Message-ID: <5346871C.4080102@vulnerability-lab.com>
Date: Thu, 10 Apr 2014 13:57:16 +0200
From: Vulnerability Lab <research@...nerability-lab.com>
To: fulldisclosure@...lists.org
Subject: [FD] iVault Private P&V 1.1 iOS - Path Traversal Vulnerability

Document Title:
===============
iVault Private P&V 1.1 iOS - Path Traversal Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1253


Release Date:
=============
2014-04-09


Vulnerability Laboratory ID (VL-ID):
====================================
1253


Common Vulnerability Scoring System:
====================================
6.8


Product & Service Introduction:
===============================
The BEST and MOST convenient private Photo&Video App! It provides multiple security mechanisms, and perfectly keeps your privacy 
away from peeping eyes. First, you need to add your ‘SPECIAL’ photos&videos into iVault, it provides many convenient features.
Second, you may concern about the security things. Third, iVault can provide more than you can imagine.

(Copy of the Homepage: https://itunes.apple.com/us/app/ivault-private-photo.s-video.s/id780124144 )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the official iVault Private Photos & Videos v1.1 iOS mobile application.


Vulnerability Disclosure Timeline:
==================================
2014-04-09:	Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Arvin Brook
Product: iVault - Private Photos & Videos Vault + Secrets Folders Manager 1.1


Exploitation Technique:
=======================
Remote


Severity Level:
===============
High


Technical Details & Description:
================================
The application-side path/directory traversal web vulnerability has been discovered in the official iVault Private Photos & Videos v1.1 iOS mobile application.
The vulnerability allows an local attacker to unauthorized access path- or directories values to leak information or compromise the mobile application privacy.

The first vulnerability is located in the `path & directory` value of the wifi web-access module. Remote attackers are able to request the via vulnerable path 
value any application content even if protected. The attackers are able to include local frames as path value to request an internal application path to 
unauthorized access stored private images/files. The issue can be combined with script-code attacks but is not limited to the condition only. The attack vector 
is located on the application-side and the method to include the malicious path value request is a sync (device). The security risk of the 
directory traversal vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 6.8(+)|(-)6.9.

Exploitation of the local `path & directory` vulnerability requires a low privileged device user account with physical device access and without user interaction.
Successful exploitation of the vulnerability results in unauthorized picture or file access, information disclosure and further application-side attacks.

Vulnerable Input(s):
				[+] Path

Vulnerable Module(s):
				[+] Directory

Vulnerable Parameter(s):
				[+] Oberverzeichnis > aktuell:(x)

Affected Module(s):
				[+] Path Dir Listing (each WiFi web access side)


Proof of Concept (PoC):
=======================
The application-side vulnerability can be exploited by local attackers with physical device access and low privileged user account.
User interaction is not required. For security demonstration or to reproduce the vulnerability follow the provided information 
and steps below to continue.

PoC: Source

            <script language="javascript">
                var currentFolderPath = '/"<../../var/mobile/Applications[PATH/DIRECTORY TRAVERSAL VULNERABILITY!]';
                var alertMessage = "%%ALERT_MESSAGE%%";
                var actionType = "Show";
                var submitting = false;
                var tipHiddenTop = -200;
                var tipShownTop = -80;
                var lastShownTipDate;
                
                var maxNumberOfImageCurrentEvent = 48;
                var maxNumberOfVideoCurrentEvent = 5;
                var limitationMsg = "Die Anzahl deiner Dokumente hat schon an der Grenze der freien Edition (maximal 50 Bilder oder Fotos, 5 Videos) erreicht. 
		Möchtest du nicht eine volle Edition bekommen und damit alle Einschränkungen weglassen? No thanks ;) -bkm";
                
                var videoTypes = ["MOV", "MP4", "MPV", "M4V"];
                
                function tippable() {
                    var currentTop = document.getElementById("tip").style.top;
                    currentTop = currentTop.substring(0, currentTop.length-2);
                    currentTop = Number(currentTop);
                    
                    var not = ((currentTop > tipHiddenTop) && (currentTop < tipShownTop))
                    return !not;


PoC: Execution

<div id="content" onselectstart="return false;">
<a href="/logout.html" style="float:right; margin:10px;">outloggen</a>
            
<h1 style="padding:0 15px 0">WiFi web access</h1>
<div id="buttons" style="position:relative; left:10px; height:60px; padding-top:10x;">
                
<a href="/back.html" style="text-decoration:none; top:0; left:0;"><img src="/Web/back2.png" style="width:30px; height:30px; 
border:none; margin:-9px 6px;">Oberverzeichnis [aktuell:/>"<../../var/mobile/Applications[PATH/DIRECTORY TRAVERSAL VULNERABILITY!]>]</a>


Reference(s):
http://localhost:9900/


Solution - Fix & Patch:
=======================
The vulnerability can be patched by a secure restriction and filter process of the `path` and `directory` value request.
Parse and encode also the vulnerable `Oberverzeichnis > aktuell:(x)` output values on each wifi web access page to prevent directory traversal attacks.


Security Risk:
==============
The security risk of the local directory/path traversal web vulnerability is estimated as high(-).


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@...lution-sec.com) [www.vulnerability-lab.com]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       - www.evolution-sec.com
Contact:    admin@...nerability-lab.com 	- research@...nerability-lab.com 	       - admin@...lution-sec.com
Section:    www.vulnerability-lab.com/dev 	- forum.vulnerability-db.com 		       - magazine.vulnerability-db.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       - youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact (admin@...nerability-lab.com or research@...nerability-lab.com) to get a permission.

				Copyright © 2014 | Vulnerability Laboratory [Evolution Security]



-- 
VULNERABILITY LABORATORY RESEARCH TEAM
DOMAIN: www.vulnerability-lab.com
CONTACT: research@...nerability-lab.com



_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists