Message-ID: <54465410.7040305@vulnerability-lab.com>
Date: Tue, 21 Oct 2014 14:39:44 +0200
From: Vulnerability Lab <research@...nerability-lab.com>
To: fulldisclosure@...lists.org
Subject: [FD] Files Document & PDF 2.0.2 iOS - Multiple Vulnerabilities

Document Title:
===============
Files Document & PDF 2.0.2 iOS - Multiple Vulnerabilities


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1341


Release Date:
=============
2014-10-14


Vulnerability Laboratory ID (VL-ID):
====================================
1341


Common Vulnerability Scoring System:
====================================
8.7


Product & Service Introduction:
===============================
Store and view your documents, transferring them easily from any Mac or PC. High quality viewers, including support for PDF, 
Office, iWork & images. Full integration with Box, Dropbox, Google Drive & OneDrive [Pro feature]. Play music; watch movies; 
access your cloud storage or download from the internet.

(Copy of the Vendor Homepage: https://itunes.apple.com/us/app/files-document-pdf-reader/id294150896 )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the official Files Document & PDF Reader 2.0.2 iOS mobile application.


Vulnerability Disclosure Timeline:
==================================
2014-10-14: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Olive Toast Software Ltd.
Product: Files Document & PDF Reader - iOS Mobile WebDav Application (Wifi) 2.0.2


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Critical


Technical Details & Description:
================================
1.1
A code execution web vulnerability has been discovered  in the official Files Document & PDF Reader 2.0.2 iOS mobile application.
The issue allows an attacker to compromise the application and connected device components by exploitation of system specific 
code execution vulnerability in the webdisk interface.

The vulnerability is located in the MKCOL request of the `Ordner Erstellen` input module. The main web-dav index provides a function to add folder as 
path through a regular input form form which is not correctly encoding the input. Own malicious context can be injected to the add folder function and 
the results is the application-side execution of system specific malicious codes. The input field of the upload modules executes the input wrong encoded 
via POST method request as filename value. Remote attackers are also able to execute own malicious codes by usage of a script code payload in combination 
with the affected values. The execution of the code occurs in the main web-dav file dir web listing context. The attack vector is located on application-side 
and the request method to attack the service is MKCOL. 

The security risk of the remote code execution web vulnerability is estimated as critical with a cvss (common vulnerability scoring system) count of 8.6
Exploitation of the remote code execution web vulnerability requires no privileged application user account (passwd default blank) or user interaction. 
Successful exploitation of the code execution vulnerability results in mobile application compromise and connected or affected device component compromise.


Vulnerable Method(s):
					[+] MKCOL

Vulnerable Module(s):
					[+] Ordner Erstellen (Folder Add)

Vulnerable Parameter(s):
					[+] ot_notification

Affected Module(s):
					[+] Web Dav - Interface Path Dir Listing




1.2
A local file include web vulnerability has been discovered  in the official Files Document & PDF Reader 2.0.2 iOS mobile application.
The local file include web vulnerability allows remote attackers to unauthorized include local file/path requests or system specific 
path commands to compromise the mobile web-application.

The web vulnerability is located in the `filename` values of the `rename` input. Remote attackers are able to inject own files with malicious 
`filename` values in the `Move` request to compromise the mobile web-application. The attacker is able to inject the local file include requests 
by usage of the `wifi interface` in connection with the vulnerable create to add request. The local file/path include execution occcurs in the web 
dav file dir listing. 

Remote attackers are also able to exploit the filename validation issue in combination with persistent injected script codes to execute different 
local malicious attacks requests. The attack vector is on the application-side of the file wifi mobile app. 

The security risk of the local file include web vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 7.1. 
Exploitation of the file include web vulnerability requires no user interaction or privileged web-application user account. Successful exploitation 
of the local file include web vulnerability results in mobile application or connected device component compromise.

Vulnerable Method(s):
				[+] [Created]

Vulnerable Module(s):
				[+] Rename

Vulnerable Parameter(s):
				[+] filename

Affected Module(s):
				[+] Web Dav - Interface File Dir Listing



1.3
A local command/path injection web vulnerability has been discovered in the official Files Document & PDF Reader 2.0.2 iOS mobile application.
The remote web vulnerability allows to inject local commands via vulnerable system values to compromise the apple iOS mobile web-application.

The vulnerability is located in the in the device name value of the web dav index header context module. Local attackers are able to inject own 
script codes by changing the local iOS devicename to malicious context with special chars. The execute of the injected script code occurs with 
persistent attack vector in the header section of the wifi web-interface. 

The security risk of the command/path inject vulnerabilities are estimated as medium with a cvss (common vulnerability scoring system) count of 5.2.
Exploitation of the command/path inject vulnerability requires a local low privileged iOS device account with restricted access and no user interaction. 
Successful exploitation of the vulnerability results in unauthorized execute of system specific commands or unauthorized path requests.

Request Method(s):
				[+] [GET]

Vulnerable Parameter(s):
				[+] devicename

Affected Module(s):
				[+] Web Dav - Web Interface Wifi [Application Header Context]


Proof of Concept (PoC):
=======================
1.1
The local command inject web vulnerability can be exploited by local attackers with physcial device access by low privileged accounts and without user interaction. 
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.


PoC: Web Dav Server - Interface Index

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; 
charset=UTF-8"/>
<title>Files - bkm337"><[LOCAL COMMAND INJECT VULNERABILITY VIA DEVICE NAME VALUE!]></title>
<link rel="stylesheet" href="234C930E-2662-4104-B498-0AF172314DAF" type="text/css" media="screen" charset="UTF-8"/>
<script 
type="text/javascript" src="F59FEFFF-9F87-4906-8F48-5CF14F3E3422"></script>
<!--[if lte IE 7]>
<style type="text/css">body{min-width:700px} #ot_files_title{line-height:80%} .ot_actions button{padding:0px; margin-left:0px}</style>
<![endif]-->
</head>
<body>
<div>
  <h2 id="ot_files_title" class="link" onclick="window.open('http://www.olivetoast.com')">WebDAV Server<br/>
    <span>© Olive Toast Software Ltd.</span>
  </h2>
</div>
<h1 class="text-center ot_root_title">Files - bkm337"><[LOCAL COMMAND INJECT VULNERABILITY VIA DEVICE NAME VALUE!]></h1>
<div class="text-center">
  <!-- Using table layout because display:inline-block (with divs) isn't supported by ie6/7 -->
  <table 
class="ot_root_table">
    <tr>
      <td id="ot_documents" class="ot_rootfolder">
        <a href="/Documents/">
          <img src="E9936039-D58C-4D9B-94C6-0A0DF86DA628" alt="Documents Folder"/>
          <p class="ot_rootfolder_caption">Dokumente</p>
        </a>
      </td>
      <td id="ot_public" class="ot_rootfolder">
        <a href="/Public/">
          <img src="98301160-7F1E-401C-9FE9-022A78CA3990" alt="Public Folder"/>
          <p class="ot_rootfolder_caption">Öffentlich</p>
        </a>
      </td>
    </tr>
  </table>
</div>
<div class="hr"></div>
<div class="footer">
  <span id="ot_footer_text">WebDAV Server</span><br/>
  <span class="link" onclick="window.open
('http://www.olivetoast.com')">© Olive Toast Software Ltd.</span>
</div>
</body>
</html>



1.2
The code execution vulnerability can be exploited by remote attackers without privileged application user account and also without user interaction.
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.


PoC: ot_notification name > Ordner Erstellen

<div id="ot_actions_top" class="ot_actions">
<!-- MSIE6 doesn't support 'name' on non-input/button tags -->
<span class="ot_select">Auswählen: </span><span class="menu ot_select_all">Alle</span> <b>|</b> <span class="menu ot_select_none">Keine</span>
<button style="padding: 0px;" name="ot_delete_button" class="ot_group_start">Löschen</button>
<button style="padding: 0px;" name="ot_rename_button" class="ot_group_start">Umbenennen</button>
<button style="padding: 0px;" name="ot_move_button">Verschieben</button><ul class="popup_menu" name="ot_move_menu"></ul>
<button style="padding: 0px;" name="ot_copy_button">Kopieren nach</button><ul class="popup_menu" name="ot_copy_menu"></ul>
<button style="padding: 0px;" name="ot_jump_button" class="ot_group_start">Springen</button><ul class="popup_menu" name="ot_jump_menu"></ul>
<button style="padding: 0px;" name="ot_createfolder_button" class="ot_group_start">Ordner erstellen</button>
<span disabled="false" class="ot_refresh_list menu ot_group_start">Neu laden</span></div>
<div class="hr"></div>
<div class="ot_notification_container">
<span style="visibility: visible;" id="ot_notification_top" 
class="ot_notification">Erstellen von '"><[PERSISTENT INJECTED SCRIPT CODE VIA FOLDERNAME!]">' fehlgeschlagen</iframe></span>
</div><h2 id="ot_content_title"><a href="/">Files</a>/<a href="/Documents/">Documents</a></h2>


--- PoC Session Logs [MKCOL] ---

Status: 200[OK] 
MKCOL http://localhost:8080/Documents/%22%3E%3C-[CODE EXECUTION VULNERABILITY VIA FOLDERNAME VALUE!]; Load Flags[LOAD_BACKGROUND  ] Größe des Inhalts[unknown] Mime Type[unknown]
   Request Header:
      Host[localhost]
      User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0]
      Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
      Accept-Language[de,en-US;q=0.7,en;q=0.3]
      Accept-Encoding[gzip, deflate]
      X-Requested-With[XMLHttpRequest]
      Referer[http://localhost/Documents/]
      Content-Length[0]
      Content-Type[text/plain; charset=UTF-8]
      Cookie[otsessionid=; otsessionid=]

Status: 200[OK] 
MKCOL http://localhost:8080/Documents/-[CODE EXECUTION VULNERABILITY VIA FOLDERNAME VALUE!]; Load Flags[LOAD_DOCUMENT_URI  ] Größe des Inhalts[unknown] Mime Type[unknown]
   Request Header:
      Host[localhost]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0]
      Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
      Accept-Language[de,en-US;q=0.7,en;q=0.3]
      Accept-Encoding[gzip, deflate]
      Referer[http://localhost/Documents/]
      Cookie[otsessionid=; otsessionid=]





1.3
The local file include web vulnerability can be exploited by local attackers without privileged application user account and without user interaction.
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.


PoC: localhost:8080/Documents/ - Web Dav via Rename function

<table>
  <thead style="display: table-header-group;" id="ot_file_listing_header">
    <tr>
      <th></th>
      <th id="ot_name_header" class="text-left sort">Name<img src="D52A0C4C-AB72-4105-9AD1-77E0FD6B18CE"></th>
      <th id="ot_size_header" class="text-right sort">Größe<img src="D52A0C4C-AB72-4105-9AD1-77E0FD6B18CE" style="visibility:hidden"></th>
      <th></th>
      <th id="ot_date_header" class="text-left sort">Datum<img src="D52A0C4C-AB72-4105-9AD1-77E0FD6B18CE" style="visibility:hidden"></th>
    </tr>
  </thead>
  <tbody id="ot_file_listing">
<tr selected="yes"><td><input type="checkbox"></td><td class="name"><a collection="no" 
href="/Documents/Willkommen.docx%20%22%3E%3Ciframe%20src%3Da%3E"><img src="/85AEFEF7-ABF5-4199-84FF-C694D6E47DC2">
<span class="filename">Willkommen.docx "><./[FILE INCLUDE VULNERABILITY VIA FILENAME!]></span></a></td><td class="size">5 KB</td><td class="download"></td>
<td class="date">15 Sep. 21:04</td></tr>
</tbody>
</table> <!-- ot_file_listing -->
<br>
<h3 style="display: none;" id="ot_noitems">(Keine Elemente)</h3>
<br>
<div class="ot_notification_container">
  <span style="visibility: hidden;" id="ot_notification_bottom" class="ot_notification"></span>
</div>


