Document Title:
===============
Phone Drive v3.0.3 iOS - Multiple Critical Vulnerabilities
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1037
Release Date:
=============
2013-07-30
Vulnerability Laboratory ID (VL-ID):
====================================
1037
Common Vulnerability Scoring System:
====================================
7.6
Product & Service Introduction:
===============================
You can now use your iOS device as a portable Wireless Flash Drive. Introducing Phone Drive.
Phone Drive allows you to store, view and manage files on your iPhone or iPad. You can connect
to Phone Drive from any Mac or PC over the Wi-Fi network and transfer files by drag & drop files
straight from the Finder or Windows Explorer. Phone Drive features document viewer, PDF reader,
music player, image viewer, voice recorder, text editor, file manager and support most of the
file operations: like delete, move, copy, email, share, zip, unzip and more.
( Copy of the Homepage: https://itunes.apple.com/de/app/phone-drive/id431033044 )
Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered 2 persistent web vulnerabilities in the Phone Drive v3.0.3 application (Apple iOS - iPad & iPhone).
Vulnerability Disclosure Timeline:
==================================
2013-07-31: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
Apple AppStore
Product: Phone Drive - Mobile Application 3.0.3
Exploitation Technique:
=======================
Remote
Severity Level:
===============
High
Technical Details & Description:
================================
1.1
A local command/path injection web vulnerability is detected in the Phone Drive v3.0.3 application (Apple iOS - iPad & iPhone).
The vulnerability allows to inject local commands via vulnerable system values to compromise the apple mobile iOS application.
The vulnerability is located in the index file dir (header) listing module when processing to request and list the ipad or
iphone devicename. Local attackers can change the name of the device to inject the code and request any local path or inject
commands on application-side. The malicious context with the path request executes when a user or victim is watching the
file dir index listing.
Exploitation of the web vulnerability requires a local privilege iOS device account with restricted access and no user interaction.
Successful exploitation of the vulnerability results unauthorized execution of system specific commands and path requests.
Vulnerable Application(s):
[+] Phone Drive v3.0.3 - ITunes or AppStore (Apple)
Vulnerable Parameter(s):
[+] device name
Affected Module(s):
[+] Listing (INDEX & SUB CATEGORIES) - Page Header
1.2
A local command/path injection web vulnerability is detected in the Phone Drive v3.0.3 application (Apple iOS - iPad & iPhone).
The vulnerability allows to inject local commands via vulnerable system values to compromise the apple mobile iOS application.
The vulnerability is located in the file dir foldername listing module when processing to request and list the foldernames as item.
Local attackers can change the name of the foldernames to inject the code and request any local path or inject commands on application-side.
The malicious context with the path request executes when a user or victim is watching the file dir foldername listing.
Exploitation of the web vulnerability requires a local privilege iOS device account with restricted access and no user interaction.
Successful exploitation of the vulnerability results unauthorized execution of system specific commands and path requests.
Vulnerable Application(s):
[+] Phone Drive v3.0.3 - ITunes or AppStore (Apple)
Vulnerable Parameter(s):
[+] foldername (add/create)
Affected Module(s):
[+] Folder Listing (INDEX & SUB CATEGORIES)
1.3
A persistent input validation web vulnerability is detected in the Phone Drive v3.0.3 application (Apple iOS - iPad & iPhone).
The bug allows an attacker (remote) to implement/inject malicious own malicious persistent script codes (application-side).
The vulnerability is located in the `rename file` module of the web-server (http://localhost:80) when processing to
inject via POST method manipulated `filenames`. The file name will be changed to the path value without secure filter,
encode or parse. The injected script code occurs in the folder listing of the file location in the separate path.
Exploitation of the persistent web vulnerability requires low user interaction and a local low privilege mobile application account.
Successful exploitation of the vulnerability can lead to persistent session hijacking (customers), account steal via persistent
web attacks, persistent phishing or persistent module context manipulation.
Vulnerable Application(s):
[+] Phone Drive v3.0.3 - ITunes or AppStore (Apple)
Vulnerable Module(s):
[+] File Listing - Names
Vulnerable Parameter(s):
[+] rename (filename)
Affected Module(s):
[+] File Listing (INDEX & SUB CATEGORIES)
Proof of Concept (PoC):
=======================
1.1
The local command/path inject web vulnerability can be exlploited by local attackers with physical iOS device access and user interaction.
For demonstration or reproduce ...
PoC: Listing (INDEX & SUB CATEGORIES) - INJECT via Device Name
Manual steps to reproduce the vulnerability ...
1. Download the Phone Drive application to your iOS test device
2. Login to your ipad install and startup the software
3. Open the iOS settings of your iphone or ipad and change the device (system) name to your script code with local path and or command var
4. Save the input and start sharing the files with the iOS app
5. Open as localhost the service in your browser to request the http web server
6. The command/path inject will be executed in the header location of the app web-server index and also in all sub categories
7. Successful reproduced!
1.2
The local command/path inject web vulnerability can be exlploited by remote attackers without privilege application user account
and user interaction. For demonstration or reproduce ...
--- Request Session Log (POST METHOD) ---
Status: 200[OK]
POST http://192.168.2.104/#
Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ]
Content Size[5458]
Mime Type[application/x-unknown-content-type]
Request Headers:
Host[192.168.2.104]
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[en-US,en;q=0.5]
Accept-Encoding[gzip, deflate] DNT[1]
Referer[http://192.168.2.104/]
Connection[keep-alive]
Post Data:
createFolder[Benjamin%2520%3E%3C(LOCAL COMMAND/PATH INJECT VULNERABILITY)ios]
ID[0]
submitButton[Create]
Response Headers:
Accept-Ranges[bytes]
Content-Length[5458]
Date[Tue, 30 Jul 2013 16:16:47 GMT]
PoC: Listing (INDEX & SUB CATEGORIES) - INJECT via Creat/Add Foldername
Note:
To reproduce the inject of the command/path request with script code inject the payload inside of the foldername input on creat or edit.
The code will be executed in the index foldername listing and in the sub category and foldername listing.
1.3
The persistent input validation web vulnerability can be exploited by remote attackers without privilege application user account and
low user interaction. For demonstration or reproduce ...
--- Request Session Log (POST METHOD) ---
Status: 200[OK]
POST http://192.168.2.104/Benjamin%2520%3E%3Cbkm37%3Ebkm37ios/#
Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ]
Content Size[4837]
Mime Type[application/x-unknown-content-type]
Request Headers:
Host[192.168.2.104]
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[en-US,en;q=0.5]
Accept-Encoding[gzip, deflate] DNT[1]
Referer[http://192.168.2.104/Benjamin%2520%3E%3Cbkm37%3Ebkm37ios/]
Connection[keep-alive]
Post Data:
renameFile[%3C(PERSISTENT INJECTED SCRIPT CODE!)%3Eintro.png]
ID[intro.png]
submitButton[Rename]
Response Headers:
Accept-Ranges[bytes]
Content-Length[4837]
Date[Tue, 30 Jul 2013 16:39:10 GMT]
PoC: Listing (File Name) - INJECT via Rename Files Function
