295 lines
No EOL
11 KiB
Text
295 lines
No EOL
11 KiB
Text
Title:
|
||
======
|
||
File Lite 3.3 & 3.5 PRO iOS - Multiple Web Vulnerabilities
|
||
|
||
|
||
Date:
|
||
=====
|
||
2013-05-04
|
||
|
||
|
||
References:
|
||
===========
|
||
http://www.vulnerability-lab.com/get_content.php?id=939
|
||
|
||
|
||
VL-ID:
|
||
=====
|
||
939
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
5.9
|
||
|
||
|
||
Introduction:
|
||
=============
|
||
You have tons of files you need to get from one device to another, so what do you do? You use File Pro, that’s what you do.
|
||
App Chronicles! Multipurpose, Easy-to-Use and Robust app for files & documents. Import files, documents & media from PC/Mac,
|
||
email attachments, dropbox, sugarsync, iCloud & Box.net to File Pro along with amazing transfer features of FTP and Wifi.
|
||
The only documents manager app which includes total security of files along with PDF scanner, Audio Recorder and editing
|
||
TXT files. Open all kind of file & documents including RAR and CBR files.
|
||
|
||
(Copy of the Homepage: https://itunes.apple.com/de/app/file-pro-document-viewer-file/id537623975 ) [PRO VERSION]
|
||
(Copy of the Homepage: https://itunes.apple.com/de/app/file-lite-document-viewer/id540971042 ) [LITE VERSION]
|
||
|
||
|
||
Abstract:
|
||
=========
|
||
The Vulnerability Laboratory Research Team discovered multiple web vulnerabilities in the mobile File Lite 3.3 & 3.5 PRO iOS app (Apple - iPad|iPhone).
|
||
|
||
|
||
Report-Timeline:
|
||
================
|
||
2013-05-04: Public Disclosure
|
||
|
||
|
||
Status:
|
||
========
|
||
Published
|
||
|
||
|
||
Affected Products:
|
||
==================
|
||
Apple AppStore
|
||
Product: File Lite - Evereader Wi-Fi Sharing iOS 3.3 & 3.5 PRO
|
||
|
||
|
||
Exploitation-Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity:
|
||
=========
|
||
High
|
||
|
||
|
||
Details:
|
||
========
|
||
1.1
|
||
A local file include and arbitrary file upload vulnerability is detected in the mobile File Lite 3.3 & 3.5 PRO iOS app (Apple - iPad|iPhone).
|
||
The vulnerability allows remote attackers via POST method to include unauthorized remote files on the affected webserver file system.
|
||
|
||
Remote attackers can also unauthorized implement mobile webshells by using multiple file extensions (*.php.js.gif) when processing to
|
||
upload via POST request method. The attacker uploads a file with a double extension or multiple extensions and access the file in the
|
||
secound step by usage of the directory webserver dir listing to compromise the apple iphone or ipad application.
|
||
|
||
Exploitation of the local file include web vulnerability does not require user interaction and also no application user account.
|
||
Successful exploitation of the web vulnerabilities results in app/service manipulation and ipad or iphone compromise via file
|
||
include or unauthorized web-server file (webshell) upload attacks.
|
||
|
||
Vulnerable Application(s):
|
||
[+] File Lite 3.3 & 3.5 PRO - ITunes or AppStore (Apple)
|
||
|
||
Vulnerable Module(s):
|
||
[+] File Upload
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] filename
|
||
|
||
Affected Module(s):
|
||
[+] File Dir Index Listing
|
||
|
||
|
||
|
||
1.2
|
||
A persistent input validation vulnerability is detected in the mobile Wifi Photo Transfer 2.1 & 1.1 Pro app for the apple ipad & iphone.
|
||
The bug allows an attacker (remote) to implement/inject malicious script code on the application side (persistent) of the app web service.
|
||
|
||
The vulnerability is located in the index file dir listing module of the webserver (http://localhost:8080/) when processing to display
|
||
injected and via POST request method manipulated filenames. The persistent script code will be executed out of the main index file dir
|
||
listing module when the service is processing to list the new malicious injected filename as item.
|
||
|
||
Exploitation of the persistent web vulnerability requires low or medium user interaction without an application user account.
|
||
Successful exploitation of the vulnerability can lead to persistent session hijacking (customers), account steal via persistent web
|
||
attacks, persistent phishing or stable (persistent) certificate mail notification context manipulation.
|
||
|
||
Vulnerable Application(s):
|
||
[+] File Lite 3.3 & 3.5 PRO - ITunes or AppStore (Apple)
|
||
|
||
Vulnerable Module(s):
|
||
[+] File Upload
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] Name
|
||
|
||
Affected Module(s):
|
||
[+] Filename - Index File Dir Name Listing
|
||
|
||
|
||
1.3
|
||
A client side cross site scripting web vulnerability is detected in the mobile Wifi Photo Transfer 2.1 & 1.1 Pro app for the apple ipad & iphone.
|
||
The vulnerability allows remote attackers to form manipulated urls to inject script code on client side application requests.
|
||
|
||
The client side cross site scripting web vulnerability is located in the index section when processing to request the via GET a
|
||
manipulated filename (value) as response. The vulnerability occurs when a remote attacker is changing the GET file request to
|
||
own script code. The request will be executed on client side of the victims browser.
|
||
|
||
Exploitation of the vulnerability does not require an application user account but low or medium user interaction.
|
||
Successful exploitation results in client side cross site requests, unauthorized external redirects, client side phishing,
|
||
client side session hijacking and client side module context manipulation.
|
||
|
||
Vulnerable Application(s):
|
||
[+] File Lite 3.3 & 3.5 PRO - ITunes or AppStore (Apple)
|
||
|
||
Vulnerable Module(s):
|
||
[+] Files - GET Request
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] filename
|
||
|
||
|
||
Proof of Concept:
|
||
=================
|
||
1.1
|
||
the arbitrary file upload vulnerability can be exploited by remote attackers without required application user account or user interaction.
|
||
For demonstration or reproduce ...
|
||
|
||
PoC: POST REQUEST METHOD - FILE UPLOAD
|
||
|
||
Host=192.168.2.104:8080
|
||
|
||
User-Agent=Mozilla/5.0 (Windows NT 6.1; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0
|
||
|
||
Accept=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
||
|
||
Accept-Language=en-US,en;q=0.5
|
||
|
||
Accept-Encoding=gzip, deflate
|
||
DNT=1
|
||
|
||
Referer=http://192.168.2.104:8080/
|
||
|
||
Connection=keep-alive
|
||
Content-Type=multipart/form-data;
|
||
boundary=---------------------------48201118910051
|
||
Content-Length=98447
|
||
POSTDATA =-----------------------------48201118910051
|
||
Content-Disposition: form-data; name="newfile"; filename="hacki-hack.png.txt.html.php.gif[FILE UPLOAD VULNERABILITY]"
|
||
Content-Type: image/gif
|
||
?PNG ...
|
||
|
||
|
||
|
||
Review:
|
||
[{'name':'.Private', 'id':0},{'name':'1234.png.txt.iso.php.gif', 'id':1},{'name':'Recents', 'id':2},{'name':'benjamin.html', 'id':3}]
|
||
|
||
|
||
Reference(s):
|
||
http://localhost:8080/files
|
||
|
||
|
||
|
||
|
||
1.2
|
||
The persistent script code injection web vulnerability can be exploited by remote attackers without application user account and
|
||
with low user interaction. For demonstration or reproduce ...
|
||
|
||
|
||
PoC: File Name - Index Output Listing
|
||
|
||
<a href="http://192.168.2.104:8080/files/%3E%22%3Ciframe%20src=a%3E" class="file">
|
||
>"<[PERSISTENT SCRIPT CODE INJECT VULNERABILITY!] src="Welcome%20to%20Evereader%20Wi-Fi%20Sharing%21_files/hack.txt"></a><
|
||
/td><td
|
||
class='del'><form action='/files/%3E%22%3C[PERSISTENT SCRIPT CODE INJECT VULNERABILITY!]%3E'
|
||
method='post'><input name='_method' value='delete'
|
||
type='hidden'/><input name="commit" type="submit" value="Delete"
|
||
class='button' /></td></tr></tbody></table></iframe></a>
|
||
|
||
|
||
|
||
1.3
|
||
The client side script code injection web vulnerability can be exploited by remote attackers without application user account and
|
||
with low or medium required user interaction. For demonstration or reproduce ...
|
||
|
||
PoC: GET REQUEST METHOD - File Request
|
||
|
||
--- Request Header ---
|
||
Host=192.168.2.104:8080
|
||
User-Agent=Mozilla/5.0 (Windows NT 6.1; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0
|
||
Accept=application/json,
|
||
text/javascript, */*
|
||
Accept-Language=en-US,en;q=0.5
|
||
Accept-Encoding=gzip, deflate
|
||
DNT=1
|
||
X-Requested-With=XMLHttpRequest
|
||
|
||
Referer=http://192.168.2.104:8080/
|
||
Cookie=USERID=<SCRIPT>document.cookie=true</SCRIPT>; true
|
||
Connection=keep-alive
|
||
|
||
|
||
--- Response Header ---
|
||
Status=OK - 200
|
||
Accept-Ranges=bytes
|
||
Content-Length=171
|
||
Cache-Control=private, max-age=0, must-revalidate
|
||
Content-Type=text/plain;
|
||
charset=utf-8
|
||
Date=Fr., 26 Apr 2013 17:48:48 GMT
|
||
|
||
|
||
URL: http://localhost:8080/files?Fri%20Apr%2026%202013%2019:46:51%20GMT+0200
|
||
|
||
|
||
Solution:
|
||
=========
|
||
1.1
|
||
Parse the POST method request when processing to upload a file with wrong extension and disallow double extensions.
|
||
Restrict the file access of web files like html, php or java-script.
|
||
Implement a own exception-handling to prevent again future arbitrary file uploads.
|
||
|
||
1.2
|
||
Restrict the input/output of the del filename and file input parameter. Encode and parse the output of the both vulnerable values to patch the issue.
|
||
|
||
1.3
|
||
Parse the parameter request with the flag details to fix the vulnerability in the GET request.
|
||
|
||
|
||
Risk:
|
||
=====
|
||
1.1
|
||
The security risk of the remote arbitrary file upload vulnerability is estimated as high(-)
|
||
|
||
1.2
|
||
The security risk of the persistent input validation web vulnerability is estimated as medium(+).
|
||
|
||
1.3
|
||
The security risk of the client side cross site scripting vulnerability is estimated as low(+).
|
||
|
||
|
||
Credits:
|
||
========
|
||
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@vulnerability-lab.com) [www.vulnerability-lab.com]
|
||
|
||
|
||
Disclaimer:
|
||
===========
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
||
or trade with fraud/stolen material.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register
|
||
Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com
|
||
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
||
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and
|
||
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
||
modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.
|
||
|
||
Copyright © 2013 | Vulnerability Laboratory
|
||
|
||
--
|
||
VULNERABILITY RESEARCH LABORATORY
|
||
LABORATORY RESEARCH TEAM
|
||
CONTACT: research@vulnerability-lab.com |