170 lines
7.9 KiB
Text
Executable file
170 lines
7.9 KiB
Text
Executable file
Document Title:
|
|
===============
|
|
Bluetooth Text Chat v1.0 iOS - Code Execution Vulnerability
|
|
|
|
|
|
References (Source):
|
|
====================
|
|
http://www.vulnerability-lab.com/get_content.php?id=1250
|
|
|
|
|
|
Release Date:
|
|
=============
|
|
2014-04-07
|
|
|
|
|
|
Vulnerability Laboratory ID (VL-ID):
|
|
====================================
|
|
1250
|
|
|
|
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
9.1
|
|
|
|
|
|
Product & Service Introduction:
|
|
===============================
|
|
BlueTooth Text Chat is a simple way to chat with near by users. Application works on BlueTooth. User can send text messages.
|
|
Pictures can be embedded in messages. It is a very simple app for quick chat. Application is compatible with `BlueMe` app series.
|
|
|
|
(Copy of the Homepage: https://itunes.apple.com/us/app/bluetooth-text-chat/id495083008 )
|
|
|
|
|
|
Abstract Advisory Information:
|
|
==============================
|
|
The vulnerability laboratory research team discovered a remote code execution web vulnerability in the official Bluetooth Text Chat v1.0 iOS mobile application.
|
|
|
|
|
|
Vulnerability Disclosure Timeline:
|
|
==================================
|
|
2014-04-07: Public Disclosure (Vulnerability Laboratory)
|
|
|
|
|
|
Discovery Status:
|
|
=================
|
|
Published
|
|
|
|
|
|
Affected Product(s):
|
|
====================
|
|
HyTech Professionals
|
|
Product: Bluetooth Text Chat - iOS Mobile Web Application 1.0
|
|
|
|
|
|
Exploitation Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity Level:
|
|
===============
|
|
Critical
|
|
|
|
|
|
Technical Details & Description:
|
|
================================
|
|
A remote code execution web vulnerability has been discovered in the official Bluetooth Text Chat v1.0 iOS mobile application.
|
|
The vulnerability allows an remote attackers to execute own malicious system specific codes to compromise the iOS mobile application.
|
|
|
|
The vulnerability is located in the message body input and affects the bluetooth message listing. Remote attackers are able to inject
|
|
own system specific codes in the bluetooth message listing to compromise mobile application. The message input is not encoded or parsed
|
|
and the app functions itself only allows to send text and pictures of the local storage (phone album). The exploit can also be combined with
|
|
a loop codes to crash the app or own web script codes (htmls,php or js) to perform further attacks and persistent manipulation of modules.
|
|
The injection method requires an exchange with another connected bluetooth chat user and the attack vector is located on the application-side
|
|
of the vulnerable mobile application. The attacker includes his message with the code execution payload and the code execution occurs after
|
|
the message has been send to the local bluetooth service. The execution of the system specific code occurs in the chat messages output listing
|
|
and chat history. The code execution in the message listing does not require a link ref click or mouse-over (interaction) and executed directly
|
|
on the arrival. The security risk of the remote code execution web vulnerability is estimated as critical with a cvss (common vulnerability
|
|
scoring system) count of 9.1(+)|(-)9.2.
|
|
|
|
Exploitation of the code execution vulnerability requires a connected bluetooth user to chat and no privileged account. User interaction connect
|
|
and accept is required to interact with another user via bluetooth. Successful exploitation of the remote vulnerability results in mobile
|
|
application compromise and connected or affected device component compromise.
|
|
|
|
Request Method(s):
|
|
[+] Bluetooth (Chat > POST)
|
|
|
|
Vulnerable Module(s):
|
|
[+] Chat Message
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] body > message
|
|
|
|
Affected Module(s):
|
|
[+] Messages Listing & History
|
|
|
|
|
|
Proof of Concept (PoC):
|
|
=======================
|
|
The system specific code execution vulnerability can be exploited by remote attackers via bluetooth, without required user interaction but the connection
|
|
for messaging needs to be accepted. For security demonstration or to reproduce the code execution vulnerability follow the provided information and steps
|
|
below to continue.
|
|
|
|
Requirement(s):
|
|
1. 2 x iOS devices (Tested: iPhone (A) and a iPad (B) with iOS v7.1)
|
|
2. Mobile application > https://itunes.apple.com/us/app/bluetooth-text-chat/id495083008
|
|
3. Both devices need the bluetooth module (active)
|
|
|
|
Manually steps to reproduce the vulnerability ...
|
|
1. Install the application on both ios devices ( https://itunes.apple.com/us/app/bluetooth-text-chat/id495083008 )
|
|
2. Start both applications and sync the bluetooth chat connection of device A to B
|
|
3. Accept the connection at device B of the A device request
|
|
4. Include a system specific code inside of the message body input field and press send/submit
|
|
5. The code execution occurs to everybody (A & B) who is listed as user in the same chat conversation
|
|
Note: The target user does not need to click or interact with the attacker the message only needs to arrive
|
|
6. Successful reproduce of the bluetooth text chat remote code execution vulnerability!
|
|
|
|
|
|
Picture(s):
|
|
http://www.vulnerability-lab.com/resources/pictures/1250/1.png
|
|
|
|
|
|
Solution - Fix & Patch:
|
|
=======================
|
|
The vulnerability can be patched by a secure parse and encode of the vulnerable message body input.
|
|
The vulnerable output message and history listing needs to be encoded separatly to prevent script code injects, command executions or futher code exec attacks.
|
|
|
|
|
|
Security Risk:
|
|
==============
|
|
The security risk of the remote code execution web vulnerability in the Bluetooth Text Chat v1.0 is estimated as critical.
|
|
|
|
|
|
Credits & Authors:
|
|
==================
|
|
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]
|
|
|
|
|
|
Disclaimer & Information:
|
|
=========================
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,
|
|
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
|
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
|
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
|
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
|
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
|
or trade with fraud/stolen material.
|
|
|
|
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
|
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
|
Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com
|
|
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
|
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
|
|
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
|
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
|
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and
|
|
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
|
modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
|
|
|
Copyright ? 2014 | Vulnerability Laboratory [Evolution Security]
|
|
|
|
|
|
|
|
--
|
|
VULNERABILITY LABORATORY RESEARCH TEAM
|
|
DOMAIN: www.vulnerability-lab.com
|
|
CONTACT: research@vulnerability-lab.com
|
|
|
|
|