astaektagadar: Transferable Remote v1.1 iPad iPhone

Full Disclosure mailing list archives
Transferable Remote v1.1 iPad iPhone - Multiple Web Vulnerabilities
From: Vulnerability Lab <research () vulnerability-lab com>
Date: Wed, 13 Feb 2013 02:46:52 +0100
Title: ====== Transferable Remote v1.1 iPad iPhone - Multiple Web Vulnerabilities   Date: ===== 2013-02-09   References: =========== http://www.vulnerability-lab.com/get_content.php?id=863   VL-ID: ===== 863   Common Vulnerability Scoring System: ==================================== 8.5   Introduction: ============= Transferable is the easiest way to download photos from your iPhone, iPad or iPod Touch to your Mac or PC! Transferable let`s you download your photos and albums using just a web browser - no need for iTunes or even  plugging your device in! As soon as the app launches it displays a web address, simply type this into a web  browser on your PC or Mac and you will be able to browse, download or upload photos and albums!  - Easy to use interface - Wifi Transfer - iTunes not required - Download single pictures or whole albums! - Upload photos from your PC/Mac to your iPhone, iPad or iPod Touch - Star your favorite photos for download - No limit on number of photos that can be downloaded - Works with any web browser - no installation required! - View Thumbnails and full resolution pictures - Download photos as a zip  Transferable requires a wifi connection and an iphone or ipad device with iOS.  (Copy of the Homepage: https://itunes.apple.com/us/app/transferable-pro-wifi-photo/id518154149)   Abstract: ========= The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the mobile Transferable Remote v1.01  app for the apple ipad & iphone.   Report-Timeline: ================ 2013-02-09:     Public Disclosure   Status: ======== Published   Affected Products: ================== Apple AppStore Product: Transferable Remote 1.01   Exploitation-Technique: ======================= Remote   Severity: ========= Critical   Details: ======== 1.1 A local file include web vulnerability via POST request method is detected in the mobile Transferable Remote v1.01 app  for the apple ipad & iphone. The vulnerability allows remote attackers via POST method to inject local app webserver folders to request unauthorized  local webserver files.  The vulnerbility is located in the downloadPhoto module of the webserver (http://192.168.0.10:80) when processing to  load a manipulated  `assets-library` url parameter. The execution of the injected path or file request will occur when the attacker is  processing to reload  to index listing of the affected module.   Exploitation of the web vulnerability does not require a privileged application user account (standard) or user  interaction. Successful exploitation of the vulnerability results in unauthorized path or file access via local file or path include  attack.   Vulnerable Application(s):                                 [+] Transferable Remote v1.0 - ITunes or AppStore (Apple)  Vulnerable Module(s):                                 [+] downloadPhoto  Vulnerable Parameter(s):                                 [+] assets-library  Affected Module(s):                                 [+] Index Listing     1.2 A local command injection web vulnerability is detected in the mobile Transferable Remote v1.01 app for the apple ipad  & iphone. The vulnerability allows to inject local commands via vulnerable system values to compromise the apple mobile  application.  The vulnerbility is located in the index module when processing to load the ipad or iphone device name. Local attackers  can change the  ipad or iphone device name to system specific commands and file/path requests to provoke the execution when processing  to watch the index listing.  Exploitation of the web vulnerability does not require a privileged application user account (standard) or user  interaction. Successful exploitation of the vulnerability results unauthorized execution of system specific commands and path  requests.  Vulnerable Application(s):                                 [+] Transferable Remote v1.0 - ITunes or AppStore (Apple)  Vulnerable Module(s):                                 [+] Index  Vulnerable Parameter(s):                                 [+] device name - iPad or iPone  Affected Module(s):                                 [+] Index Listing (Device Name)     1.3 A persistent input validation vulnerability is detected in the mobile Transferable Remote v1.01 app for the apple ipad  & iphone. The bug allows an attacker (remote) to implement/inject malicious script code on the application side (persistent) of  the app web service.   The vulnerability is located in the downloadCollection module of the webserver (http://192.168.0.10:80) when processing  to request via POST manipulated name, ext and url parameters. The persistent script code will be executed out of the  downloadcollection module listing.   Exploitation of the vulnerability requires low or medium user interaction and with low or medium privileged application  user account. Successful exploitation of the vulnerability can lead to persistent session hijacking (customers), account steal via  persistent web  attacks, persistent phishing or stable (persistent) certificate mail notification context manipulation.  Vulnerable Application(s):                                 [+] Transferable Remote v1.0 - ITunes or AppStore (Apple)  Vulnerable Module(s):                                 [+] downloadCollection  Vulnerable Parameter(s):                                 [+] url & ext  Affected Module(s):                                 [+] Index Listing (Device Name)    1.4 A non-persistent cross site scripting vulnerability is detected  in the mobile Transferable Remote v1.01 app for the  apple ipad & iphone. The vulnerability allows remote attackers to form manipulated request to hijack employeerss, moderator or admin  sessions via client side  browser attack.  The vulnerability is located in the appliance invalid Exception Handling module and the not secure parsed path & id  variables.  Successful exploitation of the vulnerability result in account steal via client side session hijacking, client site  phishing, or  client-side content request manipulation.  Vulnerable Application(s):                                 [+] Transferable Remote v1.0 - ITunes or AppStore (Apple)  Vulnerable Module(s):                                 [+] Index  Vulnerable Module(s):                                 [+] page and bound id  Affected Module(s):                                 [+] Exception Handling (Error) Listing   Proof of Concept: ================= 1.1 The local File Include web vulnerability can be exploited by remote attacker without required application user account  (no password: standard)  and also without user interaction. For demonstration or reproduce ...  Local Path Include Vulnerability  PoC: http://192.168.0.10/downloadPhoto/assets-library://[INCLUDE FILE, PATH OR URL]<(POST)  Reference(s): http://192.168.0.10/downloadPhoto/   1.2 The command injection web vulnerability can be exploited by local attacker with required device application user  account and with  low user interaction. For demonstration or reproduce ...  Command Injection via Devicename  PoC: {"devcname":"IPad360 ?337","devctype":"ipad","pro":"false"} ... {"devcname":"[COMMAND INJECTION VIA DEVICENAME]","devctype":"ipad","pro":"false"<OR true;)}  Reference(s): http://192.168.0.10/getSettings http://192.168.0.10/    1.3 The persistent validation web vulnerability can be exploited by remote attackers with required application user account  and with  low or medium user interaction. For demonstration or reproduce ...  POST Inject via Download marked (star) files  PoC: (POST) input=%5B%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DF102FE64-1463-4150-8FF8-0A512E7EB278%26 ext%3DJPG%22%2C%22name%22%3A%22<[INJECTED SCRIPT CODE!]") <.JPG%22%2C%22search%22%3A%22<[INJECTED SCRIPT CODE!]")  <JPG%22%7D%2C%7B%22url%22%3A%22 assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D7A40B84F-CE2A-40C7-87C9-C66927626F66%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0004.JPG%22%2C%22search %22%3A%22IMG0004JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D11E8FF27-B3A4-46B9-B320-74EFBDF9760D%26ext%3DJPG%22%2C %22name%22%3A%22IMG_0008.JPG%22%2C%22search%22%3A%22IMG0008JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG %3Fid%3D8EC135C1-D1DF-458F-B7B5-75DF2EB87B06%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0010.JPG%22%2C%22search%22%3A%22IMG0010JPG%22%7D%2C%7B%22url %22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DAD9CA73F-1ED4-4708-83DB-AC27441D9CC5%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0011.JPG%22 %2C%22search%22%3A%22IMG0011JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D2DF297C4-1EC7-4B96-8B74-F4923AF9FBDA%26 ext%3DJPG%22%2C%22name%22%3A%22IMG_0012.JPG%22%2C%22search%22%3A%22IMG0012JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG %3Fid%3D7A8B8F5B-B524-44E3-8C99-6DB2AB258E66%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0013.JPG%22%2C%22search%22%3A%22IMG0013JPG%22%7D%2C%7B%22url%22 %3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D76E366E9-AAF2-41A5-8D9C-599F1242001D%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0014.JPG%22%2C%22 search%22%3A%22IMG0014JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D27000044-675B-4C67-A4ED-2EA38B8318E5%26ext%3D JPG%22%2C%22name%22%3A%22IMG_0015.JPG%22%2C%22search%22%3A%22IMG0015JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D 4C0729AE-7BBC-4DC6-BDF4-62E7D48AE167%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0016.JPG%22%2C%22search%22%3A%22IMG0016JPG%22%7D%2C%7B%22url%22%3A%22 assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D5457AD21-66CD-4CF4-8F3E-1ACE66761742%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0017.JPG%22%2C%22search %22%3A%22IMG0017JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DCA15604D-4344-4739-9B7D-4B2B87BFC04E%26ext%3DJPG%22 %2C%22name%22%3A%22IMG_0018.JPG%22%2C%22search%22%3A%22IMG0018JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D 20BDBEC2-3B0E-435E-87B5-5DF1228D8164%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0019.JPG%22%2C%22search%22%3A%22IMG0019JPG%22%7D%2C%7B%22url%22%3A%22 assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DD69EDCA7-632F-417B-895A-88B6900282EE%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0020.JPG%22%2C%22search %22%3A%22IMG0020JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D0207435E-10A3-4F4E-8B49-05E891C4BC0A%26ext%3DJPG %22%2C%22name%22%3A%22IMG_0021.JPG%22%2C%22search%22%3A%22IMG0021JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3F id%3D4A9763CC-8EB3-4B12-802F-3C3E5A092CD2%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0022.JPG%22%2C%22search%22%3A%22IMG0022JPG%22%7D%2C%7B%22url%22 %3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D5AF6F15B-6F68-48E8-9ACB-8D424A3C8AEB%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0023.JPG%22%2C %22search%22%3A%22IMG0023JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D3477F60C-DD79-4022-B1FB-37F1038E89C2%26 ext%3DJPG%22%2C%22name%22%3A%22IMG_0024.JPG%22%2C%22search%22%3A%22IMG0024JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG %3Fid%3D1A072B2E-8869-4845-A9DF-EB1C5BAA6728%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0025.JPG%22%2C%22search%22%3A%22IMG0025JPG%22%7D%2C%7B%22url %22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DA7611789-4D0B-42D0-91CA-8D268C0D9721%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0026.JPG%22 %2C%22search%22%3A%22IMG0026JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DF0D4C1E7-9318-46F3-A539-B2140BD5A10A%26 ext%3DJPG%22%2C%22name%22%3A%22IMG_0027.JPG%22%2C%22search%22%3A%22IMG0027JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG %3Fid%3D2433465E-2C1E-4133-8FA0-D4800BF334A8%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0028.JPG%22%2C%22search%22%3A%22IMG0028JPG%22%7D%2C%7B%22url%22 %3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D712872C7-7A34-452A-816D-57DB34ABD3F3%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0029.JPG%22%2C%22 search%22%3A%22IMG0029JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D3874F42F-5AB7-4E3E-8913-C5EAC4E9FED5%26ext%3D JPG%22%2C%22name%22%3A%22IMG_0030.JPG%22%2C%22search%22%3A%22IMG0030JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D 6C2CA643-C80D-455C-BC35-3705E8EFAF3D%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0031.JPG%22%2C%22search%22%3A%22IMG0031JPG%22%7D%2C%7B%22url%22%3A%22 assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DDA8CE2BD-9F39-4037-B82A-DDFBF32D42C3%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0032.JPG%22%2C%22search %22%3A%22IMG0032JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DCA7E8330-FB0B-4F04-8E78-899DA951F003%26ext%3DJPG%22 %2C%22name%22%3A%22IMG_0033.JPG%22%2C%22search%22%3A%22IMG0033JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D B0D24A45-61B9-4181-B6C7-D5F012D2FC57%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0034.JPG%22%2C%22search%22%3A%22IMG0034JPG%22%7D%2C%7B%22url%22%3A%22 assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D012F05C9-AE5B-423B-AE00-A112FCBE9897%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0035.JPG%22%2C%22search %22%3A%22IMG0035JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DD19E01E0-B803-4ACB-A2AE-259C1247916A%26ext%3DJPG %22%2C%22name%22%3A%22IMG_0036.JPG%22%2C%22search%22%3A%22IMG0036JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid %3DA9F743E5-9D18-4236-A666-AE890431F738%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0037.JPG%22%2C%22search%22%3A%22IMG0037JPG%22%7D%2C%7B%22url%22%3A %22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3D970D6C1D-99F8-4B5B-963C-F60931B910A9%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0038.JPG%22%2C%22 search%22%3A%22IMG0038JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DDA5B327A-8016-4574-AF37-4AD9F13533B3%26ext %3DJPG%22%2C%22name%22%3A%22IMG_0039.JPG%22%2C%22search%22%3A%22IMG0039JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG %3Fid%3DAEE85816-B08F-44D2-8F21-18209C6A37EE%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0040.JPG%22%2C%22search%22%3A%22IMG0040JPG%22%7D%2C%7B%22url %22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DB3CBB8B4-1323-4EB6-A029-8C2D17FC9FDC%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0041.JPG%22 %2C%22search%22%3A%22IMG0041JPG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.PNG%3Fid%3D2C37BCB2-820C-4884-8126-5CD71FD4D7B6%26ext %3DPNG%22%2C%22name%22%3A%22IMG_0042.PNG%22%2C%22search%22%3A%22IMG0042PNG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.PNG %3Fid%3D7A039467-1507-4031-ACCD-F5E327763DB7%26ext%3DPNG%22%2C%22name%22%3A%22IMG_0043.PNG%22%2C%22search%22%3A%22IMG0043PNG%22%7D%2C%7B%22url %22%3A%22assets-library%3A%2F%2Fasset%2Fasset.PNG%3Fid%3D109F6B8A-1B7E-4371-AFBE-C58E924347C0%26ext%3DPNG%22%2C%22name%22%3A%22IMG_0044.PNG %22%2C%22search%22%3A%22IMG0044PNG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.PNG%3Fid%3D870C9313-4069-41A2-A274-C37D29ED9D16%26ext %3DPNG%22%2C%22name%22%3A%22IMG_0045.PNG%22%2C%22search%22%3A%22IMG0045PNG%22%7D%2C%7B%22url%22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG %3Fid%3DAB71436A-9D20-4B18-92FB-F7E54293E082%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0007.JPG%22%2C%22search%22%3A%22IMG0007JPG%22%7D%2C%7B%22url %22%3A%22assets-library%3A%2F%2Fasset%2Fasset.JPG%3Fid%3DA1611D33-B9C0-4F56-BFE0-F219AE129EAF%26ext%3DJPG%22%2C%22name%22%3A%22IMG_0006.JPG %22%2C%22search%22%3A%22IMG0006JPG%22%7D%5D  Reference(s): http://192.168.0.10/downloadCollection    1.4 The client side cross site scripting web vulnerability can be exploited by remote attacker without privileged  application user account and  with medium or high required user interaction. For demonstration or reproduce ...  Client Side Cross Site Scripting - Exception Handling  PoC: http://137.168.0.10:15555/0/-x[CLIENT SIDE INJECTED SCRIPT CODE! XSS]  Manually steps to reproduce ...  1. Install the service application on your mobile ipad or iphone device 2. Start the software and open http://192.168.0.10:15555/ 3. Include the following path `0/-1` to provoke the an invalid application error (Example:  http://137.168.0.10:15555/0/-1) 4. The -1 will be displayed with the path in a script bound to the invalid value exception 5. Now, the attacker can include his script code and request the same script via GET again 6. The script will be executed on client side in the browser when processing to load the manipulated link 7. Successful reproduce ... done!  Reference(s): http://137.168.0.10:15555/0/ http://137.168.0.10:15555/1/ http://137.168.0.10:15555/2 http://137.168.0.10:15555/3/   Risk: ===== 1.1 The security risk of the file include web vulnerability is estimated as critical.  1.2 The security risk of the local command inject vulnerability via devicename is estimated as high(-).  1.3 The security risk of the persistent input validation web vulnerability is estimated as medium(+).  1.4 The security risk of the client side cross site scripting web vulnerability is estimated as low(+).   Credits: ======== Vulnerability Laboratory [Research Team]  -    Benjamin Kunz Mejri (bkm () vulnerability-lab com) Vulnerability Laboratory [Research Team]  -    Chokri Ben Achour (meister () vulnerability-lab com)   Disclaimer: =========== The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all  warranties,  either expressed or implied, including the warranties of merchantability and capability for a particular purpose.  Vulnerability- Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss  of business  profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such  damages. Some  states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing  limitation  may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack  into databases  or trade with fraud/stolen material.  Domains:    www.vulnerability-lab.com           - www.vuln-lab.com                             -  www.vulnerability-lab.com/register Contact:    admin () vulnerability-lab com      - support () vulnerability-lab com             - research ()  vulnerability-lab com Section:    video.vulnerability-lab.com         - forum.vulnerability-lab.com                  -  news.vulnerability-lab.com Social:     twitter.com/#!/vuln_lab             - facebook.com/VulnerabilityLab                -  youtube.com/user/vulnerability0lab Feeds:      vulnerability-lab.com/rss/rss.php   - vulnerability-lab.com/rss/rss_upcoming.php   -  vulnerability-lab.com/rss/rss_news.php  Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability  Laboratory.  Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the  use of other  media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode,  videos and  other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record,  list (feed),  modify, use or edit our material contact (admin () vulnerability-lab com or support () vulnerability-lab com) to get a  permission.                                          Copyright ? 2012 | Vulnerability Laboratory  --  VULNERABILITY RESEARCH LABORATORY LABORATORY RESEARCH TEAM CONTACT: research () vulnerability-lab com   _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
??By Date?? ????? ??By Thread??