345 lines
No EOL
16 KiB
Text
345 lines
No EOL
16 KiB
Text
Document Title:
|
||
===============
|
||
Easy FTP Pro v4.2 iOS - Command Inject Vulnerabilities
|
||
|
||
|
||
References (Source):
|
||
====================
|
||
http://www.vulnerability-lab.com/get_content.php?id=1291
|
||
|
||
|
||
Release Date:
|
||
=============
|
||
2014-08-06
|
||
|
||
|
||
Vulnerability Laboratory ID (VL-ID):
|
||
====================================
|
||
1291
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
5.7
|
||
|
||
|
||
Product & Service Introduction:
|
||
===============================
|
||
The Best FTP and SFTP client for iPhone and iPad! Easy FTP is an FTP (File Transfer Protocol) and SFTP client for
|
||
iPhone/iPod Touch. Easy FTP offer all the features of a desktop client. Also includes a web browser that allow to
|
||
download files, audio player, mp4, avi,... video player, Dropbox, also helps you to access files on your remote
|
||
computer (Mac, Windows, Linux), NAS Servers, and more.
|
||
|
||
( Copy of the Homepage: https://itunes.apple.com/en/app/easy-ftp-pro/id429071149 )
|
||
|
||
|
||
Abstract Advisory Information:
|
||
==============================
|
||
The Vulnerability Laboratory Research Team discovered two command injection web vulnerabilities in the official Easy FTP Pro v4.2 iOS mobile application.
|
||
|
||
|
||
Vulnerability Disclosure Timeline:
|
||
==================================
|
||
2014-08-06: Public Disclosure (Vulnerability Laboratory)
|
||
|
||
|
||
Discovery Status:
|
||
=================
|
||
Published
|
||
|
||
|
||
Affected Product(s):
|
||
====================
|
||
Juan Ramon Rivero
|
||
Product: Easy FTP Pro - iOS Mobile Web Application 4.2
|
||
|
||
|
||
Exploitation Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity Level:
|
||
===============
|
||
Medium
|
||
|
||
|
||
Technical Details & Description:
|
||
================================
|
||
Two local command inject web vulnerabilities has been discovered in the official Easy FTP Pro v4.2 iOS mobile application.
|
||
The vulnerability allows remote attackers to inject own commands by usage of misconfigured stored system/device values to
|
||
compromise the apple mobile iOS application.
|
||
|
||
The first vulnerability is located in the vulnerable `foldername` value of the `easy ftp wifi` module. Local attackers are
|
||
able to inject own malicious system specific commands or path value requests in the vulnerable `foldername` input value.
|
||
The execution of the command occurs in the `File Dir Index Listing` module of the easy ftp pro v4.2 mobile application.
|
||
The attacker is able to manipulate the local device values with physical or restricted acccess to compromise the mobile
|
||
application by preparing to change the foldername. The encoding of the vulnerable values in the `File Dir Index Listing`
|
||
module is broken.
|
||
|
||
The second vulnerability is also located in the `<60>asy ftp wifi` module. The same attack like on changing a foldername can
|
||
be exploited by attacker through the regular filename validation. The attacker is able to manipulate the local device values
|
||
with physical or restricted acccess to compromise the mobile application by preparing to change the filename.
|
||
|
||
The attack vector is located on the application-side and the injection requires physical device access or a local low
|
||
privileged device user account. Local attackers are also able to exploit the albumname validation issue in combination
|
||
with persistent injected script codes.
|
||
|
||
The security risk of the local command/path inject vulnerability is estimated as medium with a cvss (common vulnerability
|
||
scoring system) count of 5.7. Exploitation of the command/path inject vulnerability requires a low privileged iOS device
|
||
account with restricted access and no user interaction. Successful exploitation of the vulnerability results in unauthorized
|
||
execution of system specific commands and unauthorized path value requests to compromise the mobile iOS application or the
|
||
connected device components.
|
||
|
||
|
||
Request Method(s):
|
||
[+] [Sync]
|
||
|
||
Vulnerable Module(s):
|
||
[+] Add File & Rename File + Import
|
||
[+] Add Folder & Rename Folder + Import
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] foldername
|
||
[+] filename
|
||
|
||
Affected Module(s):
|
||
[+] File Dir Index Listing
|
||
|
||
|
||
Proof of Concept (PoC):
|
||
=======================
|
||
The local command inject web vulnerabilities can be exploited by local attackers with low privileged or restricted device user account
|
||
with physical access and without user interaction. For security demonstration or to reproduce the vulnerability follow the provided
|
||
information and steps below to continue.
|
||
|
||
|
||
PoC #1:
|
||
--- PoC Session Logs [GET] (Execution) ---
|
||
Status: pending[]
|
||
GET http://localhost:8080/[LOCAL COMMAND INJECT VULNERABILITY!] Load Flags[VALIDATE_ALWAYS ] Gr<47><72>e des Inhalts[unknown] Mime Type[unknown]
|
||
Request Header:
|
||
Host[localhost:8080]
|
||
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0]
|
||
Accept[image/png,image/*;q=0.8,*/*;q=0.5]
|
||
Accept-Language[de,en-US;q=0.7,en;q=0.3]
|
||
Accept-Encoding[gzip, deflate]
|
||
Referer[http://localhost:8080/]
|
||
|
||
|
||
12:26:56.763[0ms][total 0ms]
|
||
|
||
Status: 200[OK]
|
||
GET http://localhost:8080/index Load Flags[LOAD_DOCUMENT_URI ] Gr<47><72>e des Inhalts[unknown] Mime Type[unknown]
|
||
Request Header:
|
||
Host[localhost:8080]
|
||
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0]
|
||
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||
Accept-Language[de,en-US;q=0.7,en;q=0.3]
|
||
Accept-Encoding[gzip, deflate]
|
||
Referer[http://localhost:8080/]
|
||
|
||
|
||
12:27:11.166[0ms][total 0ms] Status: Aus dem Cache geladen[Aus dem Cache geladen]
|
||
GET http://localhost:8080/# Load Flags[LOAD_FROM_CACHE ] Gr<47><72>e des Inhalts[-1] Mime Type[unbekannt]
|
||
Request Header:
|
||
Host[localhost:8080]
|
||
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0]
|
||
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||
Accept-Language[de,en-US;q=0.7,en;q=0.3]
|
||
Accept-Encoding[gzip, deflate]
|
||
|
||
|
||
|
||
PoC: Source Foldername - File Dir Index Listing
|
||
|
||
<script type="text/javascript" charset="utf-8">
|
||
|
||
function eliminaArchivo(archNombre){
|
||
$.post("/delete/"+archNombre,
|
||
function(data) {
|
||
cargaLista(rutaActual);
|
||
});
|
||
}
|
||
function comprueba(){
|
||
var fullPath = document.getElementById('uploadFile').value;
|
||
if (fullPath) {
|
||
var startIndex = (fullPath.indexOf('\\') >= 0 ? fullPath.lastIndexOf('\\') : fullPath.lastIndexOf('/'));
|
||
var filename = fullPath.substring(startIndex);
|
||
if (filename.indexOf('\\') === 0 || filename.indexOf('/') === 0) {
|
||
filename = filename.substring(1);
|
||
}
|
||
filenombre = filename;
|
||
}
|
||
|
||
return true;
|
||
}
|
||
|
||
var rutaActual = '';
|
||
function confirma(nombre){
|
||
var borrar = confirm("Do you really want to delete: "+unescape(nombre)+"?");
|
||
if (borrar == true){
|
||
//return true;
|
||
eliminaArchivo(nombre);
|
||
}
|
||
return false;
|
||
}
|
||
function cargaLista(ruta){
|
||
$("#filelist").empty();
|
||
$("#folder").empty();
|
||
var send = ruta;
|
||
if(ruta == '..'){
|
||
if(rutaActual.lastIndexOf('/')>=0)
|
||
send = rutaActual.substr(0,rutaActual.lastIndexOf('/'));
|
||
else
|
||
send = '';
|
||
}
|
||
$.ajaxSetup({cache: false});
|
||
$.getJSON('/files/'+send/*'/files/'+ruta*/,
|
||
function(data){
|
||
var shadow = false;
|
||
//console.log(data);
|
||
rutaActual = data.currentDir;
|
||
$('#folder').append('Current path: Documents/' +data.currentDir);
|
||
$.each(data.files, function(i,item){
|
||
var trclass='';
|
||
if (shadow)
|
||
trclass= " class='shadow'";
|
||
encodeName = (encodeURI(rutaActual)+'/'+item.name).replace("'", "'");
|
||
var html = '';
|
||
if(item.type == 'FILE')
|
||
html += "<tr" + trclass + "><td class='icon'> </td><td class='filename'><a href='/files/" + encodeName + "' class='file'>" +
|
||
decodeURI(item.name) + "</a></td>" + "<td class='size'>" + item.tam + "</td>";else
|
||
html += "<tr" + trclass + "><td class='icon'><img src=\"folder.png\" alt=\"folder\" height=20 width=20 /></td><td class='filename'>
|
||
<a href='javascript:cargaLista(\"" + encodeURI(item.path).replace("'", "'") + "\")' class='file'>" + decodeURI(item.name) + "</a></td>"+"<td class='size'> </td>";
|
||
html += "<td class='date'>" + item.date + "</td>" +
|
||
"<td class='del'><a href='#' onclick='confirma(\""+escape(decodeURI(encodeURI(rutaActual)+'/'+item.name)).replace("'", "'")+"\")'><img src=\"delete.gif\"
|
||
alt=\"folder\" height=20 width=20 style=\"border:0;\" /></a></td></tr>";
|
||
$(html).appendTo("#filelist");
|
||
shadow = !shadow;
|
||
});
|
||
})
|
||
.error(function(){
|
||
alert('Connection error. Check if the web sharing is on and the iphone/ipod still connected to the network.');
|
||
});
|
||
|
||
}
|
||
$.ajaxSetup({cache: true});
|
||
$(document).ready(function(){
|
||
cargaLista('');
|
||
});
|
||
</script>
|
||
|
||
|
||
PoC #2:
|
||
--- PoC Session Logs [GET] (Execution) ---
|
||
Status: 200[OK]
|
||
GET http://localhost:8080/files/%3[LOCAL COMMAND INJECT VULNERABILITY!]_=1407321412178 Load Flags[LOAD_BACKGROUND VALIDATE_ALWAYS ] Gr<47><72>e des Inhalts[42] Mime Type[application/x-unknown-content-type]
|
||
Request Header:
|
||
Host[localhost:8080]
|
||
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0]
|
||
Accept[application/json, text/javascript, */*; q=0.01]
|
||
Accept-Language[de,en-US;q=0.7,en;q=0.3]
|
||
Accept-Encoding[gzip, deflate]
|
||
X-Requested-With[XMLHttpRequest]
|
||
Referer[http://localhost:8080/]
|
||
Connection[keep-alive]
|
||
Response Header:
|
||
Accept-Ranges[bytes]
|
||
Content-Length[42]
|
||
Date[Wed, 06 Aug 2014 10:37:15 GMT]
|
||
|
||
|
||
|
||
|
||
|
||
Status: pending[]
|
||
GET http://localhost:8080/..%3C/[LOCAL COMMAND INJECT VULNERABILITY!] Load Flags[LOAD_DOCUMENT_URI ] Gr<47><72>e des Inhalts[unknown] Mime Type[unknown]
|
||
Request Header:
|
||
Host[localhost:8080]
|
||
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0]
|
||
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||
Accept-Language[de,en-US;q=0.7,en;q=0.3]
|
||
Accept-Encoding[gzip, deflate]
|
||
Referer[http://localhost:8080/]
|
||
|
||
|
||
|
||
|
||
PoC: Source Filename - File Dir Index Listing
|
||
|
||
<div id="tlista">
|
||
<table border="0" cellpadding="0" cellspacing="0">
|
||
<thead>
|
||
<tr>
|
||
<th class="icon"><a href="javascript:cargaLista('..')" class="file"> <img src="back.png" alt="back" border="0/" height="20" width="20"></a>
|
||
|
||
</th>
|
||
<th class="filename">
|
||
Name
|
||
</th>
|
||
<th class="size">
|
||
Size
|
||
</th>
|
||
<th class="date">
|
||
Modified
|
||
</th>
|
||
<th class="del">
|
||
<a href="javascript:cargaLista(rutaActual)" class="file"> <img src="refresh.png" alt="back" border="0/" height="16" width="16"></a>
|
||
</th>
|
||
</tr>
|
||
</thead>
|
||
</table>
|
||
<table border="0" cellpadding="0" cellspacing="0">
|
||
<tbody id="filelist"><tr><td class="icon"><img src="folder.png" alt="folder" height="20" width="20"></td><td class="filename">
|
||
<a href="javascript:cargaLista("h[LOCAL COMMAND INJECT VULNERABILITY!])" class="file">[LOCAL COMMAND INJECT VULNERABILITY!]"></a></td>
|
||
<td class='size'> </td><td class='date'>06.08.14 12:27</td><td class='del'><a href='#' onclick='confirma("/[LOCAL COMMAND INJECT VULNERABILITY!]")'>
|
||
<img src="delete.gif" alt="folder" height=20 width=20 style="border:0;" /></a></td></tr></tbody></table></iframe></a></td></tr></tbody>
|
||
|
||
|
||
Solution - Fix & Patch:
|
||
=======================
|
||
The vulnerabilities can be patched by a secure parse and encode of the vulnerable file- and foldername values.
|
||
Restrict the local app user input on both values to prevent further command injection attacks. Do not forget to parse the affected output listing in the file dir listing.
|
||
|
||
|
||
Security Risk:
|
||
==============
|
||
The security risk of both command inject web vulnerabilities in the file- and foldername values are estimated as medium(+).
|
||
|
||
|
||
Credits & Authors:
|
||
==================
|
||
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]
|
||
|
||
|
||
Disclaimer & Information:
|
||
=========================
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either
|
||
expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers
|
||
are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even
|
||
if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation
|
||
of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break
|
||
any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
||
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
||
Section: dev.vulnerability-db.com - forum.vulnerability-db.com - magazine.vulnerability-db.com
|
||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
|
||
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
|
||
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
|
||
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
|
||
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
||
|
||
Copyright <20> 2014 | Vulnerability Laboratory [Evolution Security]
|
||
|
||
|
||
|
||
--
|
||
VULNERABILITY LABORATORY RESEARCH TEAM
|
||
DOMAIN: www.vulnerability-lab.com
|
||
CONTACT: research@vulnerability-lab.com |