Document Title: =============== Transferable Remote v1.1 iPad iPhone - Web Vulnerabilities Date: ===== 2013-02-09 References: =========== http://www.vulnerability-lab.com/get_content.php?id=863 VL-ID: ===== 863 Common Vulnerability Scoring System: ==================================== 8.5 Introduction: ============= Transferable is the easiest way to download photos from your iPhone, iPad or iPod Touch to your Mac or PC! Transferable let`s you download your photos and albums using just a web browser - no need for iTunes or even plugging your device in! As soon as the app launches it displays a web address, simply type this into a web browser on your PC or Mac and you will be able to browse, download or upload photos and albums! - Easy to use interface - Wifi Transfer - iTunes not required - Download single pictures or whole albums! - Upload photos from your PC/Mac to your iPhone, iPad or iPod Touch - Star your favorite photos for download - No limit on number of photos that can be downloaded - Works with any web browser - no installation required! - View Thumbnails and full resolution pictures - Download photos as a zip Transferable requires a wifi connection and an iphone or ipad device with iOS. (Copy of the Homepage: https://itunes.apple.com/us/app/transferable-pro-wifi-photo/id518154149) Abstract: ========= The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the mobile Transferable Remote v1.01 app for the apple ipad & iphone. Report-Timeline: ================ 2013-02-09: Public Disclosure Status: ======== Published Affected Products: ================== Apple AppStore Product: Transferable Remote v1.01 Exploitation-Technique: ======================= Remote Severity: ========= Critical Details: ======== 1.1 A local file include web vulnerability via POST request method is detected in the mobile Transferable Remote v1.01 app for the apple ipad & iphone. The vulnerability allows remote attackers via POST method to inject local app webserver folders to request unauthorized local webserver files. The vulnerbility is located in the downloadPhoto module of the webserver (http://192.168.0.10:80) when processing to load a manipulated `assets-library` url parameter. The execution of the injected path or file request will occur when the attacker is processing to reload to index listing of the affected module. Exploitation of the web vulnerability does not require a privileged application user account (standard) or user interaction. Successful exploitation of the vulnerability results in unauthorized path or file access via local file or path include attack. Vulnerable Application(s): [+] Transferable Remote v1.0 - ITunes or AppStore (Apple) Vulnerable Module(s): [+] downloadPhoto Vulnerable Parameter(s): [+] assets-library Affected Module(s): [+] Index Listing 1.2 A local command injection web vulnerability is detected in the mobile Transferable Remote v1.01 app for the apple ipad & iphone. The vulnerability allows to inject local commands via vulnerable system values to compromise the apple mobile application. The vulnerbility is located in the index module when processing to load the ipad or iphone device name. Local attackers can change the ipad or iphone device name to system specific commands and file/path requests to provoke the execution when processing to watch the index listing. Exploitation of the web vulnerability does not require a privileged application user account (standard) or user interaction. Successful exploitation of the vulnerability results unauthorized execution of system specific commands and path requests. Vulnerable Application(s): [+] Transferable Remote v1.0 - ITunes or AppStore (Apple) Vulnerable Module(s): [+] Index Vulnerable Parameter(s): [+] device name - iPad or iPone Affected Module(s): [+] Index Listing (Device Name) 1.3 A persistent input validation vulnerability is detected in the mobile Transferable Remote v1.01 app for the apple ipad & iphone. The bug allows an attacker (remote) to implement/inject malicious script code on the application-side (persistent) of the app web service. The vulnerability is located in the downloadCollection module of the webserver (http://192.168.0.10:80) when processing to request via POST manipulated name, ext and url parameters. The persistent script code will be executed out of the downloadcollection module listing. Exploitation of the vulnerability requires low or medium user interaction and with low or medium privileged application user account. Successful exploitation of the vulnerability can lead to persistent session hijacking (customers), account steal via persistent web attacks, persistent phishing or stable (persistent) certificate mail notification context manipulation. Vulnerable Application(s): [+] Transferable Remote v1.0 - ITunes or AppStore (Apple) Vulnerable Module(s): [+] downloadCollection Vulnerable Parameter(s): [+] url & ext Affected Module(s): [+] Index Listing (Device Name) 1.4 A non-persistent cross site scripting vulnerability is detected in the mobile Transferable Remote v1.01 app for the apple ipad & iphone. The vulnerability allows remote attackers to form manipulated request to hijack employeerss, moderator or admin sessions via client side browser attack. The vulnerability is located in the appliance invalid Exception Handling module and the not secure parsed path & id variables. Successful exploitation of the vulnerability result in account steal via client side session hijacking, client site phishing, or client-side content request manipulation. Vulnerable Application(s): [+] Transferable Remote v1.0 - ITunes or AppStore (Apple) Vulnerable Module(s): [+] Index Vulnerable Module(s): [+] page and bound id Affected Module(s): [+] Exception Handling (Error) Listing Proof of Concept: ================= 1.1 The local File Include web vulnerability can be exploited by remote attacker without required application user account (no password: standard) and also without user interaction. For demonstration or reproduce ... Local Path Include Vulnerability PoC: http://192.168.0.10/downloadPhoto/assets-library://[INCLUDE FILE, PATH OR URL]<(POST) Reference(s): http://192.168.0.10/downloadPhoto/ 1.2 The command injection web vulnerability can be exploited by local attacker with required device application user account and with low user interaction. For demonstration or reproduce ... Command Injection via Devicename PoC: {"devcname":"IPad360 ¥337","devctype":"ipad","pro":"false"} ... {"devcname":"[COMMAND INJECTION VIA DEVICENAME]","devctype":"ipad","pro":"false"