Message-ID: <525D374A.307@vulnerability-lab.com>
Date: Tue, 15 Oct 2013 14:38:34 +0200
From: Vulnerability Lab <research@...nerability-lab.com>
To: full-disclosure@...ts.grok.org.uk
Subject: My File Explorer v1.3.1 iOS - Multiple Web
	Vulnerabilities

Document Title:
===============
My File Explorer v1.3.1 iOS - Multiple Web Vulnerabilities


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1107


Release Date:
=============
2013-10-09


Vulnerability Laboratory ID (VL-ID):
====================================
1107


Common Vulnerability Scoring System:
====================================
6.6


Product & Service Introduction:
===============================
My File Explorer lets you easily view, manage and store files on your iPhone, iPad, iPad mini or iPod touch. 
You can also easily transfer your Photos from your device to your PC/MAC via Wi-Fi Transfer option. 
You don`t need iTunes anymore by using the mobile application.

Key Features:
- Store, view or manage any documents on your iPhone, iPad or iPod Touch
- Direct access to Photo Library from a PC or Mac via Wi-Fi and batch photo download.
- Upload pictures from your PC to your photo library via Wi-Fi.
- Easy file transfer via Wi-Fi (Browser or FTP), Bluetooth or iTunes File Sharing
- Voice Record
- In App File Name Search
- In App Browser Support for Internet Downloads
- Copy, paste, move, delete and create text files.
- Simple and Advanced PDF Reader
- Email your files.
- Backup & Email in app notes easily.
- Open email attachments.
- Zip, unzip and unrar support. Also supports password protected zip and rar files.
- Dropbox integration
- Passcode protected folders
- Universal (iPhone & iPad support)
- Several file listing and sorting options

Supported File Formats:
- Plain Text Files
- Zip and Rar files
- Audio (WAV, MP3, M4A, ...)
- Images (JPG, PNG, GIF, ...)
- Movies (MP4, MOV, ...)
- iWorks (Pages, numbers, and Keynote)
- Microsoft Office (Word, Excel and PowerPoint)
- RTF (Rich Text Format)
- PDF Documents
- HTML web pages.

( Copy of the Homepage: https://itunes.apple.com/de/app/my-file-explorer/id571929068 )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered multiple web vulnerabilities in the My File Explorer v1.3.1 iOS mobile web-application.



Vulnerability Disclosure Timeline:
==================================
2013-10-09:    Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Apple
Product: My File Explorer - Mobile Web Application 1.3.1


Exploitation Technique:
=======================
Remote


Severity Level:
===============
High


Technical Details & Description:
================================
1.1
A local command/path injection web vulnerability is detected  in the My File Explorer v1.3.1 iOS mobile application (Apple iOS - iPad & iPhone).
The local vulnerability allows to inject local commands by using system setting values to compromise the apple mobile iOS web-application.

The application vulnerability is located in the index file dir listing module when processing to request a manipulated iPad or iPhone deviceName.
Local attackers can change the name of the apple device to inject the own code to request any local path or inject commands on application-side.
The malicious code is executed from either attacker or by a user when calling the web-page.

Exploitation of the web vulnerability requires a local privileged iOS device account with restricted access and no user interaction.
Successful exploitation of the vulnerability results unauthorized execution of system specific commands and path requests.


Vulnerable Parameter(s):
				[+] deviceName

Affected Module(s):
				[+] Index File Dir List
				[+] Sub Category List




1.2
A local path traversal and file include vulnerability is detected in the My File Explorer v1.3.1 iOS mobile application (Apple iOS - iPad & iPhone).
The path traversal allows remote attackers to unauthorized switch or access folder to access application, device or system information.

The web vulnerability allows to bypass the regular path to folder generate by exploitation of the `Create Directory` function. The remote attacker 
can create a directory by using a manipulated second path with a frame to load. The vulnerability can be exploited by requesting the mobile 
application with a manipulated path value and the same op parameter. The redirect will load the wrong path value and redirect the user to the local 
mobile application or device system path.

Exploitation of the path/directory web vulnerability requires no user interaction and non privileged mobile web.application user account.
Successful exploitation of the vulnerability results in the unauthorized access of remote users to local application path or system/device files.


Vulnerable Module(s):
				[+] Create Directory (Add Folder)

Vulnerable Parameter(s):
				[+] name
				[+] path



Proof of Concept (PoC):
=======================
1.1
The local command inject web vulnerability via device name can be exploited by remote attackers with physical device access and 
low user interaction. For demonstration or reproduce ...

1. Start the iphone or ipad device with iOS
2. Install the my file explorer mobile web application
3. Open in the iphone or ipad settings menu the device name information box
4. Change the device name to your malicious script code or payload with a path/folder command
5. Close the settings menu with a save and open the already downloaded mobile application
6. Open the wifi settings and click to share to open the web-server
7. After the web server is started we open the index file listing in our web-browser by using your local ip + port 8080
8. Click to the index and to the sub categories, the test code will be executed persistent in all websites of the mobile app
9. Successful reproduced!


PoC:  deviceName

<div class="deviceName">
        >"<[LOCAL COMMAND/PATH INJECT VULNERABILITY!]><div style="1" <="" div="">
</div>
<div class="row" style="height:40px;background-color:#f5f5f5;margin-top:5px">
  <div class="span12">
    <div class="row">
      <div class="span8">
          <ul class="breadcrumb" style="margin-top:0px">
            <li class="active">Root</li>
          </ul>
      </div>



1.2
The path traversal and local path inject web vulnerability can be exploited by remote attackers without privileged application user account 
and also without user interaction. For demonstration or reproduce ...


PoC: Example 
http://localhost:8080/?path=/[FOLDER A]/[FRAME TO PATH B]/&op=[PATH B]

PoC:
http://localhost:8080/?path=/PENTEST-A/%3Cx%20src=%3Cx%20src=b%3E>/&op=%3Cix%20src=b%3E


Note: By requesting a regular folder with a manipulated second path value to the vulnerable op parameter its possible to exploit the vulnerability.
The second path needs to match with the op parameter value to request the path from the second location.


Review: Source (Vulnerable %% )

<body id="body">
<div id="header">

  <div class="logo" onclick="location.href = 'index.html';"></div>
  <div class="appName">
      My File Explorer

  </div>
<div class="deviceName">
        %%__MyFileExplorerDeviceName__%%  [INJECTED MALICIOUS CONTEXT!]
</div>
</div>
<div class="row" style="height:40px;background-color:#f5f5f5;margin-top:5px">
  <div class="span12">
    <div class="row">
      <div class="span8">
          <ul class="breadcrumb" style="margin-top:0px">
            %%__MyFileExplorerPaths__%%     [INJECTED MALICIOUS CONTEXT!]
          </ul>
      </div>
      <div class="span4" style="margin-top:5px;">
      	%%__MyFileExplorerCreateDirectory__%%      [INJECTED MALICIOUS CONTEXT!]
      </div>
    </div>
  </div>
</div>

%%__MyFileExplorerUploadItem__%%      [INJECTED MALICIOUS CONTEXT!]

<div id="content">
 

            %%__MyFileExplorerFiles__%%      [INJECTED MALICIOUS CONTEXT!]
    <table id="mfe" class="table table-hover table-bordered table-striped" style="width:100%;color:white;">
    <thead>
      <tr>
        <th style="width:10px"><input id="selectAll" type="checkbox"></th>
        <th style="width:50px;"><a id="backbutton" href="#" onclick="returnBack();">%%__BACK__%%</a></th>
          <th>%%__NAME__%%</th>    [INJECTED MALICIOUS CONTEXT!]
            <th>%%__LMODIFIED__%%</th>
            <th>%%__SIZE__%%</th>
            <th>%%__KIND__%%</th>
<th><a id="downloadSelected" href="#" onclick="downloadSelectedImages(); return false;">%%__DOWNLOAD__%% [INJECTED MALICIOUS CONTEXT!]</a></th>
        </tr>
    </thead>



--- Error Exception Logs ---
%%__MyFileExplorerPaths__%% 
%%__MyFileExplorerCreateDirectory__%%
%%__MyFileExplorerUploadItem__%%
%%__MyFileExplorerFiles__%%
%%__BACK__%% 	
%%__NAME__%% 	
%%__LMODIFIED__%% 	
%%__SIZE__%% 	
%%__KIND__%% 	
%%__DOWNLOAD__%%



--- PoC Session Request Logs ---

22:41:44.261[0ms][total 0ms] 
GET http://localhost:8080/?path=/PENTEST-A/%3Cx%20src=%3Cx%20src=b%3E>/&op=%3Cix%20src=b%3E 
Load Flags[LOAD_BACKGROUND  VALIDATE_NEVER  ] 
Content Size[unknown] Mime Type[unknown]
   
Request Headers:
      Host[192.168.2.104:8080]
      
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0]

Accept[application/json, text/javascript, */*; q=0.01]

Accept-Language[en-US,en;q=0.5]
Accept-Encoding[gzip, deflate]

DNT[1]
X-Requested-With[XMLHttpRequest]
Referer[http://localhost:8080/?path=/PENTEST-A/%3Cx%20src=%3Cx%20src=b%3E>/&op=%3Cix%20src=b%3E]




Solution - Fix & Patch:
=======================
1.1
The first vulnerability can be patched by a secure encode/parse of the vulnerable deviceName parameter.

1.2
The second vulnerability can be patched by secure encode/parse of the vulnerable create directory input fields.
Restrict the input to disallow path traversals or local file request with frames.
Filter the path value of the directory the prevent execution of malicious client-side or server-side context.


Security Risk:
==============
1.1
The security risk of the local command inject web vulnerability is estimated as medium(+).

1.2
The security risk of the remote path traversal web vulnerability is estimated as high.


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@...lution-sec.com) [www.vulnerability-lab.com]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       - www.evolution-sec.com
Contact:    admin@...nerability-lab.com 	- research@...nerability-lab.com 	       - admin@...lution-sec.com
Section:    www.vulnerability-lab.com/dev 	- forum.vulnerability-db.com 		       - magazine.vulnerability-db.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       - youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact (admin@...nerability-lab.com or research@...nerability-lab.com) to get a permission.

				Copyright © 2013 | Vulnerability Laboratory [Evolution Security]



-- 
VULNERABILITY LABORATORY RESEARCH TEAM
DOMAIN: www.vulnerability-lab.com
CONTACT: research@...nerability-lab.com


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists