161 lines
No EOL
7.3 KiB
Text
161 lines
No EOL
7.3 KiB
Text
Document Title:
|
|
===============
|
|
WK UDID v1.0.1 iOS - Command Inject Vulnerability
|
|
|
|
|
|
References (Source):
|
|
====================
|
|
http://www.vulnerability-lab.com/get_content.php?id=1539
|
|
|
|
|
|
Release Date:
|
|
=============
|
|
2015-07-01
|
|
|
|
|
|
Vulnerability Laboratory ID (VL-ID):
|
|
====================================
|
|
1539
|
|
|
|
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
5.6
|
|
|
|
|
|
Product & Service Introduction:
|
|
===============================
|
|
This app offers the opportunity to read device-specific information from your iPhone, iPad or iPod touch. The desired information can be
|
|
selected and sent via email to a recipient of your choice or it can be copied to the clipboard for later use. You can get information about
|
|
the unique identifier (UDID), the model, the name and the operating system of your device.
|
|
|
|
(Copy of the Homepage https://itunes.apple.com/us/app/wk-udid/id392624227 )
|
|
|
|
|
|
Abstract Advisory Information:
|
|
==============================
|
|
The Vulnerability Laboratory Research team discovered a local command inject web vulnerability in the official WK UDID v1.0.1 iOS mobile web-application.
|
|
|
|
|
|
Vulnerability Disclosure Timeline:
|
|
==================================
|
|
2015-07-01: Public Disclosure (Vulnerability Laboratory)
|
|
|
|
|
|
Discovery Status:
|
|
=================
|
|
Published
|
|
|
|
|
|
Affected Product(s):
|
|
====================
|
|
WK EDV GmbH
|
|
Product: WK UDID - iOS Mobile Web Application 1.0.1
|
|
|
|
|
|
Exploitation Technique:
|
|
=======================
|
|
Local
|
|
|
|
|
|
Severity Level:
|
|
===============
|
|
Medium
|
|
|
|
|
|
Technical Details & Description:
|
|
================================
|
|
A local command inject web vulnerability has been discovered in the official WK UDID v1.0.1 iOS mobile web-application.
|
|
The vulnerability allows to inject malicious script codes to the application-side of the vulnerable mobile app.
|
|
|
|
The vulnerability is located in the device name value of the send by mail function. Local attackers are able to manipulate the name value
|
|
of the device to compromise the mail function of the wkudid mobile app. The html encoding is broken in the send by mail export function.
|
|
Local attackers are able to manipulate the device name id to compromise the application internal validation in send emails. The attack vector
|
|
of the vulnerability is server-side and the injection point is the device name information settings.
|
|
|
|
The security risk of the local commandpath inject vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 5.6.
|
|
Exploitation of the commandpath inject vulnerability requires a low privilege androidios device account with restricted access and no user interaction.
|
|
Successful exploitation of the vulnerability results in unauthorized execution of system specific commands and unauthorized path value requests to
|
|
compromise the mobile iOS application and connected device components.
|
|
|
|
Vulnerable Module(s)
|
|
[+] Device - Settings - Information
|
|
|
|
Vulnerable Parameter(s)
|
|
[+] device name
|
|
|
|
Affected Module(s)
|
|
[+] WKUDID - Mail
|
|
|
|
|
|
Proof of Concept (PoC):
|
|
=======================
|
|
The local command inject web vulnerability can be exploited by local attackers with low privilege device user account and without user interaction.
|
|
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.
|
|
|
|
Manual steps to reproduce the vulnerability ...
|
|
1. Start the iOS device
|
|
2. Open the settings module
|
|
3. Change the name to the local command injection payload
|
|
4. Save the settings and start the application wkudid
|
|
5. Send the details by mail
|
|
6. Review the arrival inbox
|
|
7. The execution point is the xml and header location with the device name value
|
|
8. Successful reproduce of the local command inject security vulnerability!
|
|
|
|
|
|
PoC Device ID - Email
|
|
|
|
<div>Identifier (UDID): FFFFFFFFC0463E7B3E5D46A88EDF4194C74B27D1
|
|
<br>Model: iPad<br>Name: bkm337>"<./[LOCAL COMMAND INJECT VULNERABILITY VIA DEVICE NAME VALUE!]">%20<gt;<BR>
|
|
System Name: iPhone OS<BR>System Version: 8.3<BR>Total Memory (RAM): 987.98 MB<BR>
|
|
Free Memory: 19.06 MB<BR>Total Storage: 27.19 GB<BR>Free Storage: 0.70 GB<BR>
|
|
CPU Frequency: an error occured<BR>Network: WiFi<BR>Wi-Fi: 02:00:00:00:00:00<BR>
|
|
IP Address: 192.168.2.104<BR>Carrier: not available<BR></iframe></div>
|
|
|
|
|
|
Solution - Fix & Patch:
|
|
=======================
|
|
The vulnerability can be patched by a secure parse and encode of the vulnerable Device name value. Restrict the input and encode the output in the
|
|
vulnerable generated html file. Disallow script code values in the html generated file type to prevent further command injection attacks.
|
|
|
|
|
|
Security Risk:
|
|
==============
|
|
The security rsik of the local command inject web vulnerability in the device name value is estimated as medium. (CVSS 5.6)
|
|
|
|
|
|
Credits & Authors:
|
|
==================
|
|
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]
|
|
|
|
|
|
Disclaimer & Information:
|
|
=========================
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed
|
|
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable
|
|
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab
|
|
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for
|
|
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses,
|
|
policies, deface websites, hack into databases or trade with fraud/stolen material.
|
|
|
|
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
|
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
|
Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact
|
|
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
|
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
|
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/
|
|
|
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
|
|
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
|
|
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
|
|
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
|
|
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
|
|
|
Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™
|
|
|
|
--
|
|
VULNERABILITY LABORATORY - RESEARCH TEAM
|
|
SERVICE: www.vulnerability-lab.com
|
|
CONTACT: research@vulnerability-lab.com
|
|
PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt |