302 lines
12 KiB
Text
Executable file
302 lines
12 KiB
Text
Executable file
Title:
|
|
======
|
|
Photo Server 2.0 iOS - Multiple Critical Vulnerabilities
|
|
|
|
|
|
Date:
|
|
=====
|
|
2013-07-23
|
|
|
|
|
|
References:
|
|
===========
|
|
http://www.vulnerability-lab.com/get_content.php?id=1029
|
|
|
|
|
|
VL-ID:
|
|
=====
|
|
1029
|
|
|
|
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
8.6
|
|
|
|
|
|
Introduction:
|
|
=============
|
|
Photo Server is the free (photos only) version of Video Server. Access your device`s camera roll from any computer or
|
|
device with a web browser on your local network router`s WiFi. With proper configuration of your WiFi router, access
|
|
can be made from the web browser of any computer or device connected to the internet.
|
|
|
|
Video transfer can be enabled either through the in-app upgrade or by clicking on and viewing an iAd (iAds not available
|
|
in all countries yet).
|
|
|
|
The Bluetooth option allows you to transfer photos stored in your camera roll between Apple iMobile devices such as the
|
|
iPhone, iPod Touch, and iPad without WiFi. Once the BlueTooth connection is established between the devices, choose your
|
|
picture and the app automatically begins transmitting it via BlueTooth to the other device. Once received on the other
|
|
device you can view the photograph and save it to your camera roll.
|
|
|
|
(Copy of the Homepage: https://itunes.apple.com/en/app/photo-server/id397545365 )
|
|
|
|
|
|
Abstract:
|
|
=========
|
|
The Vulnerability Laboratory Research Team discovered a command injection and file include (arbitrary file upload) vulnerability in the Photo Server 2.0 application (Apple iOS - iPad & iPhone).
|
|
|
|
|
|
Report-Timeline:
|
|
================
|
|
2013-07-23: Public Disclosure (Vulnerability Laboratory)
|
|
|
|
|
|
Status:
|
|
========
|
|
Published
|
|
|
|
|
|
Affected Products:
|
|
==================
|
|
Apple AppStore
|
|
Product: Photo Server - Application 2.0
|
|
|
|
|
|
Exploitation-Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity:
|
|
=========
|
|
Critical
|
|
|
|
|
|
Details:
|
|
========
|
|
1.1
|
|
A local command/path injection web vulnerability is detected in the Photo Server 2.0 application (Apple iOS - iPad & iPhone).
|
|
The vulnerability allows to inject local commands via vulnerable system values to compromise the apple mobile iOS application.
|
|
|
|
The vulnerability is located in the index file dir listing module when processing to request and list the ipad or iphone devicename.
|
|
Local attackers can change the name of the device to inject the code and request any local path or inject commands on application-side.
|
|
The malicious context with the path request executes when a user or victim is watching the file dir index listing.
|
|
|
|
Exploitation of the web vulnerability requires a local privilege iOS device account with restricted access and no user interaction.
|
|
Successful exploitation of the vulnerability results unauthorized execution of system specific commands and path requests.
|
|
|
|
Vulnerable Application(s):
|
|
[+] Photo Server v2.0 - ITunes or AppStore (Apple)
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] device name
|
|
|
|
Affected Module(s):
|
|
[+] Index File Dir Listing
|
|
|
|
|
|
|
|
|
|
1.2
|
|
A file include web vulnerability is detected in the Photo Server 2.0 application (Apple iOS - iPad & iPhone).
|
|
The file include vulnerability allows remote attackers to include (upload) local file or path requests to compromise the application or service.
|
|
|
|
The vulnerability is located in the upload module when processing to upload files with manipulated names via POST method. The attacker can inject
|
|
local path or files to request context and compromise the device. The validation has a bad side effect which impacts the risk to combine the attack
|
|
with persistent injected script code.
|
|
|
|
Exploitation of the file include web vulnerability requires no user interaction or privilege application user account.
