PhotoSync v2.2 iOS - Command Inject Web Vulnerability
Document Title: === PhotoSync v2.2 iOS - Command Inject Web Vulnerability References (Source): http://www.vulnerability-lab.com/get_content.php?id=1290 Release Date: = 2014-08-05 Vulnerability Laboratory ID (VL-ID): 1290 Common Vulnerability Scoring System: 6.5 Product Service Introduction: === It`s all about one thing – the best and easiest way to transfer, backup and share your photos videos! PhotoSync allows you to transfer your photos videos between your iPhone, iPad, Mac or PC over your local Wi-Fi network. It also supports sending and receiving photos videos to/from popular cloud photo services, mobile storage devices and NAS. ( Copy of the Homepage: https://itunes.apple.com/en/app/photosync-drahtlos-fotos-und/id415850124 http://www.photosync-app.com/ ) Abstract Advisory Information: == The Vulnerability Laboratory Research Team discovered a command inject web vulnerability in the official TouchByte PhotoSync v2.2 iOS (apple) mobile application. Vulnerability Disclosure Timeline: == 2014-08-05: Public Disclosure (Vulnerability Laboratory) Discovery Status: = Published Affected Product(s): Touchbyte GmbH Product: PhotoSync - iOS Mobile Web Application 2.2 Exploitation Technique: === Local Severity Level: === High Technical Details Description: A local command/path injection web vulnerabilities has been discovered in the official TouchByte PhotoSync v2.2 iOS (apple) mobile application. The vulnerability allows local attackers to inject commands via stored system/device values to compromise the apple mobile iOS application. The vulnerability is located in the vulnerable `albumname` value of the `index file dir` module. Local attackers are able to inject own malicious system specific commands or path value requests in the vulnerable `albumname` value. The execution of the command occurs in the `File Dir Index Listing` module of the photosync mobile application. The attacker is able to manipulate the local device values with physical or restricted acccess to compromise the mobile application by preparing to change the albumname. The encoding of the vulnerable values in the `File Dir Index Listing` module is broken. The attack vector is on the application-side and the injection requires physical device access or a local low privileged device user account. Local attackers are also able to exploit the albumname validation issue in combination with persistent injected script codes. The security risk of the local command/path inject vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 6.5. Exploitation of the command/path inject vulnerability requires a low privileged iOS device account with restricted access and no user interaction. Successful exploitation of the vulnerability results in unauthorized execution of system specific commands and unauthorized path value requests to compromise the mobile iOS application or the connected device components. Request Method(s): [+] [POST] Vulnerable Module(s): [+] File Dir Wifi Vulnerable Parameter(s): [+] albumname Affected Module(s): [+] File Dir Index Listing Proof of Concept (PoC): === The command inject web vulnerability can be exploited by local attackers with physical or restricted device access without user interaction. For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue. Manual steps to reproduce the vulnerability ... 1. Download and Install the PhotoSync mobile application to your iOS device (ipad or iphone) https://itunes.apple.com/en/app/photosync-drahtlos-fotos-und/id415850124 2. Open the default iOS Photo/Pictures App and exchange one of the albumnames to the local command inject string 3. Save the settings and close the default iOS photo/pictures app 4. Now, we start the photosync app Note: After the start at the bottom of the app is the local wifi web-server ip (localhost:8080) 5. Open the local IP 6. The execution directly occurs in the main directory of the file dir index listing service 7. Successful reproduce of the local command inject vulnerability! PoC: File Dir Index Listing (albumname) div class=albumentriesdiv class=albumentrydiv class=imagepreviewa href=/listAlbum/0 img src=/posterImage/0 alt=thumbnail/a/divdiv class=descriptiona href=/listAlbum/0 Aufnahmen span class=count(24)/span/a/divdiv class=disclosure/div/divdiv class=section div class=sectiontitleAlben/div/divdiv class=albumentrydiv
PhotoSync v2.2 iOS - Command Inject Web Vulnerability
Document Title: === PhotoSync v2.2 iOS - Command Inject Web Vulnerability References (Source): http://www.vulnerability-lab.com/get_content.php?id=1290 Release Date: = 2014-08-05 Vulnerability Laboratory ID (VL-ID): 1290 Common Vulnerability Scoring System: 6.5 Product Service Introduction: === It`s all about one thing – the best and easiest way to transfer, backup and share your photos videos! PhotoSync allows you to transfer your photos videos between your iPhone, iPad, Mac or PC over your local Wi-Fi network. It also supports sending and receiving photos videos to/from popular cloud photo services, mobile storage devices and NAS. ( Copy of the Homepage: https://itunes.apple.com/en/app/photosync-drahtlos-fotos-und/id415850124 http://www.photosync-app.com/ ) Abstract Advisory Information: == The Vulnerability Laboratory Research Team discovered a command inject web vulnerability in the official TouchByte PhotoSync v2.2 iOS (apple) mobile application. Vulnerability Disclosure Timeline: == 2014-08-05: Public Disclosure (Vulnerability Laboratory) Discovery Status: = Published Affected Product(s): Touchbyte GmbH Product: PhotoSync - iOS Mobile Web Application 2.2 Exploitation Technique: === Local Severity Level: === High Technical Details Description: A local command/path injection web vulnerabilities has been discovered in the official TouchByte PhotoSync v2.2 iOS (apple) mobile application. The vulnerability allows local attackers to inject commands via stored system/device values to compromise the apple mobile iOS application. The vulnerability is located in the vulnerable `albumname` value of the `index file dir` module. Local attackers are able to inject own malicious system specific commands or path value requests in the vulnerable `albumname` value. The execution of the command occurs in the `File Dir Index Listing` module of the photosync mobile application. The attacker is able to manipulate the local device values with physical or restricted acccess to compromise the mobile application by preparing to change the albumname. The encoding of the vulnerable values in the `File Dir Index Listing` module is broken. The attack vector is on the application-side and the injection requires physical device access or a local low privileged device user account. Local attackers are also able to exploit the albumname validation issue in combination with persistent injected script codes. The security risk of the local command/path inject vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 6.5. Exploitation of the command/path inject vulnerability requires a low privileged iOS device account with restricted access and no user interaction. Successful exploitation of the vulnerability results in unauthorized execution of system specific commands and unauthorized path value requests to compromise the mobile iOS application or the connected device components. Request Method(s): [+] [POST] Vulnerable Module(s): [+] File Dir Wifi Vulnerable Parameter(s): [+] albumname Affected Module(s): [+] File Dir Index Listing Proof of Concept (PoC): === The command inject web vulnerability can be exploited by local attackers with physical or restricted device access without user interaction. For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue. Manual steps to reproduce the vulnerability ... 1. Download and Install the PhotoSync mobile application to your iOS device (ipad or iphone) https://itunes.apple.com/en/app/photosync-drahtlos-fotos-und/id415850124 2. Open the default iOS Photo/Pictures App and exchange one of the albumnames to the local command inject string 3. Save the settings and close the default iOS photo/pictures app 4. Now, we start the photosync app Note: After the start at the bottom of the app is the local wifi web-server ip (localhost:8080) 5. Open the local IP 6. The execution directly occurs in the main directory of the file dir index listing service 7. Successful reproduce of the local command inject vulnerability! PoC: File Dir Index Listing (albumname) div class=albumentriesdiv class=albumentrydiv class=imagepreviewa href=/listAlbum/0 img src=/posterImage/0 alt=thumbnail/a/divdiv class=descriptiona href=/listAlbum/0 Aufnahmen span class=count(24)/span/a/divdiv class=disclosure/div/divdiv class=section div class=sectiontitleAlben/div/divdiv class=albumentrydiv
