",2009-11-15,"Jeff Channell",php,webapps,0 +33639,platforms/php/webapps/33639.txt,"Joomla! EasyBook 2.0.0rc4 Component Multiple HTML Injection Vulnerabilities",2009-09-17,"Jeff Channell",php,webapps,0 +33640,platforms/windows/dos/33640.py,"AIMP <= 2.8.3 '.m3u' File Remote Stack Buffer Overflow Vulnerability",2010-02-12,Molotov,windows,dos,0 +33641,platforms/php/webapps/33641.txt,"Joomla! F!BB Component 1.5.96 RC SQL Injection and HTML Injection Vulnerabilities",2009-09-17,"Jeff Channell",php,webapps,0 +33642,platforms/windows/remote/33642.html,"Symantec Multiple Products Client Proxy ActiveX (CLIproxy.dll) Remote Overflow",2010-02-17,"Alexander Polyakov",windows,remote,0 +33643,platforms/php/webapps/33643.txt,"CMS Made Simple 1.6.6 Local File Include and Cross Site Scripting Vulnerabilities",2010-02-12,"Beenu Arora",php,webapps,0 diff --git a/platforms/ios/webapps/33627.txt b/platforms/ios/webapps/33627.txt new file mode 100755 index 000000000..677696bdb --- /dev/null +++ b/platforms/ios/webapps/33627.txt @@ -0,0 +1,208 @@ +Document Title: +=============== +NG WifiTransfer Pro 1.1 - File Include Vulnerability + + +References (Source): +==================== +http://www.vulnerability-lab.com/get_content.php?id=1260 + + +Release Date: +============= +2014-04-28 + + +Vulnerability Laboratory ID (VL-ID): +==================================== +1260 + + +Common Vulnerability Scoring System: +==================================== +6.5 + + +Product & Service Introduction: +=============================== +The easiest way to transfer files between iPhones or with computers! WifiTransfer enables fast wireless file transfer between +iPhones or with computers with a simple scan. WifiTransfer enables simple and ultra fast file transfer between iPhones over +Wi-Fi networks. Without any additional setup, just a QRCode scan will do. The target iPhone doesn`t have to install WifiTransfer. +An iPhone with an ARBITRARY scanner will do. (However, with WifiTransfer installed on the target iPhone, you will have better +control on the transfer process.) In addition to transfer files between iPhone/iPad, you can also remotely manage files on your +iPhone right from your desktop computer. Supported browsers: Safari, Chrome, FireFox, Internet Explorer. + +(Copy of the Homepage: https://itunes.apple.com/us/app/wifitransfer-pro-instant-file/id802094784 ) + + +Abstract Advisory Information: +============================== +The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the official Notable Group WifiTransfer Pro v1.1 iOS mobile web-application. + + +Vulnerability Disclosure Timeline: +================================== +2014-04-28: Public Disclosure (Vulnerability Laboratory) + + +Discovery Status: +================= +Published + + +Affected Product(s): +==================== +Notable Group +Product: WifiTransfer Pro - iOS Mobile Application 1.1 + + +Exploitation Technique: +======================= +Local + + +Severity Level: +=============== +High + + +Technical Details & Description: +================================ +A local file include web vulnerability has been discovered in the official Notable Group WifiTransfer Pro v1.1 iOS mobile web-application. +The local file include web vulnerability allows remote attackers to unauthorized include local file/path requests or system specific path +commands to compromise the mobile web-application. + +The web vulnerability is located in the `filename` value of the `upload` module. Remote attackers are able to inject own files with malicious +`filename` values in the `upload` POST method request to compromise the mobile web-application. The local file/path include execution occcurs +in the `WifiTransfer File Management` listing context. The attacker is able to inject the local file include request by usage of the +`wifi interface` or by a local privileged application user account via `file sync`(app). + +Remote attackers are also able to exploit the filename validation issue in combination with persistent injected script codes to execute different +local malicious attacks requests. The attack vector is on the application-side of the wifi service and the request method to inject is POST. The security +risk of the local file include web vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 6.5. + +Exploitation of the local file include web vulnerability requires no user interaction but a privileged web-application user account with low user auth. +Successful exploitation of the local file include web vulnerability results in mobile application or connected device component compromise. + +Request Method(s): + [+] [POST] - Remote + [+] [SYNC] - Local + +Vulnerable Module(s): + [+] WifiTransfer File Management (UI) + +Vulnerable Function(s): + [+] Upload + +Vulnerable Parameter(s): + [+] filename + +Affected Module(s): + [+] Index File Dir Listing (http://localhost:8080/) + + +Proof of Concept (PoC): +======================= +The local file include web vulnerability can be exploited by attackers without privileged application user account and low user interaction. +For security demonstration or to reproduce the file include web vulnerability follow the provided information and steps below to continue. + +Manual steps to reproduce the vulnerability ... + +1. Install the vulnerable wifi ios software app (https://itunes.apple.com/us/app/wifitransfer-pro-instant-file/id802094784) +2. Start the server and activate the localhost wifi server +3. Open the wifi interface in a browser or console > http://localhost:8080/ +4. The the directory button to choose a file for a upload +5. Activate a session tamper to capture the request information to intercept +6. Click the upload button and inject your own path/file request inside of the filename value +7. Open the interface in the browser and the execution occurs in the file dir item listing context +8. Successful reproduce of the security vulnerability via wifi user interface! + +Note: The inject is also possible via sync + +1. Add a file in the device app interface +2. Inject the path request as payload in combination with script code and save +3. Activate the localhost wifi interface (web-server) +4. Open the interface in the browser and the execution occurs in the file dir item listing context +5. Successful reproduce of the security vulnerability via app sync! + + +PoC: + + + + + +
NameAction
<./-[LOCAL FILE INCLUDE VULNERABILITY!].png.png
Download
+ + + + +--- PoC Session Logs [POST] --- +Status: 302[Found] +POST http://localhost:8080/files Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Gr??e des Inhalts[67] Mime Type[text/html] + Request Header: + Host[localhost:8080] + User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0] + Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] + Accept-Language[de,en-US;q=0.7,en;q=0.3] + Accept-Encoding[gzip, deflate] + Referer[http://localhost:8080/] + Connection[keep-alive] + POST-Daten: + POST_DATA[-----------------------------2128355697111 +Content-Disposition: form-data; name="newfile"; filename="./-[LOCAL FILE INCLUDE VULNERABILITY!].png" +Content-Type: image/png + + +Reference(s): +http://localhost:8080/ +http://localhost:8080/files + + +Solution - Fix & Patch: +======================= +The vulnerability can be patched by a secure parse and encode of the vulnerable filename input value in the upload POST method request. +Filter and encode also the name value output in the wifi interface file dir listing. +Setup a restriction of the filename input and disallow data names with special chars. + + +Security Risk: +============== +The security risk of the local file include web vulnerability in the wifi interface is estimated as high. + + +Credits & Authors: +================== +Vulnerability Laboratory [Research Team] - LariX4 (research@evolution-sec.com) [www.vulnerability-lab.com] + + +Disclaimer & Information: +========================= +The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, +either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability- +Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business +profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some +states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation +may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases +or trade with fraud/stolen material. + +Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com +Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com +Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com +Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab +Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php + +Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. +Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other +media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and +other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), +modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission. + + Copyright ? 2014 | Vulnerability Laboratory [Evolution Security] + +-- +VULNERABILITY LABORATORY RESEARCH TEAM +DOMAIN: www.vulnerability-lab.com +CONTACT: research@vulnerability-lab.com + + diff --git a/platforms/ios/webapps/33628.txt b/platforms/ios/webapps/33628.txt new file mode 100755 index 000000000..8d4ba698e --- /dev/null +++ b/platforms/ios/webapps/33628.txt @@ -0,0 +1,285 @@ +Document Title: +=============== +Files Desk Pro v1.4 iOS - File Include Web Vulnerability + + +References (Source): +==================== +http://www.vulnerability-lab.com/get_content.php?id=1266 + + +Release Date: +============= +2014-05-16 + + +Vulnerability Laboratory ID (VL-ID): +==================================== +1266 + + +Common Vulnerability Scoring System: +==================================== +6.7 + + +Product & Service Introduction: +=============================== +FileDesk is iPhone/iPad app for managing your files. Read differect kind of files,Create PDFs with different contents, Make your +documents/files private,Share Your files over WiFi. File Desk - A digital desk for your files. Manage your Documents/Files With File Desk. + +(Copy of the Homepage: https://itunes.apple.com/ag/app/file-desk-pro-documents-manager/id600550320 ) + + +Abstract Advisory Information: +============================== +The Vulnerability Laboratory Research Team discovered a local file include web vulnerability in the official Files Desk Pro v1.4 iOS mobile web-application. + + +Vulnerability Disclosure Timeline: +================================== +2014-05-16: Public Disclosure (Vulnerability Laboratory) + + +Discovery Status: +================= +Published + + +Affected Product(s): +==================== +LiveBird Technologies Private Limited +Product: Files Desk Pro & Lite 1.4 + + +Exploitation Technique: +======================= +Local + + +Severity Level: +=============== +High + + +Technical Details & Description: +================================ +A local file include web vulnerability has been discovered in the official Files Desk Pro v1.4 iOS mobile web-application. +The local file include web vulnerability allows remote attackers to unauthorized include local file/path requests or system +specific path commands to compromise the mobile web-application. + +The web vulnerability is located in the `filename` value of the `upload` module. Remote attackers are able to inject own files +with malicious `filename` values in the `upload` POST method request to compromise the mobile web-application. The local file/path +include execution occcurs in the `index file dir` list of the `filesdesk` manager. The attacker is able to inject the local file +include request by usage of the `wifi interface` or by a local privileged application user accounts via `file sync`(app). + +Remote attackers are also able to exploit the filename validation issue in combination with persistent injected script codes to +execute different local malicious attacks requests. The attack vector is on the application-side of the wifi service and the +request method to inject is POST. The security risk of the local file include web vulnerability is estimated as high with a +cvss (common vulnerability scoring system) count of 6.7. + +Exploitation of the local file include web vulnerability requires no user interaction but a privileged web-application user +account with low user auth. Successful exploitation of the local file include web vulnerability results in mobile application +or connected device component compromise. + +Request Method(s): + [+] [POST] - Remote + [+] [SYNC] - Local + +Vulnerable Module(s): + [+] FilesDesk Wifi (UI) + +Vulnerable Function(s): + [+] Upload + +Vulnerable Parameter(s): + [+] filename + +Affected Module(s): + [+] Index File Dir Listing (http://localhost:8081/) + + +Proof of Concept (PoC): +======================= +The local file/path include web vulnerability can be exploited local attackers without privileged application user account and without user interaction. +For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue. + +Manual steps to reproduce ... +1. Install the FileDesk mobile application to your iOS device (ipad or iphone) +2. Start the local wifi web-server and share some random files +3. Connect with another remote computer to the local web-server interface url > web.localhost:8081 +4. Start a session tamper and choose a random file to upload +5. Submit the upload form and intercept in the session to change the vulnerable filename value to a local device file/path +Note: Can also be combined with script codes and html tags +6. Refresh the index and the execution of the malicious request occurs in the index file dir list (name value) +7. Successful reproduce of the file include web vulnerability! + + +PoC: FilesDesk Index + + + + + + +
NameDelete
<[LOCAL FILE/PATH INCLUDE + +VULNERABILITY!]">.png
+ + + + +Vulnerable Source: Upload Script + + + + +--- PoC Session Logs [POST] --- +Status: 302[Found] +POST http://192.168.2.104:8081/files Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Gr??e des Inhalts[67] Mime Type[text/html] + Request Header: + Host[192.168.2.104:8081] + User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0] + Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] + Accept-Language[de,en-US;q=0.7,en;q=0.3] + Accept-Encoding[gzip, deflate] + Referer[http://192.168.2.104:8081/] + Connection[keep-alive] + POST-Daten: + POST_DATA[-----------------------------147491436412682 +Content-Disposition: form-data; name="newfile"; filename="%3C../[LOCAL FILE/PATH INCLUDE VULNERABILITY!].png" +Content-Type: image/png + + +Status: 200[OK] +GET http://192.168.2.104:8081/ Load Flags[LOAD_DOCUMENT_URI LOAD_REPLACE LOAD_INITIAL_DOCUMENT_URI ] Gr??e des Inhalts[2953] Mime Type[application/x-unknown-content-type] + Request Header: + Host[192.168.2.104:8081] + User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0] + Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] + Accept-Language[de,en-US;q=0.7,en;q=0.3] + Accept-Encoding[gzip, deflate] + Referer[http://192.168.2.104:8081/] + Connection[keep-alive] + Response Header: + Accept-Ranges[bytes] + Content-Length[2953] + Date[Do., 15 Mai 2014 14:27:35 GMT] + + + + +Status: 200[OK] +GET http://192.168.2.104:8081/files?Thu%20May%2015%202014%2016:14:57%20GMT+0200 Load Flags[LOAD_BACKGROUND ] Gr??e des Inhalts[39] Mime Type[text/plain] + Request Header: + Host[192.168.2.104:8081] + User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0] + Accept[application/json, text/javascript, */*] + Accept-Language[de,en-US;q=0.7,en;q=0.3] + Accept-Encoding[gzip, deflate] + X-Requested-With[XMLHttpRequest] + Referer[http://192.168.2.104:8081/] + Connection[keep-alive] + Response Header: + Accept-Ranges[bytes] + Content-Length[39] + Cache-Control[private, max-age=0, must-revalidate] + Content-Type[text/plain; charset=utf-8] + Date[Do., 15 Mai 2014 14:27:37 GMT] + + + + +Status: 200[OK] +GET http://192.168.2.104:8081/%3C../[LOCAL FILE/PATH INCLUDE VULNERABILITY!] Load Flags[LOAD_DOCUMENT_URI ] Gr??e des Inhalts[0] Mime Type[application/x-unknown-content-type] + Request Header: + Host[192.168.2.104:8081] + User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0] + Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] + Accept-Language[de,en-US;q=0.7,en;q=0.3] + Accept-Encoding[gzip, deflate] + Referer[http://192.168.2.104:8081/] + Connection[keep-alive] + Response Header: + Accept-Ranges[bytes] + Content-Length[0] + Date[Do., 15 Mai 2014 14:27:38 GMT] + + + + +Reference(s): +http://web.localhost:8081/[x] +http://web.localhost:8081/files + + +Solution - Fix & Patch: +======================= +The vulnerability can be patched by a secure parse and encode of the filename value in the upload POST method request. +Disallow special chars for files and foldernames and restrict the user input. Encode and parse also the vulnerable name output value. + + +Security Risk: +============== +The security risk of the local file include web vulnerability in the filename value is estimated as high(-). + + +Credits & Authors: +================== +Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com] + + +Disclaimer & Information: +========================= +The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either +expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers +are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even +if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation +of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break +any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. + +Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com +Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com +Section: dev.vulnerability-db.com - forum.vulnerability-db.com - magazine.vulnerability-db.com +Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab +Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php +Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/ + +Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to +electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by +Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website +is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact +(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission. + + Copyright ? 2014 | Vulnerability Laboratory [Evolution Security] + + + +-- +VULNERABILITY LABORATORY RESEARCH TEAM +DOMAIN: www.vulnerability-lab.com +CONTACT: research@vulnerability-lab.com + + diff --git a/platforms/ios/webapps/33629.txt b/platforms/ios/webapps/33629.txt new file mode 100755 index 000000000..458d58ef6 --- /dev/null +++ b/platforms/ios/webapps/33629.txt @@ -0,0 +1,197 @@ +Document Title: +=============== +Privacy Pro v1.2 HZ iOS - File Include Web Vulnerability + + +References (Source): +==================== +http://www.vulnerability-lab.com/get_content.php?id=1267 + + +Release Date: +============= +2014-05-23 + + +Vulnerability Laboratory ID (VL-ID): +==================================== +1267 + + +Common Vulnerability Scoring System: +==================================== +6.6 + + +Product & Service Introduction: +=============================== +First of all,you need to enter the password two times that means to enter the password and confirm password,please remember the password, so as +to avoid