211 lines
No EOL
7.6 KiB
Text
Executable file
211 lines
No EOL
7.6 KiB
Text
Executable file
Title:
|
|
======
|
|
Air Disk Wireless 1.9 iPad iPhone - Multiple Vulnerabilities
|
|
|
|
|
|
Date:
|
|
=====
|
|
2013-02-08
|
|
|
|
|
|
References:
|
|
===========
|
|
http://www.vulnerability-lab.com/get_content.php?id=850
|
|
|
|
|
|
VL-ID:
|
|
=====
|
|
850
|
|
|
|
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
8.3
|
|
|
|
|
|
Introduction:
|
|
=============
|
|
HTTP File Sharing with web interface, USB Drive loader, File Upload & Download.
|
|
|
|
Support ALL Major File formats and Folder
|
|
HTTP Wireless File Sharing
|
|
Web Authentication
|
|
Wireless Sharing your Photos from system Photos Album
|
|
Wireless Sharing videos (Playing with URL files)
|
|
Web Upload & Download File Support
|
|
File Manager (Delete & View)
|
|
|
|
iTunes File Sync
|
|
App Lock Password
|
|
HTTP Sharing Password Access
|
|
|
|
Support All Office formats and others: .txt .pdf .html .mp3 .mov, ...
|
|
|
|
(Copy of the Homepage: https://itunes.apple.com/us/app/air-disk-free-wireless-http/id444063740 )
|
|
|
|
|
|
Abstract:
|
|
=========
|
|
The Vulnerability Laboratory Research Team discovered multiple web vulnerabilities in the Air Disk Wireless HTTP File Sharing app for the apple ipad & iphone.
|
|
|
|
|
|
Report-Timeline:
|
|
================
|
|
2013-02-08: Public Disclosure
|
|
|
|
|
|
Status:
|
|
========
|
|
Published
|
|
|
|
|
|
Affected Products:
|
|
==================
|
|
Apple AppStore
|
|
Product: Air Disk Wireless HTTP File Sharing Application - (iPad & iPhone) 1.9
|
|
|
|
|
|
Exploitation-Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity:
|
|
=========
|
|
Critical
|
|
|
|
|
|
Details:
|
|
========
|
|
1.1
|
|
A local file include web vulnerability via POST request method is detected in the Air Disk Wireless HTTP File Sharing app for the apple ipad & iphone.
|
|
The vulnerability allows remote attackers via POST method to inject local app webserver folders to request unauthorized local webserver files.
|
|
|
|
The vulnerbility is located in the upload file module of the webserver (http://192.168.0.10:8988/) when processing to load a manipulated
|
|
filename via POST. The execution of the injected path or file request will occur when the attacker is opening the main index file dir listing.
|
|
|
|
Exploitation of the web vulnerability does not require a privileged application user account (standard) or user interaction.
|
|
Successful exploitation of the vulnerability results in unauthorized path or file access via local file or path include attack.
|
|
|
|
|
|
Vulnerable Application(s):
|
|
[+] Air Disk v1.9 - ITunes or AppStore (Apple)
|
|
|
|
Vulnerable Module(s):
|
|
[+] File Upload
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] filename
|
|
|
|
Affected Module(s):
|
|
[+] Air Disk Index - (Filename) Listing
|
|
|
|
|
|
|
|
1.2
|
|
A local command injection web vulnerability is detected in the Air Disk Wireless HTTP File Sharing app for the apple ipad & iphone.
|
|
The vulnerability allows to inject local commands via vulnerable system values to compromise the apple mobile application.
|
|
|
|
The vulnerbility is located in the index module when processing to load the ipad or iphone device name. Local attackers can change the
|
|
ipad or iphone device name to system specific commands and file requests to provoke the execution when processing to watch the index listing.
|
|
|
|
Exploitation of the web vulnerability does not require a privileged application user account (standard) or user interaction.
|
|
Successful exploitation of the vulnerability results unauthorized execution of system specific commands and path requests.
|
|
|
|
|
|
Vulnerable Application(s):
|
|
[+] Air Disk v1.9 - ITunes or AppStore (Apple)
|
|
|
|
Vulnerable Module(s):
|
|
[+] Index
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] device name - iPad or iPone
|
|
|
|
Affected Module(s):
|
|
[+] Air Disk Index - (Device Name) Listing
|
|
|
|
|
|
|
|
Proof of Concept:
|
|
=================
|
|
1.1
|
|
The file include vulnerability can be exploited by remote attackers without required user interaction or privileged application user account.
|
|
For demonstration or reproduce ...
|
|
|
|
PoC:
|
|
http://192.168.0.10:8988/%20../var/../../../[File]
|
|
|
|
|
|
Review: Air Disk Index - (Filename) Listing
|
|
|
|
<table id="table1" border="0" cellpadding="1" cellspacing="2" width="741"><tbody><tr>
|
|
<td style="width:461px;background-color:#ebebeb;"> 📝 <a href="http://192.168.0.10:8988/%20../var/../../../[File]"
|
|
target="_blank"><iframe src="http://192.168.0.10:8988/%20../var/../../../[File]">%20%20%20%20</a></td><td
|
|
style="width:100px;background-color:#e3e3e3;text-align:right;">42.59
|
|
KB </td><td
|
|
|
|
|
|
|
|
1.2
|
|
The command injection vulnerability can be exploited by remote attackers without required user interaction or privileged application user account.
|
|
For demonstration or reproduce ...
|
|
|
|
Review:Air Disk Index - (Device Name) Listing
|
|
|
|
<body><div class="main"><!--header--><div id="header"><div id="header_top"></div><div id="header_mid">
|
|
<span style="padding-top:10px;">Air DISK</span></div><div id="header_bottom">
|
|
The following files are the hosts live from >"<[EXECUTION OF SYSTEM SPECIFIC INJECTED COMMAND AS DEVICENAME]]">
|
|
AirDisk App Document folder</div></div><!--header
|
|
end--><!--cotainer--><div id="content"><div
|
|
style='color:black;font-size:16px;text-align:center;'>Storage Usage:
|
|
<font color=green>20439 MB</font> Available. <font
|
|
color=red>8200 MB</font> Used. Total: <font color=blue>27
|
|
GB</font>.</div><div class="content_title"><img
|
|
src="data:iamge/png;
|
|
|
|
|
|
Risk:
|
|
=====
|
|
1.1
|
|
The security risk of the remote file include web vulnerability is estimated as critical.
|
|
|
|
1.2
|
|
The security risk of the local command injection web vulnerability is estimated as high.
|
|
|
|
|
|
Credits:
|
|
========
|
|
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@vulnerability-lab.com)
|
|
|
|
|
|
Disclaimer:
|
|
===========
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
|
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
|
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
|
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
|
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
|
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
|
or trade with fraud/stolen material.
|
|
|
|
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register
|
|
Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com
|
|
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
|
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
|
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
|
|
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
|
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
|
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and
|
|
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
|
modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.
|
|
|
|
Copyright ? 2012 | Vulnerability Laboratory
|
|
|
|
|
|
|
|
--
|
|
VULNERABILITY RESEARCH LABORATORY
|
|
LABORATORY RESEARCH TEAM
|
|
CONTACT: research@vulnerability-lab.com |