Document Title: =============== Song Exporter v2.1.1 RS iOS - File Include Vulnerabilities
References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=1172 Release Date: ============= 2013-12-19 Vulnerability Laboratory ID (VL-ID): ==================================== 1172 Common Vulnerability Scoring System: ==================================== 7.4 Product & Service Introduction: =============================== ong Exporter Pro lets you transfer via Wi-Fi the songs you have in your iPhone, iPod touch or iPad to any computer in your network. No iTunes required. Now you can backup your songs, share them with your friends and workmates, and stream them directly to almost any media player! The ability to directly access your own music on your iPhone is something that Apple should have built into their iOS devices, but Song Exporter Pro fills that void quite nicely. This is an app that everyone should get. Song Exporter Pro is a must have app if you love to share your music with friends. They nailed such a basic essential need that is a major pain point for iOS devices users. It`s reliable, lightweight and easy to use. (Copy of the Homepage: https://itunes.apple.com/us/app/song-exporter-pro/id421646421 ) Abstract Advisory Information: ============================== The Vulnerability Laboratory Research Team discovered multiple web vulnerabilities in the official Rocha Software Song Exporter 2.1.1 Pro iOS mobile application. Vulnerability Disclosure Timeline: ================================== 2013-12-19: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Rocha Software Product: Song Exporter - Mobile Web Application (iOS) 2.1.1 Exploitation Technique: ======================= Remote Severity Level: =============== High Technical Details & Description: ================================ A local file/path include web vulnerability has been discovered in the official Rocha Software Song Exporter 2.1.1 Pro mobile web-application for apple iOS. The local file include web vulnerability allows remote attackers to unauthorized include local file requests or system specific path commands to compromise the web-application or device. The local file include web vulnerability is located in the vulnerable `artist`,`album`,`name(filename)` value of the `Index File Dir List` module (web-interface). Remote attackers are able to sync via itunes own files with malicious filename, artist titel or album name. The attack vector is persistent and the request method is GET. The local file/path include execute occcurs in the main `file dir index` list. The security risk of the local file include web vulnerability is estimated as high(-) with a cvss (common vulnerability scoring system) count of 7.4(+)|(-)7.5. Exploitation of the local file include web vulnerability requires no user interaction or privileged web-application user account with password. Successful exploitation of the local web vulnerability results in mobile application or connected device component compromise by unauthorized local file include web attacks. Vulnerable Input(s): [+] Song Exporter Pro - Index Song Dir List Vulnerable Parameter(s): [+] Name (filename) [+] Artist (name) [+] Album (name) Affected Module(s): [+] Index File Dir List (http://localhost:8080) [+] Songs Path (http://localhost:8080/songs/) [+] File - Unicode Playlist [+] File - Playlist Proof of Concept (PoC): ======================= The local file include web vulnerabilities can be exploited by local attackers with physical device access or restricted user accounts without user interaction. For security demonstration or to reproduce follow the provided information and steps below. PoC: Name (filename) <table style="width:780px" id="maintable" border="0" cellpadding="0" cellspacing="0"> <thead><tr> <th class="asc" width="60"><h3>Pos</h3></th> <th class="head" width="300"><h3>Name</h3></th> <th class="head" width="60"><h3>Time</h3></th> <th class="head" width="180"><h3>Artist</h3></th> <th class="head" width="180"><h3>Album</h3></th> </tr></thead> <tbody> <tr class="evenrw"><td class="evensl" align="right">1</td> <td><a href="http://localhost:8080/songs/../[LOCAL FILE INCLUDE VULNERABILITY!]\.mp3">[LOCAL FILE INCLUDE VULNERABILITY!].mp3</a></td> <td align="right">3:27</td> <td>Blumentopf</td> <td>Wir</td></tr> </tbody> </table> PoC: Artist (name) <table style="width:780px" id="maintable" border="0" cellpadding="0" cellspacing="0"> <thead><tr> <th class="asc" width="60"><h3>Pos</h3></th> <th class="head" width="300"><h3>Name</h3></th> <th class="head" width="60"><h3>Time</h3></th> <th class="head" width="180"><h3>Artist</h3></th> <th class="head" width="180"><h3>Album</h3></th> </tr></thead> <tbody> <tr class="evenrw"><td class="evensl" align="right">1</td> <td><a href="http://localhost:8080/songs/Blumentopf/Wir/Systemfuck.mp3";>Systemfuck.mp3</a></td> <td align="right">3:27</td> <td>../[LOCAL FILE INCLUDE VULNERABILITY!]\</td> <td>Wir</td></tr> </tbody> </table> PoC: Album (name) <table style="width:780px" id="maintable" border="0" cellpadding="0" cellspacing="0"> <thead><tr> <th class="asc" width="60"><h3>Pos</h3></th> <th class="head" width="300"><h3>Name</h3></th> <th class="head" width="60"><h3>Time</h3></th> <th class="head" width="180"><h3>Artist</h3></th> <th class="head" width="180"><h3>Album</h3></th> </tr></thead> <tbody> <tr class="evenrw"><td class="evensl" align="right">1</td> <td><a href="http://localhost:8080/songs/Blumentopf/Wir/Systemfuck.mp3";>Systemfuck.mp3</a></td> <td align="right">3:27</td> <td>Blumentopf</td> <td>../[LOCAL FILE INCLUDE VULNERABILITY!]\</td></tr> </tbody> </table> Solution - Fix & Patch: ======================= The vulnerability can be patched by a secure encode and parse of the vulnerable artist name, song filename and album values. Encode and restrict also the direct songs folder path with the html file dir list. Security Risk: ============== The security risk of the local file include web vulnerability in the filename value is estimated as high(-). Credits & Authors: ================== Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (b...@evolution-sec.com) [www.vulnerability-lab.com] Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability- Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com Contact: ad...@vulnerability-lab.com - resea...@vulnerability-lab.com - ad...@evolution-sec.com Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (ad...@vulnerability-lab.com or resea...@vulnerability-lab.com) to get a permission. Copyright © 2013 | Vulnerability Laboratory [Evolution Security] -- VULNERABILITY LABORATORY RESEARCH TEAM DOMAIN: www.vulnerability-lab.com CONTACT: resea...@vulnerability-lab.com