|
|
Successful exploitation of the vulnerability results in unauthorized local file and path requests to compromise the device or application.
|
|
|
|
Vulnerable Module(s):
|
|
[+] Upload (Files)
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] filename
|
|
|
|
Affected Module(s):
|
|
[+] Index File Dir Listing
|
|
|
|
|
|
|
|
1.3
|
|
An arbitrary file upload web vulnerability is detected in the Photo Server 2.0 application (Apple iOS - iPad & iPhone).
|
|
The arbitrary file upload issue allows a remote attacker to upload files with multiple extensions to bypass the validation for unauthorized access.
|
|
|
|
The vulnerability is located in the upload module when processing to upload files with multiple ending extensions. Attackers are able to upload
|
|
a php or js web-shells by renaming the file with multiple extensions. He uploads for example a web-shell with the following name and
|
|
extension image.jpg.js.php.jpg . He deletes in the request after the upload the jpg to access unauthorized the malicious file (web-shell) to
|
|
compromise the web-server or mobile device.
|
|
|
|
Exploitation of the arbitrary file upload web vulnerability requires no user interaction or privilege application user account.
|
|
Successful exploitation of the vulnerability results in unauthorized file access because of a compromise after the upload of web-shells.
|
|
|
|
Vulnerable Module(s):
|
|
[+] Upload (Files)
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] filename (multiple extensions)
|
|
|
|
Affected Module(s):
|
|
[+] Index File Dir Listing
|
|
|
|
|
|
Proof of Concept:
|
|
=================
|
|
1.1
|
|
The local command/path inject web vulnerability can be exploited by local attackers with device access and without user interaction.
|
|
For demonstration or reproduce ...
|
|
|
|
PoC:
|
|
|
|
<html><head>
|
|
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
|
|
<title>iPad ?337 360* >"<[COMMAND/PATH INJECT VULNERABILITY]> Photo Server app's Web Browser Interface Page</title></head><body>
|
|
<center><h2>iPad ?337 360* >"<[COMMAND/PATH INJECT VULNERABILITY]">'s
|
|
Photo Server App Web Browser Interface
|
|
Page</h2></center><form action="" method="post"
|
|
enctype="multipart/form-data" name="form1"
|
|
id="form1"><label>Choose QuickTime (.MOV) or JPEG (.JPG or
|
|
.jpeg) file to upload to iPad ?337 360* >"<iframe src=a>:
|
|
<input type="file" name="file" id="file" value="Choose file..."
|
|
/></label><label><input type="submit" name="button"
|
|
id="button" value="Upload"
|
|
/></label></form><hr><p><i>Save videos
|
|
or photos of the links below to hard drive by using context menu's
|
|
(mouse right-click) Save Link As ...
|
|
function.</i><hr><h1>The Video and Photo
|
|
List</h1>
|
|
<li><a
|
|
href='assets-library---asset/asset.PNG?id=09FDBC65-D87B-4D3A-A093-EC1CD07D1D22&ext=PNG'><img
|
|
|
|
|
|
--- Request Session Log ---
|
|
|
|
Status: 200[OK]
|
|
|
|
GET http://192.168.2.104:8888/vulnerabilitylab
|
|
Load Flags[LOAD_DOCUMENT_URI ]
|
|
Content Size[3032] Mime Type[application/x-unknown-content-type]
|
|
|
|
|
|
Request Headers:
|
|
|
|
Host[192.168.2.104:8888]
|
|
|
|
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0]
|
|
|
|
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
|
|
|
Accept-Language[en-US,en;q=0.5]
|
|
|
|
Accept-Encoding[gzip, deflate]
|
|
|
|
DNT[1]
|
|
|
|
|
|
Referer
|
|
[http://192.168.2.104:8888/]
|
|
|
|
Connection[keep-alive]
|
|
|
|
|
|
Response Headers:
|
|
|
|
Accept-Ranges[bytes]
|
|
Content-Length[3032]
|
|
Date[So., 21 Jul 2013 10:13:51 GMT]
|
|
|
|
|
|
|
|
|
|
|
|
1.2
|
|
The file include web vulnerability can be exploited by remote attackers without application user account and user interaction.
|
|
For demonstration or reproduce ...
|
|
|
|
PoC:
|
|
<hr><h1>The Video and Photo List</h1>
|
|
<li><a href="http://192.168.2.104:8888/assets-library---asset/../[File Include Vulnerability].PNG
|
|
?id=09FDBC65-D87B-4D3A-A093-EC1CD07D1D22&ext=PNG"><img src="iPad%20%C3%82%C2%A5337%20360%20%20Photo%20Server%20app%27s%2
|
|
0Web%20Browser%20Interface%20Page_files/../[File Include Vulnerability].PNG">assets-library---asset/../[File Include Vulnerability].PNG
|
|
?id=09FDBC65-D87B-4D3A-A093-EC1CD07D1D22.PNG</a>
|
|
|
|
|
|
|
|
1.3
|
|
The arbitrary file upload vulnerability can by remote attackers without application user account and user interaction.
|
|
For demonstration or reproduce ...
|
|
|
|
PoC:
|
|
<hr><h1>The Video and Photo List</h1>
|
|
<li><a href="http://192.168.2.104:8888/assets-library---asset/pentester23.PNG.jpg.html.php.js.gif.PNG
|
|
?id=09FDBC65-D87B-4D3A-A093-EC1CD07D1D22&ext=PNG"><img src="iPad%20%C3%82%C2%A5337%20360%20%20Photo%20Server%20app%27s%2
|
|
0Web%20Browser%20Interface%20Page_files/pentester23.PNG.jpg.html.php.js.gif.PNG">assets-library---asset/pentester23.PNG.jpg.html.php.js.gif.PNG
|
|
?id=09FDBC65-D87B-4D3A-A093-EC1CD07D1D22.PNG</a>
|
|
|
|
Note: After the request of the upload you can attacker can open the localhost:8888 webserver again and access the folder by an include of the filename
|
|
|
|
|
|
Solution:
|
|
=========
|
|
1.1
|
|
The command/path injection web vulnerability can be patched by a secure parse or encoding of the 2 index location with the device name.
|
|
|
|
1.2
|
|
The file include web vulnerability can be patched by a secure parse of the POST method request when processing to upload a manipulated file.
|
|
Encode, filter or parse also the output listing in the index with the existing file names.
|
|
|
|
1.3
|
|
Disallow multiple extensions by secure filtering of the POST method request when processing to upload a file with multiple extensions.
|
|
Change the web app http server settings and file access rights to prevent the execution of js, html and php files.
|
|
|
|
|
|
|
|
Risk:
|
|
=====
|
|
1.1
|
|
The security risk of the command/path inject web vulnerability is estimated as high.
|
|
|
|
1.2
|
|
The security risk of the file include web vulnerability is estimated as critical.
|
|
|
|
1.3
|
|
The security risk of the arbitrary file upload vulnerability is estimated as high(+).
|
|
|
|
|
|
Credits:
|
|
========
|
|
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com)
|
|
|
|
|
|
Disclaimer:
|
|
===========
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,
|
|
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
|
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
|
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
|
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
|
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
|
or trade with fraud/stolen material.
|
|
|
|
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
|
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
|
Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com
|
|
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
|
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
|
|
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
|
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
|
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and
|
|
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
|
modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
|
|
|
Copyright ? 2013 | Vulnerability Laboratory [Evolution Security]
|
|
|
|
|
|
|
|
--
|
|
VULNERABILITY LABORATORY RESEARCH TEAM
|
|
DOMAIN: www.vulnerability-lab.com
|
|
CONTACT: research@vulnerability-lab.com
|
|
|
|
|