Date: Wed, 06 Aug 2014 13:23:19 +0200
From: Vulnerability Lab <research@...nerability-lab.com>
To: fulldisclosure@...lists.org
Subject: [FD] PhotoSync v2.2 iOS - Command Inject Web Vulnerability

Document Title:
===============
PhotoSync v2.2 iOS - Command Inject Web Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1290


Release Date:
=============
2014-08-05


Vulnerability Laboratory ID (VL-ID):
====================================
1290


Common Vulnerability Scoring System:
====================================
6.5


Product & Service Introduction:
===============================
It`s all about one thing – the best and easiest way to transfer, backup and share your photos & videos! PhotoSync allows you to transfer 
your photos & videos between your iPhone, iPad, Mac or PC over your local Wi-Fi network. It also supports sending and receiving photos & 
videos to/from popular cloud & photo services, mobile storage devices and NAS.

( Copy of the Homepage: https://itunes.apple.com/en/app/photosync-drahtlos-fotos-und/id415850124 & http://www.photosync-app.com/ )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered a command inject web vulnerability in the official TouchByte PhotoSync v2.2 iOS (apple) mobile application.


Vulnerability Disclosure Timeline:
==================================
2014-08-05: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Touchbyte GmbH
Product: PhotoSync - iOS Mobile Web Application 2.2


Exploitation Technique:
=======================
Local


Severity Level:
===============
High


Technical Details & Description:
================================
A local command/path injection web vulnerabilities has been discovered in the official TouchByte PhotoSync v2.2 iOS (apple) mobile application.
The vulnerability allows local attackers to inject commands via stored system/device values to compromise the apple mobile iOS application.

The vulnerability is located in the vulnerable `albumname` value of the `index file dir` module. Local attackers are able to inject own 
malicious system specific commands or path value requests in the vulnerable `albumname` value. The execution of the command occurs in the 
`File Dir Index Listing` module of the photosync mobile application. The attacker is able to manipulate the local device values with physical 
or restricted acccess to compromise the mobile application by preparing to change the albumname. The encoding of the vulnerable values in the 
`File Dir Index Listing` module is broken.

The attack vector is on the application-side and the injection requires physical device access or a local low privileged device user account. 
Local attackers are also able to exploit the albumname validation issue in combination with persistent injected script codes.

The security risk of the local command/path inject vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 6.5.
Exploitation of the command/path inject vulnerability requires a low privileged iOS device account with restricted access and no user interaction. 
Successful exploitation of the vulnerability results in unauthorized execution of system specific commands and unauthorized path value requests to 
compromise the mobile iOS application or the connected device components.

Request Method(s):
				[+] [POST]

Vulnerable Module(s):
				[+] File Dir Wifi

Vulnerable Parameter(s):
				[+] albumname

Affected Module(s):
				[+] File Dir Index Listing


Proof of Concept (PoC):
=======================
The command inject web vulnerability can be exploited by local attackers with physical or restricted device access without user interaction.
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.


Manual steps to reproduce the vulnerability ...
1. Download and Install the PhotoSync mobile application to your iOS device (ipad or iphone) > https://itunes.apple.com/en/app/photosync-drahtlos-fotos-und/id415850124
2. Open the default iOS Photo/Pictures App and exchange one of the albumnames to the local command inject string
3. Save the settings and close the default iOS photo/pictures app 
4. Now, we start the photosync app
Note: After the start at the bottom of the app is the local wifi web-server ip (localhost:8080)
5. Open the local IP
6. The execution directly occurs in the main directory of the file dir index listing service
7. Successful reproduce of the local command inject vulnerability!


PoC: File Dir Index Listing (albumname)

<div class="albumentries"><div class="albumentry"><div class="imagepreview"><a href="/listAlbum/0">
<img src="/posterImage/0" alt="thumbnail"></a></div><div class="description"><a href="/listAlbum/0">
Aufnahmen <span class="count">(24)</span></a></div><div class="disclosure"></div></div><div class="section">
<div class="sectiontitle">Alben</div></div><div class="albumentry"><div class="imagepreview"><a href="/listAlbum/1">
<img src="/posterImage/1" alt="thumbnail"></a></div><div class="description">
<a href="/listAlbum/1">>"<./[LOCAL COMMAND INJECT VULNERABILITY VIA ALBUMNAME VALUE!]"> <span class="count">(0)</span></a></div>
<div class="disclosure"></div></div><div class="albumentry"><div class="imagepreview"><a href="/listAlbum/2">
<img src="/posterImage/2" alt="thumbnail" /></a></div><div class="description"><a href="/listAlbum/2">
Wallpaper Society <span class="count">(4)</span></a></div><div class="disclosure"></div></div></div></div>
</div></div></div></body>
</html></iframe></a></div></div></div>


--- PoC Session Logs [GET] (Execution) ---
Status: 200[OK]
 GET http://localhost:8080/./[LOCAL COMMAND INJECT VULNERABILITY VIA ALBUMNAME VALUE!] Load Flags[LOAD_DOCUMENT_URI  ] Größe des Inhalts[0] Mime Type[application/x-unknown-content-type]
   Request Header:
      Host[localhost:8080]
      User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0]
      Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
      Accept-Language[de,en-US;q=0.7,en;q=0.3]
      Accept-Encoding[gzip, deflate]
      Referer[http://localhost:8080/]
      Connection[keep-alive]
   Response Header:
      Accept-Ranges[bytes]
      Content-Length[0]
      Date[Di., 05 Aug. 2014 08:54:54 GMT]


Solution - Fix & Patch:
=======================
The command inject web vulnerability can be patched by a secure parse and encode of the local stored albumnames.
Restrict the input and encode on imports to prevent local command injection attacks via stored device values.
Encode also the output listing were the context becomes visible to the user and use a own exception-handling to block.


Security Risk:
==============
The security risk of the local command inject web vulnerability in the albumname value is estimated as high.


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - LariX4 (research@...lution-sec.com) [www.vulnerability-lab.com]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either 
expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers 
are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even 
if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation 
of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break 
any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       		- www.evolution-sec.com
Contact:    admin@...nerability-lab.com 	- research@...nerability-lab.com 	       		- admin@...lution-sec.com
Section:    dev.vulnerability-db.com	 	- forum.vulnerability-db.com 		       		- magazine.vulnerability-db.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       		- youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   		- vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php  	- vulnerability-lab.com/list-of-bug-bounty-programs.php	- vulnerability-lab.com/register/

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to 
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by 
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website 
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact 
(admin@...nerability-lab.com or research@...nerability-lab.com) to get a permission.

				Copyright © 2014 | Vulnerability Laboratory [Evolution Security]



-- 
VULNERABILITY LABORATORY RESEARCH TEAM
DOMAIN: www.vulnerability-lab.com
CONTACT: research@...nerability-lab.com



_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists