Document Title:
===============
eTransfer Lite v1.0 iOS - Persistent Filename Vulnerability
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1064
Release Date:
=============
2013-08-30
Vulnerability Laboratory ID (VL-ID):
====================================
1064
Common Vulnerability Scoring System:
====================================
3.8
Product & Service Introduction:
===============================
eTransfer is a tool for you to transfer photos among pc, iPad. eTransfer does not need iTunes. It supports to transfer photo:
- iPad to iPad
- iPad to PC
- PC to iPad
eTransfer does not need extra software. All you need is the device that installed eTransfer and web browser on any os.
(Copy of the Homepage: https://itunes.apple.com/de/app/etransfer-lite-for-ipad/id492163598 )
Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered a persistent web vulnerability in the eTransfer Lite v1.0 application (Apple iOS - iPad & iPhone).
Vulnerability Disclosure Timeline:
==================================
2013-08-31: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
Apple AppStore
Product: eTransfer Lite 1.0
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Low
Technical Details & Description:
================================
A persistent input validation web vulnerability is detected in the eTransfer Lite v1.0 application (Apple iOS - iPad & iPhone).
The bug allows an attacker (remote) to implement/inject malicious own malicious persistent script codes (application-side).
The vulnerability is located in the `Receive Photos from others` and `Send Photos to others` module of the web-server (http://localhost:8080)
when processing to request via POST method manipulated `file-names`. The file name will be changed to the path value without secure filter,
encode or parse. The injected script code will be executed in the main file listing were the attacker injected earlier the code
and of course also in the index listing of the mobile web application.
There is a security protection to filter random files because only images are allowed. To include own script code the attacker needs
to manipulate the POST request after the first separate input parse.
Exploitation of the persistent web vulnerability requires low user interaction and a local low privilege mobile application account
with a password. Successful exploitation of the vulnerability can lead to persistent session hijacking (customers), account steal
via persistent web attacks, persistent phishing or persistent module context manipulation.
Vulnerable Application(s):
[+] eTransfer Lite v1.0 - ITunes or AppStore (Apple)
Vulnerable Module(s):
[+] File Listing
Vulnerable Parameter(s):
[+] file name
Affected Module(s):
[+] Index File Dir & Path Listing
[+] Path/Folder Listing
Proof of Concept (PoC):
=======================
The persistent input validation web vulnerability can be exploited by remote attackers and local privileged application user accounts with
low or medium user interaction. For demonstration or reproduce ...
PoC:
The following files are hosted live from the iPad's Docs folder.Images:
<[PERSISTENT INJECTED SCRIPT CODE!]">s2.png
( 51.8 Kb, 2013-08-25 02:09:25 +0000)
a2b642e7de.jpg
( 238.0 Kb, 2013-08-25 02:08:13 +0000)
Powered
By Kaisatec.com ![<[PERSISTENT INJECTED SCRIPT CODE!]">s2.png](http://192.168.2.104:8080/%3C[PERSISTENT INJECTED SCRIPT CODE!]%3Es2.png){kind=link}
