Kwelwild Posted July 1, 2013 Report Posted July 1, 2013 eFile Wifi Transfer Manager 1.0 - Multiple VulnerabilitiesTitle:======eFile Wifi Transfer Manager 1.0 iOS - Multiple VulnerabilitiesDate:=====2013-06-24References:===========http://www.vulnerability-lab.com/get_content.php?id=982VL-ID:=====982Common Vulnerability Scoring System:====================================6.8Introduction:=============eFile is the File Manager for ios device. You can use your device as a Wi-Fi flash disk. You can connect to iPhonefrom a Mac, Windows, or Linux computer (on the same Wi-Fi network). No special software required on your computer.You can transfer mp3 files via bluetooth, Wi-Fi or iTunes. Support most of the document formats. Folder PasswordProtected: Provide password protection for each folder Http Pasword Protected: Provide Password protection for Httpfile transfer. File Operations: New Folder, delete, move, copy, email, share with bluetooth or Wi-Fi, zip,unzip ...File sharing with other ios devices via Bluetooth or Wi-FiFile upload via your PC/Mac/Linux web browser or USB via iTunes.Provide download email attachmentsProvide download Safari browser attachmentsSave and Get images to and from PhotosiWork (Pages, Numbers, Keynote)Microsoft Office (Word, Excel, PowerPoint)PDF, RTF, RTFD, TXTMP3, MP4, MOV, MPV, M4VJPG, PNG, GIF, BMP, TIF, TIFF, ICOZIP,RARTXT,C,CPP,H,M(Copy of the Homepage: https://itunes.apple.com/de/app/efile-lite-file-sharing-file/id606822182 )Abstract:=========The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the eFile Wifi Manager v1.0 iOS mobile application.Report-Timeline:================2013-06-24: Public DisclosureStatus:========PublishedExploitation-Technique:=======================RemoteSeverity:=========CriticalDetails:========1.1A local file include and an arbitrary file upload web vulnerability via POST request method is detected in the eFile Wifi Manager v1.0iOS mobile application for the apple ipad & iphone. The vulnerability allows remote attackers via POST method to inject local app webserverfolders to request unauthorized local webserver files.The vulnerbility is located in the upload file module of the webserver (http://localhost/x) when processing to request a manipulatedfilename via POST. The execution of the injected path or file request will occur when the attacker is processing to reload to index listingof the affected module after the file include attack via upload. Remote attackers can exchange the filename with a tripple extension to bypassthe filter and execute the files from the little webserver of the application.Exploitation of the vulnerability requires no user interaction and also without application user account (no password standard).Successful exploitation of the vulnerability results in unauthorized path or file access via local file include or arbitrary file upload.Vulnerable Application(s): [+] eFile v1.0 - ITunes or AppStore (Apple)Vulnerable Module(s): [+] File Upload (Web Server) [Remote]Vulnerable Parameter(s): [+] filename [+] file extensionsAffected Module(s): [+] eFile Index Listing1.2A persistent input validation vulnerability is detected in the eFile Wifi Manager v1.0 iOS mobile application for the apple ipad & iphone.The bug allows an attacker (remote) to implement/inject malicious script code on the application side (persistent) of the app web service.The vulnerability is located in the index file dir listing module of the webserver (http://localhost/foldername) when processing to displayvia POST request method injected manipulated `foldernames`. The persistent script code will be executed in the main index file dirlisting module when the service is processing to list the new malicious injected foldername as item.Exploitation of the persistent web vulnerability requires low or medium user interaction without application user account.Successful exploitation of the vulnerability can lead to persistent session hijacking (customers), account steal via persistent webattacks, persistent phishing or stable (persistent) certificate mail notification context manipulation.Vulnerable Application(s): [+] eFile v1.0 - ITunes or AppStore (Apple)Vulnerable Module(s): [+] Add or Edit FoldernameVulnerable Parameter(s): [+] foldernameAffected Module(s): [+] eFile Index ListingProof of Concept:=================1.1The arbitrary file upload vulnerability and restriction bypass can be exploited by remote attackers without privilege application user accountand also without required user interaction. For demonstration or reproduce ...File Upload ...Host=localhost:8080User-Agent=Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0Accept=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language=en-US,en;q=0.5Accept-Encoding=gzip, deflateDNT=1X-Requested-With=XMLHttpRequestX-File-Name=1234.png.txt.iso.php.gifContent-Type=application/octet-streamReferer=http://localhost:8080/Content-Length=98139POSTDATA =?PNG[X]+ double extensionshttp://localhost:8080/[PATH NAME (x) VALUE].png.txt.iso.php// return false to cancel submitonSubmit: function(id, fileName){},onProgress: function(id, fileName, loaded, total){},onComplete: function(id, fileName, responseJSON){},onCancel: function(id, fileName){},// messages messages: {typeError: "{file} has invalid extension. Only {extensions} are allowed.",sizeError: "{file} is too large, maximum file size is {sizeLimit}.",minSizeError: "{file} is too small, minimum file size is {minSizeLimit}.",emptyError: "{file} is empty, please select files again without it.",onLeave: "The files are being uploaded, if you leave now the upload will be cancelled."},... ...// added to list item when upload completes// used in css to hide progress spinnersuccess: 'qq-upload-success',...1.2The persistent input validation web vulnerability can be exploited by remote attackers without privileged application user accountand with low required user interaction. For demonstration or reproduce ...New Folder ...POST http://localhost:8080/# Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ]Content Size[-1] Mime Type[application/x-unknown-content-type]Request Headers:Host[localhost:8080]User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0]Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]Accept-Language[en-US,en;q=0.5]Accept-Encoding[gzip, deflate]DNT[1]Referer[http://localhost:8080/]Connection[keep-alive]Post Data:newFolder[%2520%3E%22%3C[PERSISTENT INJECTED SCRIPT CODE!]+src%3Da%3E]submitButton[Create]Response Headers:Transfer-Encoding[chunked]Accept-Ranges[bytes]Date[Sun, 23 Jun 2013 10:16:41 GMT]http://localhost:8080/[PATH NAME (x) VALUE]function newFolder(){var title = document.getElementById("formTitle");title.innerText = "eFile";title.textContent = "eFile";title.setAttribute("id","formTitle");... ...var message = document.getElementById("formMessage");message.innerText = "Enter new folder name";message.textContent = "Enter new folder name";message.setAttribute("id","formMessage");...Reference(s): ../pagescript.jsSolution:=========1.1The arbitrary file upload vulnerability can be patched by a secure parse and restriction in the file upload module and the bound listing access.1.2The persistent input validation web vulnerability can be patched by a secure parse of the foldername.Parse the input fields of new folder and also the index output listing to prevent persistent injections or script code executions.Risk:=====1.1The security risk of the multiple arbitrary file upload vulnerability and restriction bypass is estimated as critical.1.2The security risk of the persistent input validation web vulnerability is estimated as high.Credits:========Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com)Disclaimer:===========The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of businessprofits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Somestates do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitationmay not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databasesor trade with fraud/stolen material.Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/registerContact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.comSection: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.comSocial: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0labFeeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.phpAny modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of othermedia, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos andother information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission. Copyright 2013 | Vulnerability Laboratory-- VULNERABILITY LABORATORY RESEARCH TEAMDOMAIN: www.vulnerability-lab.comCONTACT: research@vulnerability-lab.comSursa: eFile Wifi Transfer Manager 1.0 - Multiple Vulnerabilities Quote