unnecessary trouble. Personal information manager can provide personal information service personal for you, and provide the password +verification to ensure the privacy and security of your, include private account, video, pictures, books, telephone, recording, encryption and +decryption , memos and other functions, and the personal information manager can support WiFi data backup and recovery, we hope it can give +quite a lot convenient to your life. + +( Copy of the Homepage: https://itunes.apple.com/de/app/privacy-account-video-picture/id790084948 ) + + +Abstract Advisory Information: +============================== +The Vulnerability Laboratory Research Team discovered a local file include web vulnerability in the official Privacy Pro v1.2 iOS mobile web-application. + + +Vulnerability Disclosure Timeline: +================================== +2014-05-22: Public Disclosure (Vulnerability Laboratory) + + +Discovery Status: +================= +Published + + +Affected Product(s): +==================== +Huang Zhuan +Product: Privacy [Account Video Picture Books Record] - iOS Mobile Web Application 1.2 + + +Exploitation Technique: +======================= +Local + + +Severity Level: +=============== +High + + +Technical Details & Description: +================================ +A local file include web vulnerability has been discovered in the official Privacy Pro v1.2 iOS mobile web-application. +The local file include web vulnerability allows remote attackers to unauthorized include local file/path requests or system +specific path commands to compromise the mobile web-application. + +The web vulnerability is located in the `filename` value of the `upload` module. Remote attackers are able to inject own files with +malicious `filename` values in the `upload` POST method request to compromise the mobile web-application. The local file/path include +execution occcurs not like regular in the index list but inside of the upload formular message filename context. The attacker is able +to inject the local file include request by usage of the `wifi interface`. The affected service inside of the application is only the +privacy manager `wifi revover data` module. (localhost:56380 -restore) + +Remote attackers are also able to exploit the filename validation issue in combination with persistent injected script codes to execute +different local malicious attacks requests. The attack vector is on the application-side of the wifi service and the request method to +inject is POST. + +The security risk of the local file include web vulnerability is estimated as high with a cvss (common vulnerability scoring system) +count of 6.6. Exploitation of the local file include web vulnerability requires no user interaction but a privileged web-application +user account with low user auth. Successful exploitation of the local file include web vulnerability results in mobile application or +connected device component compromise. + + +Request Method(s): + [+] [POST] + +Vulnerable Service(s): + [+] WiFi Restore Data + +Vulnerable Module(s): + [+] Upload + +Vulnerable Parameter(s): + [+] filename + +Affected Module(s): + [+] Index File Dir Listing (http://localhost:56380/) + + +Proof of Concept (PoC): +======================= +The local file/path include web vulnerability can be exploited by local network attackers with low user interaction. For security demonstration or +to reproduce the vulnerability follow the provided information and steps below to continue. + +PoC: Source +../.[FILE/PATH INCLUDE VULNERABILITY!] Upload successfully! + + +--- PoC Session Logs [POST] --- +POST http://localhost:56380/upload Load Flags[LOAD_ONLY_FROM_CACHE LOAD_FROM_CACHE VALIDATE_NEVER LOAD_INITIAL_DOCUMENT_URI ] Gr??e des Inhalts[-1] Mime Type[unbekannt] + Request Header: + Host[localhost:56380] + User-Agent +[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0] + Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] + Accept-Language[de,en-US;q=0.7,en;q=0.3] + Accept-Encoding[gzip, deflate] + Referer[http://localhost:56380/index.html] + POST-Daten: + POST_DATA[-----------------------------57581386217946 +Content-Disposition: form-data; name="upload_file"; filename="../.[LOCAL FILE/PATH INCLUDE VULNERABILITY!].jpg" +Content-Type: image/jpg + +Response Header: +Status: 200[OK] +GET http://192.168.2.104:56380/index.html Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Gr??e des Inhalts[1084] Mime Type[text/html] + Request Header: + Host[192.168.2.104:56380] + User-Agent +[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0] + Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] + Accept-Language[de,en-US;q=0.7,en;q=0.3] + Accept-Encoding[gzip, deflate] + Connection[keep-alive] + Response Header: + Content-Length[1084] + Content-Type[text/html] + + +Reference(s): +http://localhost:56380/index.html (Wifi Restore Data) +http://localhost:56380/upload (Vulnerable File) + + +Solution - Fix & Patch: +======================= +The vulnerability can be patched by a secure encode and parse of the upload notification message context and input value. +Restrict the upload input and validate the context next to the data restore. + + +Security Risk: +============== +The security risk of the local file/path include web vulnerability is estimated as high(-). + + +Credits & Authors: +================== +Vulnerability Laboratory [Research Team] - LariX4 (research@evolution-sec.com) [www.vulnerability-lab.com] + + +Disclaimer & Information: +========================= +The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either +expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers +are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even +if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation +of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break +any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. + +Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com +Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com +Section: dev.vulnerability-db.com - forum.vulnerability-db.com - magazine.vulnerability-db.com +Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab +Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php +Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/ + +Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to +electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by +Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website +is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact +(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission. + + Copyright ? 