Document Title: =============== PhotoSync v2.2 iOS - Command Inject Web Vulnerability
References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=1290 Release Date: ============= 2014-08-05 Vulnerability Laboratory ID (VL-ID): ==================================== 1290 Common Vulnerability Scoring System: ==================================== 6.5 Product & Service Introduction: =============================== It`s all about one thing – the best and easiest way to transfer, backup and share your photos & videos! PhotoSync allows you to transfer your photos & videos between your iPhone, iPad, Mac or PC over your local Wi-Fi network. It also supports sending and receiving photos & videos to/from popular cloud & photo services, mobile storage devices and NAS. ( Copy of the Homepage: https://itunes.apple.com/en/app/photosync-drahtlos-fotos-und/id415850124 & http://www.photosync-app.com/ ) Abstract Advisory Information: ============================== The Vulnerability Laboratory Research Team discovered a command inject web vulnerability in the official TouchByte PhotoSync v2.2 iOS (apple) mobile application. Vulnerability Disclosure Timeline: ================================== 2014-08-05: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Touchbyte GmbH Product: PhotoSync - iOS Mobile Web Application 2.2 Exploitation Technique: ======================= Local Severity Level: =============== High Technical Details & Description: ================================ A local command/path injection web vulnerabilities has been discovered in the official TouchByte PhotoSync v2.2 iOS (apple) mobile application. The vulnerability allows local attackers to inject commands via stored system/device values to compromise the apple mobile iOS application. The vulnerability is located in the vulnerable `albumname` value of the `index file dir` module. Local attackers are able to inject own malicious system specific commands or path value requests in the vulnerable `albumname` value. The execution of the command occurs in the `File Dir Index Listing` module of the photosync mobile application. The attacker is able to manipulate the local device values with physical or restricted acccess to compromise the mobile application by preparing to change the albumname. The encoding of the vulnerable values in the `File Dir Index Listing` module is broken. The attack vector is on the application-side and the injection requires physical device access or a local low privileged device user account. Local attackers are also able to exploit the albumname validation issue in combination with persistent injected script codes. The security risk of the local command/path inject vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 6.5. Exploitation of the command/path inject vulnerability requires a low privileged iOS device account with restricted access and no user interaction. Successful exploitation of the vulnerability results in unauthorized execution of system specific commands and unauthorized path value requests to compromise the mobile iOS application or the connected device components. Request Method(s): [+] [POST] Vulnerable Module(s): [+] File Dir Wifi Vulnerable Parameter(s): [+] albumname Affected Module(s): [+] File Dir Index Listing Proof of Concept (PoC): ======================= The command inject web vulnerability can be exploited by local attackers with physical or restricted device access without user interaction. For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue. Manual steps to reproduce the vulnerability ... 1. Download and Install the PhotoSync mobile application to your iOS device (ipad or iphone) > https://itunes.apple.com/en/app/photosync-drahtlos-fotos-und/id415850124 2. Open the default iOS Photo/Pictures App and exchange one of the albumnames to the local command inject string 3. Save the settings and close the default iOS photo/pictures app 4. Now, we start the photosync app Note: After the start at the bottom of the app is the local wifi web-server ip (localhost:8080) 5. Open the local IP 6. The execution directly occurs in the main directory of the file dir index listing service 7. Successful reproduce of the local command inject vulnerability! PoC: File Dir Index Listing (albumname) <div class="albumentries"><div class="albumentry"><div class="imagepreview"><a href="/listAlbum/0"> <img src="/posterImage/0" alt="thumbnail"></a></div><div class="description"><a href="/listAlbum/0"> Aufnahmen <span class="count">(24)</span></a></div><div class="disclosure"></div></div><div class="section"> <div class="sectiontitle">Alben</div></div><div class="albumentry"><div class="imagepreview"><a href="/listAlbum/1"> <img src="/posterImage/1" alt="thumbnail"></a></div><div class="description"> <a href="/listAlbum/1">>"<./[LOCAL COMMAND INJECT VULNERABILITY VIA ALBUMNAME VALUE!]"> <span class="count">(0)</span></a></div> <div class="disclosure"></div></div><div class="albumentry"><div class="imagepreview"><a href="/listAlbum/2"> <img src="/posterImage/2" alt="thumbnail" /></a></div><div class="description"><a href="/listAlbum/2"> Wallpaper Society <span class="count">(4)</span></a></div><div class="disclosure"></div></div></div></div> </div></div></div></body> </html></iframe></a></div></div></div> --- PoC Session Logs [GET] (Execution) --- Status: 200[OK] GET http://localhost:8080/./[LOCAL COMMAND INJECT VULNERABILITY VIA ALBUMNAME VALUE!] Load Flags[LOAD_DOCUMENT_URI ] Größe des Inhalts[0] Mime Type[application/x-unknown-content-type] Request Header: Host[localhost:8080] User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0] Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] Accept-Language[de,en-US;q=0.7,en;q=0.3] Accept-Encoding[gzip, deflate] Referer[http://localhost:8080/] Connection[keep-alive] Response Header: Accept-Ranges[bytes] Content-Length[0] Date[Di., 05 Aug. 2014 08:54:54 GMT] Solution - Fix & Patch: ======================= The command inject web vulnerability can be patched by a secure parse and encode of the local stored albumnames. Restrict the input and encode on imports to prevent local command injection attacks via stored device values. Encode also the output listing were the context becomes visible to the user and use a own exception-handling to block. Security Risk: ============== The security risk of the local command inject web vulnerability in the albumname value is estimated as high. Credits & Authors: ================== Vulnerability Laboratory [Research Team] - LariX4 (resea...@evolution-sec.com) [www.vulnerability-lab.com] Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com Contact: ad...@vulnerability-lab.com - resea...@vulnerability-lab.com - ad...@evolution-sec.com Section: dev.vulnerability-db.com - forum.vulnerability-db.com - magazine.vulnerability-db.com Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/ Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (ad...@vulnerability-lab.com or resea...@vulnerability-lab.com) to get a permission. Copyright © 2014 | Vulnerability Laboratory [Evolution Security] -- VULNERABILITY LABORATORY RESEARCH TEAM DOMAIN: www.vulnerability-lab.com CONTACT: resea...@vulnerability-lab.com
