My File Explorer v1.3.1 iOS - Multiple Web Vulnerabilities
http://www.vulnerability-lab.com/get_content.php?id=1107
2013-10-09
1107
6.6
My File Explorer lets you easily view, manage and store files on your iPhone, iPad, iPad mini or iPod touch.
You can also easily transfer your Photos from your device to your PC/MAC via Wi-Fi Transfer option.
You don`t need iTunes anymore by using the mobile application.
Key Features:
Supported File Formats:
( Copy of the Homepage: https://itunes.apple.com/de/app/my-file-explorer/id571929068 )
The Vulnerability Laboratory Research Team discovered multiple web vulnerabilities in the My File Explorer v1.3.1 iOS mobile web-application.
2013-10-09: Public Disclosure (Vulnerability Laboratory)
Published
Apple
Product: My File Explorer - Mobile Web Application 1.3.1
Remote
High
1.1
A local command/path injection web vulnerability is detected in the My File Explorer v1.3.1 iOS mobile application (Apple iOS - iPad & iPhone).
The local vulnerability allows to inject local commands by using system setting values to compromise the apple mobile iOS web-application.
The application vulnerability is located in the index file dir listing module when processing to request a manipulated iPad or iPhone deviceName.
Local attackers can change the name of the apple device to inject the own code to request any local path or inject commands on application-side.
The malicious code is executed from either attacker or by a user when calling the web-page.
Exploitation of the web vulnerability requires a local privileged iOS device account with restricted access and no user interaction.
Successful exploitation of the vulnerability results unauthorized execution of system specific commands and path requests.
Vulnerable Parameter(s):
[+] deviceName
Affected Module(s):
[+] Index File Dir List
[+] Sub Category List
1.2
A local path traversal and file include vulnerability is detected in the My File Explorer v1.3.1 iOS mobile application (Apple iOS - iPad & iPhone).
The path traversal allows remote attackers to unauthorized switch or access folder to access application, device or system information.
The web vulnerability allows to bypass the regular path to folder generate by exploitation of the `Create Directory` function. The remote attacker
can create a directory by using a manipulated second path with a frame to load. The vulnerability can be exploited by requesting the mobile
application with a manipulated path value and the same op parameter. The redirect will load the wrong path value and redirect the user to the local
mobile application or device system path.
Exploitation of the path/directory web vulnerability requires no user interaction and non privileged mobile web.application user account.
Successful exploitation of the vulnerability results in the unauthorized access of remote users to local application path or system/device files.
Vulnerable Module(s):
[+] Create Directory (Add Folder)
Vulnerable Parameter(s):
[+] name
[+] path
1.1
The local command inject web vulnerability via device name can be exploited by remote attackers with physical device access and
low user interaction. For demonstration or reproduce …
PoC: deviceName
<div class="deviceName">
>"<[LOCAL COMMAND/PATH INJECT VULNERABILITY!]><div style="1" <="" div="">
</div>
<div class="row" style="height:40px;background-color:#f5f5f5;margin-top:5px">
<div class="span12">
<div class="row">
<div class="span8">
<ul class="breadcrumb" style="margin-top:0px">
<li class="active">Root</li>
</ul>
</div>
1.2
The path traversal and local path inject web vulnerability can be exploited by remote attackers without privileged application user account
and also without user interaction. For demonstration or reproduce …
PoC: Example
http://localhost:8080/?path=/[FOLDER A]/[FRAME TO PATH B]/&op=[PATH B]
Note: By requesting a regular folder with a manipulated second path value to the vulnerable op parameter its possible to exploit the vulnerability.
The second path needs to match with the op parameter value to request the path from the second location.
Review: Source (Vulnerable %% )
<body id="body">
<div id="header">
<div class="logo" onclick="location.href = 'index.html';"></div>
<div class="appName">
My File Explorer
</div>
<div class="deviceName">
%%MyFileExplorerDeviceName%% [INJECTED MALICIOUS CONTEXT!]
</div>
</div>
<div class="row" style="height:40px;background-color:#f5f5f5;margin-top:5px">
<div class="span12">
<div class="row">
<div class="span8">
<ul class="breadcrumb" style="margin-top:0px">
%%MyFileExplorerPaths%% [INJECTED MALICIOUS CONTEXT!]
</ul>
</div>
<div class="span4" style="margin-top:5px;">
%%MyFileExplorerCreateDirectory%% [INJECTED MALICIOUS CONTEXT!]
</div>
</div>
</div>
</div>
%%MyFileExplorerUploadItem%% [INJECTED MALICIOUS CONTEXT!]
<div id="content">
%%__MyFileExplorerFiles__%% [INJECTED MALICIOUS CONTEXT!]
<table id="mfe" class="table table-hover table-bordered table-striped" style="width:100%;color:white;">
<thead>
<tr>
<th style="width:10px"><input id="selectAll" type="checkbox"></th>
<th style="width:50px;"><a id="backbutton" href="#" onclick="returnBack();">%%__BACK__%%</a></th>
<th>%%__NAME__%%</th> [INJECTED MALICIOUS CONTEXT!]
<th>%%__LMODIFIED__%%</th>
<th>%%__SIZE__%%</th>
<th>%%__KIND__%%</th>
<th><a id="downloadSelected" href="#" onclick="downloadSelectedImages(); return false;">%%DOWNLOAD%% [INJECTED MALICIOUS CONTEXT!]</a></th>
</tr>
</thead>
— Error Exception Logs —
%%MyFileExplorerPaths%%
%%MyFileExplorerCreateDirectory%%
%%MyFileExplorerUploadItem%%
%%MyFileExplorerFiles%%
%%BACK%%
%%NAME%%
%%LMODIFIED%%
%%SIZE%%
%%KIND%%
%%DOWNLOAD%%
— PoC Session Request Logs —
22:41:44.261[0ms][total 0ms]
GET http://localhost:8080/?path=/PENTEST-A/%3Cx%20src=%3Cx%20src=b%3E>/&op=%3Cix%20src=b%3E
Load Flags[LOAD_BACKGROUND VALIDATE_NEVER ]
Content Size[unknown] Mime Type[unknown]
Request Headers:
Host[192.168.2.104:8080]
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0]
Accept[application/json, text/javascript, /; q=0.01]
Accept-Language[en-US,en;q=0.5]
Accept-Encoding[gzip, deflate]
DNT[1]
X-Requested-With[XMLHttpRequest]
Referer[http://localhost:8080/?path=/PENTEST-A/%3Cx%20src=%3Cx%20src=b%3E>/&op=%3Cix%20src=b%3E]
1.1
The first vulnerability can be patched by a secure encode/parse of the vulnerable deviceName parameter.
1.2
The second vulnerability can be patched by secure encode/parse of the vulnerable create directory input fields.
Restrict the input to disallow path traversals or local file request with frames.
Filter the path value of the directory the prevent execution of malicious client-side or server-side context.
1.1
The security risk of the local command inject web vulnerability is estimated as medium(+).
1.2
The security risk of the remote path traversal web vulnerability is estimated as high.
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri ([email protected]) [www.vulnerability-lab.com]
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
or trade with fraud/stolen material.
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
Contact: [email protected] - [email protected] - [email protected]
Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
modify, use or edit our material contact ([email protected] or [email protected]) to get a permission.
Copyright © 2013 | Vulnerability Laboratory [Evolution Security]
– VULNERABILITY LABORATORY RESEARCH TEAM DOMAIN: www.vulnerability-lab.com CONTACT: [email protected]