2014 | Vulnerability Laboratory [Evolution Security] + + +-- +VULNERABILITY LABORATORY RESEARCH TEAM +DOMAIN: www.vulnerability-lab.com +CONTACT: research@vulnerability-lab.com + + diff --git a/platforms/ios/webapps/33630.txt b/platforms/ios/webapps/33630.txt new file mode 100755 index 000000000..aee98c718 --- /dev/null +++ b/platforms/ios/webapps/33630.txt @@ -0,0 +1,220 @@ +Document Title: +=============== +TigerCom My Assistant v1.1 iOS - File Include Vulnerability + + +References (Source): +==================== +http://www.vulnerability-lab.com/get_content.php?id=1268 + + +Release Date: +============= +2014-05-23 + + +Vulnerability Laboratory ID (VL-ID): +==================================== +1268 + + +Common Vulnerability Scoring System: +==================================== +6.9 + + +Product & Service Introduction: +=============================== +Folder manager, Convenient transmission, Document browsing, Compression & Decompression, Password-protected. + +- Support multi-level directory management +- Add new folder +- Open camera, store photos and recording video +- Photos and video high fidelity storage +- Import photos and videos from album +- Export photos and videos to your album +- Copy, paste, delete, Email attachments +- Support multiple files operation +- Support sorting by name and type +- Icon shows file type + +Convenient transmission: +- Wifi Transmission, you can share files between iphone, ipad and computer +- Current open folder sharing, better protect your privacy +- USB transfer and share files via Itunes + +Document browsing: +- Txt document browsing and editing (txt) +- PDF document browsing (pdf) +- Word browsing (doc, docx) +- Excel browsing (xls, xlsx) +- PowerPoint browsing (ppt, pptx) +- Picture browsing (png, jpg, jpeg, jpe) +- Video player (mov, mp4, m4v, mpv, 3pg) +- Audio player (mp3, wav, aif) + +Safty: +- Intelligent encryption, protect the folder +- Password-protected switch + +( Copy of the Homepage: https://itunes.apple.com/en/app/my-assistant-free/id626680229 ) + + +Abstract Advisory Information: +============================== +The Vulnerability Laboratory Research Team discovered a local file include web vulnerability in the official TigerCom My Assistant v1.1 iOS mobile web-application. + + +Vulnerability Disclosure Timeline: +================================== +2014-05-23: Public Disclosure (Vulnerability Laboratory) + + +Discovery Status: +================= +Published + + +Affected Product(s): +==================== +TigerCom +Product: My Assistant Free 1.1 + + +Exploitation Technique: +======================= +Local + + +Severity Level: +=============== +High + + +Technical Details & Description: +================================ +A local file include web vulnerability has been discovered in the official TigerCom My Assistant v1.1 iOS mobile web-application. +The local file include web vulnerability allows remote attackers to unauthorized include local file/path requests or system specific +path commands to compromise the mobile web-application. + +The web vulnerability is located in the `filename` value of the `UPLOAD_FILE_TO_FOLDER` (uploadfile) module. Remote attackers are able +to inject own files with malicious `filename` values in the `upload` POST method request to compromise the mobile web-application. The local +file/path include execution occcurs in the index file/folder list context in the vulnerable name/path value. The attacker is able to inject +the local file include request by usage of the available `wifi interface`. + +Remote attackers are also able to exploit the filename validation issue in combination with persistent injected script codes to execute +different local malicious attacks requests. The attack vector is on the application-side of the wifi service and the request method to +inject is POST. + +The security risk of the local file include web vulnerability is estimated as high with a cvss (common vulnerability scoring system) +count of 7.0. Exploitation of the local file include web vulnerability requires no privileged web-application user account but low +user interaction. Successful exploitation of the local file include web vulnerability results in mobile application or connected +device component compromise. + + +Request Method(s): + [+] [POST] + +Vulnerable Service(s): + [+] WiFi Sharing + +Vulnerable Module(s): + [+] UPLOAD_FILE_TO_FOLDER + +Vulnerable File(s): + [+] uploadfile + +Vulnerable Parameter(s): + [+] filename + +Affected Module(s): + [+] Index File/Folder Dir Listing (http://localhost:8080/) + + +Proof of Concept (PoC): +======================= +The local file/path include web vulnerability can be exploited by local network attackers with low user interaction. For security demonstration or +to reproduce the vulnerability follow the provided information and steps below to continue. + +PoC: UPLOAD FILE TO FOLDER +Current Folder: Document +Uploading files + 68-2.png + %20./../[LOCAL FILE/PATH INCLUDE WEB VULNERABILITY!].filetype + night-city-pictures-24.jpg + + + + + +--- PoC Session Logs [POST] --- +Status: 200[OK] + POST http://localhost:8080/uploadfile Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Gr??e des Inhalts[-1] Mime Type[application/x-unknown-content-type] + Request Header: + Host[localhost:8080] + User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0] + Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] + Accept-Language[de,en-US;q=0.7,en;q=0.3] + Accept-Encoding[gzip, deflate] + Referer[http://localhost:8080/UPLOAD_FILE_TO_FOLDER] + Connection[keep-alive] + POST-Daten: + POST_DATA[-----------------------------189051727528435 +Content-Disposition: form-data; name="upload1"; filename="<%20./../[LOCAL FILE/PATH INCLUDE WEB VULNERABILITY!].filetype" +Content-Type: image/x + + +Reference(s): +http://localhost:8080/uploadfile +http://localhost:8080/UPLOAD_FILE_TO_FOLDER + + +Solution - Fix & Patch: +======================= +The vulnerability can be patched by a secure restriction and parse of the vulnerable filename value in the multi upload module. +Restrict the input name value and encode the name output value in the index listing module to prevent further local file include attacks. +Do not forget to disallow multiple file extensions which could result in the bypass or the filetype validation. + + +Security Risk: +============== +The security risk of the local file include web vulnerability in the upload to file index module is estimated as high. + + +Credits & Authors: +================== +Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com] + + +Disclaimer & Information: +========================= +The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either +expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers +are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even +if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation +of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break +any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. + +Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com +Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com +Section: dev.vulnerability-db.com - forum.vulnerability-db.com - magazine.vulnerability-db.com +Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab +Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php +Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/ + +Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to +electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by +Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website +is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact +(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission. + + Copyright ? 2014 | Vulnerability Laboratory [Evolution Security] + + + +-- +VULNERABILITY LABORATORY RESEARCH TEAM +DOMAIN: www.vulnerability-lab.com +CONTACT: research@vulnerability-lab.com + + diff --git a/platforms/ios/webapps/33631.txt b/platforms/ios/webapps/33631.txt new file mode 100755 index 000000000..e7fa689f5 --- /dev/null +++ b/platforms/ios/webapps/33631.txt @@ -0,0 +1,213 @@ +Document Title: +=============== +AllReader v1.0 iOS - Multiple Web Vulnerabilities + + +References (Source): +==================== +http://www.vulnerability-lab.com/get_content.php?id=1269 + + +Release Date: +============= +2014-05-26 + + +Vulnerability Laboratory ID (VL-ID): +==================================== +1269 + + +Common Vulnerability Scoring System: +==================================== +6.8 + + +Product & Service Introduction: +=============================== +Professional helper on your iPhone, iPad, and iPod that will allow you to read virtually any file type right from your device: PDF, DJVU, DOC, XLS, PPT, TXT, +Image, Video files, whether these are important documents, books, student materials, notes or you can just view pictures and video clips. +Supported devices: iPhone 3Gs/4/4S/5, iPod Touch 4/5, all iPad generations. + +(Copy of the Homepage: https://itunes.apple.com/us/app/all-reader./id871830567 ) + + +Abstract Advisory Information: +============================== +The Vulnerability Laboratory Research Team discovered a local file include web vulnerability in the official AllReader v1.0 iOS mobile application by Wylsacom Waytt. + + +Vulnerability Disclosure Timeline: +================================== +2014-05-26: Public Disclosure (Vulnerability Laboratory) + + +Discovery Status: +================= +Published + + +Affected Product(s): +==================== +Wylsacom Waytt +Product: AllReader - iOS Mobile Application 1.0 + + +Exploitation Technique: +======================= +Local + + +Severity Level: +=============== +High + + +Technical Details & Description: +================================ +A local file include web vulnerability has been discovered in the official AllReader v1.0 iOS mobile application by Wylsacom Waytt. +The local file include web vulnerability allows remote attackers to unauthorized include local file/path requests or system specific +path commands to compromise the mobile web-application. + +The web vulnerability is located in the `filename` value of the `file upload` module. Remote attackers are able to inject own files with +malicious `filename` values in the `file upload` POST method request to compromise the mobile web-application. The local file/path +execution occcurs in the index file/path dir list context. The attacker is able to inject the malicious file/path include request by usage +of the available `wifi interface`. + +Remote attackers are also able to exploit the filename validation issue in combination with persistent injected script codes to execute +different local malicious attacks requests. The attack vector is on the application-side of the allreader wifi service and the request +method to inject is POST. + +The security risk of the local file include web vulnerability is estimated as high with a cvss (common vulnerability scoring system) count +of 6.8. Exploitation of the local file include web vulnerability requires no privileged web-application user account withoutuser interaction. +Successful exploitation of the local file include web vulnerability results in mobile application or connected device component compromise. + + +Request Method(s): + [+] [POST] + +Vulnerable Service(s): + [+] WiFi Transfer UI + +Vulnerable Module(s): + [+] Upload File + +Vulnerable Parameter(s): + [+] filename + +Affected Module(s): + [+] Index File/Folder Dir Listing (http://localhost:8080/) + + +Proof of Concept (PoC): +======================= +The local file/path include web vulnerability in the web-server can be exploited by local attackers without auth or user interaction. +For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue. + +Manual steps to reproduce the security vulnerability ... +1. Install the ios application (iphone or ipad) +2. Start it and move to the settings menu, activate the wifi server +3. Go to another computer in the same network and surf to the local web-server url (localhost:8080) +4. Upload a random image +5. Tamper the session information by an intercept, exchange the vulnerable `filename` value with own malicious file or path request +Note: Payloads can be combined with script code to successful execute different other attacks like hijacking, phishing and co. +5. Submit the settings and refresh the file dir index list +6. The code execution occurs in the file dir index list of ios app +7. Successful reproduce of the local fil/path include web vulnerability + +PoC: File Dir Index List - http://localhost:8080/ +Files from

Files from

+The following files are hosted live from the iPhone's Docs folder.

..
+<../.[LOCAL FILE/PATH INCLUDE WEB VULNERABILITY!].png (0.5 Kb, 2014-05-26 11:49:04 +0000)
+

+

+ + +--- POC SESSION LOGS [POST] --- +Status: 200[OK] +POST http://localhost:8080/ Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Gr??e des Inhalts[821] Mime Type[application/x-unknown-content-type] + Request Header: + Host[localhost:8080] + User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0] + Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] + Accept-Language[de,en-US;q=0.7,en;q=0.3] + Accept-Encoding[gzip, deflate] + Referer[http://localhost:8080/] + Connection[keep-alive] + POST-Daten: + POST_DATA[-----------------------------102203247921326 +Content-Disposition: form-data; name="file"; filename="../.[LOCAL FILE/PATH INCLUDE WEB VULNERABILITY!].png" +Content-Type: image/png + +-- RESPONSE HEADER +Status: 200[OK] +GET http://localhost:8080/../.[LOCAL FILE/PATH INCLUDE WEB VULNERABILITY!] Load Flags[LOAD_DOCUMENT_URI ] Gr??e des Inhalts[721] Mime Type[application/x-unknown-content-type] + Request Header: + Host[localhost:8080] + User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0] + Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] + Accept-Language[de,en-US;q=0.7,en;q=0.3] + Accept-Encoding[gzip, deflate] + Referer[http://localhost:8080/] + Connection[keep-alive] + Response Header: + Accept-Ranges[bytes] + Content-Length[721] + Date[Mo., 26 Mai 2014 11:49:06 GMT] + + + +Reference(s): +http://localhost:8080/ +http://localhost:8080/../x + + +Solution - Fix & Patch: +======================= +The vulnerability can be patched by a secure parse and encode of the vulnerale filename value in the upload module POST method request. +The file dir index list needs to encode malicious filenames even of the input is already parsed to prevent further attacks via file/path value. +Restrict, filter or use a secure exception-handling to disallow special chars, html tags or script codes. + + +Security Risk: +============== +The security risk of the local file/path include web vulnerability is estimated as high(-). + + +Credits & Authors: +================== +Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com] + + +Disclaimer & Information: +========================= +The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either +expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers +are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even +if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation +of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break +any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. + +Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com +Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com +Section: dev.vulnerability-db.com - forum.vulnerability-db.com - magazine.vulnerability-db.com +Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab +Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php +Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/ + +Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to +electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by +Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website +is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact +(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission. + + Copyright ? 2014 | Vulnerability Laboratory [Evolution Security] + +-- +VULNERABILITY LABORATORY RESEARCH TEAM +DOMAIN: www.vulnerability-lab.com +CONTACT: research@vulnerability-lab.com + + diff --git a/platforms/ios/webapps/33632.txt b/platforms/ios/webapps/33632.txt new file mode 100755 index 000000000..c23b15ca7 --- /dev/null +++ b/platforms/ios/webapps/33632.txt @@ -0,0 +1,400 @@ +Document Title: +=============== +Bluetooth Photo-File Share v2.1 iOS - Multiple Web Vulnerabilities + + +References (Source): +==================== +http://www.vulnerability-lab.com/get_content.php?id=1270 + + +Release Date: +============= +2014-05-30 + + +Vulnerability Laboratory ID (VL-ID): +==================================== +1270 + + +Common Vulnerability Scoring System: +==================================== +7 + + +Product & Service Introduction: +=============================== +This is the best bluetooth sharing and file transfer app in app store. Transfer photo, video, contacts and any file between two +iPhone, iPad and/or iPod Touches over bluetooth connection. Requires iPhone 3G or later or 2nd generation iPod Touch or later. +Does not require any 3G or WiFi connection. Unlike some other bluetooth photo sharing apps only can transfer photo from Photo +Library, The bluetooth share not only can transfer photo, but also it can transfer video from Photo Library. + +( Copy of the Homepage: https://itunes.apple.com/de/app/bluetooth-photo-video-musik/id590369016 ) + + +Abstract Advisory Information: +============================== +The Vulnerability Laboratory Research Team discovered multiple web vulnerabilities in the official Bluetooth Photo/Video /Musik /Contact /File Share v2.1 iOS mobile application. + + +Vulnerability Disclosure Timeline: +================================== +2014-05-30: Public Disclosure (Vulnerability Laboratory) + + +Discovery Status: +================= +Published + + +Affected Product(s): +==================== +Tao Xu +Product: Bluetooth Photo /Video /Musik /Contact /File Share - iOS Mobile Web Application 2.1 + + +Exploitation Technique: +======================= +Remote + + +Severity Level: +=============== +High + + +Technical Details & Description: +================================ +1.1 +A local file include web vulnerability has been discovered in the official Bluetooth Photo/Video /Musik /Contact /File Share v2.1 iOS mobile application. +The local file include web vulnerability allows remote attackers to unauthorized include local file/path requests or system specific path commands to +compromise the mobile web-application. + +The web vulnerability is located in the `filename` value of the `data upload` module. Remote attackers are able to inject own files with malicious `filename` +values in the `file upload` POST method request to compromise the mobile web-application. The local file/path execution occcurs in the file/path dir index +list web context. The attacker is able to inject the malicious file/path include request by usage of the available `filesharing > wifi-transfer interface`. + +Local attackers are also able to exploit the filename validation issue in combination with persistent injected script codes to execute different local malicious +attacks requests. The attack vector is on the application-side of the allreader wifi service and the request method to inject is POST. The security risk of the +local file include web vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 6.8. + +Exploitation of the local file include web vulnerability requires no privileged web-application user account withoutuser interaction. +Successful exploitation of the local file include web vulnerability results in mobile application or connected device component compromise. + +Request Method(s): + [+] [POST] + +Vulnerable Module(s): + [+] Filesharing > Wi-fi Transfer UI + +Vulnerable Function(s): + [+] Upload + +Vulnerable Parameter(s): + [+] filename + +Affected Module(s): + [+] Index File Dir List (http://localhost:8080/) + + + + +1.2 +An arbitrary file upload web vulnerability has been discovered in the official Bluetooth Photo/Video /Musik /Contact /File Share v2.1 iOS mobile application. +The arbitrary file upload issue allows remote attackers to upload files with multiple extensions to bypass the system validation and compromise the web-server. + +The vulnerability is located in the upload file module. Remote attackers are able to upload a php or js web-shells by a rename of the file with multiple extensions +to bypass the file restriction mechanism. The attacker uploads for example a web-shell with the following name and extension `pentest.png.js.html.php`. After the +upload the attacker needs to open the file in the web application. He deletes the .png file extension and can access the application with elevated access rights. +The security risk of the arbitrary file upload web vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 7.1. + +Exploitation of the arbitrary file upload web vulnerability requires no user interaction or privilege application user account with password. +Successful exploitation of the vulnerability results in unauthorized file access because of a compromise after the upload of web-shells. + + +Request Method(s): + [+] [POST] + +Vulnerable Module(s): + [+] Filesharing > Wi-fi Transfer UI + +Vulnerable Function(s): + [+] Upload + +Vulnerable Parameter(s): + [+] filename (multiple extensions) + +Affected Module(s): + [+] Index File Dir Listing (http://localhost:8080) + + +Proof of Concept (PoC): +======================= +1.1 +The local file include web vulnerability can be exploited by local attackers without privileged application user account or user interaction. +For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. + +Manual steps to reproduce the vulnerability ... + +1. Install the mobile application to your apple ios device (iphone/ipad) +2. Open the application locally and activate the wifi transfer & export function +3. Login to another remote device in the same network to the application interface (localhost:8080) +4. Choose a random file to upload, start a session tamper to intercept and press the submit button +5. Change in the POST method request of the upload module the vulnerable filename value +Note: Include for example a local device component file or mobile application path as value +6. Continue the request, refresh the index page and download the local file or request unauthorized the mobile device path +7. Successful reproduce of the local file include web vulnerability! + + +PoC: Wi-fi Transfer (UI) - Index File Dir Listing + +
+
+ + + + + +
File NameFile Size
+<./[LOCAL FILE/PATH INCLUDE VULNERABILITY VIA FILENAME VALUE]">.png538.00B
+
+

+ + +--- POC SESSION LOGS [POST] (LFI) --- +19:32:08.304[128ms][total 128ms] Status: 302[Found] +POST http://localhost:8080/files Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Gr??e des Inhalts[67] Mime Type[text/html] + Request Header: + Host[localhost:8080] + User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0] + Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] + Accept-Language[de,en-US;q=0.7,en;q=0.3] + Accept-Encoding[gzip, deflate] + Referer[http://localhost:8080/] + Connection[keep-alive] + POST-Daten: + POST_DATA[-----------------------------284152263011599 +Content-Disposition: form-data; name="newfile"; filename="