--- PoC Session Logs ---

Status: 201[Created] 
MOVE http://192.168.2.104/Documents/Willkommen.docx Load Flags[LOAD_BACKGROUND  ] Größe des Inhalts[0] Mime Type[application/x-unknown-content-type]
   Request Header:
      Host[192.168.2.104]
      User-Agent
[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0]
      Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
      Accept-Language[de,en-US;q=0.7,en;q=0.3]
      Accept-Encoding[gzip, deflate]
  X-Requested-With[XMLHttpRequest]
      Destination[http://192.168.2.104/Documents/Willkommen.docx%20%22%3E%3C./[FILE INCLUDE VULNERABILITY VIA FILENAME!]%3Da%3E]
      Overwrite[F]
      Referer[http://192.168.2.104/Documents/]
Content-Length[0]
      Content-Type[text/plain; charset=UTF-8]
      Cookie[otsessionid=; otsessionid=]
      Connection[keep-alive]
   Response Header:
      Accept-Ranges[none]
      Content-Length[0]
      Server[OTDAV/2.0.2]
Location[http://192.168.2.104/Documents/Willkommen.docx%20%22%3E%3C./[FILE INCLUDE VULNERABILITY VIA FILENAME!]%3Da%3E]
      Date[Mon, 13 Oct 2014 17:53:40 GMT]


Status: 200[OK] 
GET http://192.168.2.104/Documents/./[FILE INCLUDE VULNERABILITY VIA FILENAME!] Load Flags[LOAD_DOCUMENT_URI  ] Größe des Inhalts[0] Mime Type[application/x-unknown-content-type]
   Request Header:
      Host
[192.168.2.104]
      User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0]
      Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
      Accept-Language[de,en-US;q=0.7,en;q=0.3]
Accept-Encoding[gzip, deflate]
      Referer[http://192.168.2.104/Documents/]
      Cookie[otsessionid=; otsessionid=]
      Connection[keep-alive]
   Response Header:
      Accept-Ranges[none]
      Content-Length[0]
      Server[OTDAV/2.0.2]
     Connection[close]
      Date[Mon, 13 Oct 2014 17:53:40 GMT]


Solution - Fix & Patch:
=======================
1.1
The code execution issue can be patched by a secure parse and encode of the `Ordner Erstellen` input field. The code execution can be prevented by a secure restriction of the ot_notification value.

1.2
The local file include web vulnerability can be patched by a secure parse and encode of the filename value. Restrict the usage of the rename and move request 
to prevent further file include attacks. 
Encode the filename value in each web-dav interface site to prevent the file include request execution.

1.3
To parse the command inject vulnerability it is required to encode the devicename value of the local device itself.
Encode the output in the web-dav interface header section to prevent the execution of a payload through the devicename value.


Security Risk:
==============
1.1
The security risk of the code execution vulnerability in the `Ordner Erstellen` module is estimated as critical.

1.2
The security risk of the local file include web vulnerability in the filename validation is estimated as high.

1.3
The security risk of the local command inject web vulnerability in the devicename value is etimated as medium.


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@...lution-sec.com) [www.vulnerability-lab.com]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either 
expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers 
are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even 
if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation 
of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break 
any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       		- www.evolution-sec.com
Contact:    admin@...nerability-lab.com 	- research@...nerability-lab.com 	       		- admin@...lution-sec.com
Section:    dev.vulnerability-db.com	 	- forum.vulnerability-db.com 		       		- magazine.vulnerability-db.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       		- youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   		- vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php  	- vulnerability-lab.com/list-of-bug-bounty-programs.php	- vulnerability-lab.com/register/

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to 
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by 
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website 
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact 
(admin@...nerability-lab.com or research@...nerability-lab.com) to get a permission.

				Copyright © 2014 | Vulnerability Laboratory [Evolution Security]



-- 
VULNERABILITY LABORATORY RESEARCH TEAM
DOMAIN: www.vulnerability-lab.com
CONTACT: research@...nerability-lab.com



_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists