Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Remote File Manager v1.2 iOS - Multiple Web Vulnerabilities
From: Vulnerability Lab <research () vulnerability-lab com>
Date: Wed, 06 Mar 2013 01:55:02 +0100

Title:
======
Remote File Manager v1.2 iOS - Multiple Web Vulnerabilities


Date:
=====
2013-02-23


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=882


VL-ID:
=====
882


Common Vulnerability Scoring System:
====================================
6.1


Introduction:
=============
Catch documents from PC or Mac via USB cable or WIFI, email attachments, Dropbox and FTP and save it on your iPhone, 
iPod Touch or iPad locally. 

File transfer
- Use iTunes file sharing to transfer files directly to your device via USB cable and WIFI.
- Access, view documents and upload from/to Google and Dropbox
- Download and upload document via FTP
- Sync your documents using iCloud

File Manager Features:
- Built-in viewer supports PDF, MS Office (Word, Excel and Powerpoint) & Apple iWork (Keynote, Pages and Numbers) 
files, HTML, RTF, TXT, PNG, JPG, GIF
- Zip and unzip files
- Create folders and sub folders
- Move files from one folder to another
- Send your files to / Open your files in other apps, e.g. pages, numbers, etc.
- Save files from emails using the open in feature
- TV / VGA out
- Print documents from Document Manager on iOS 4.2 or later
- Email files to Your Colleagues or Friends directly from File Manager App.
- Transfer files to iPhone, iPod or iPad
- Zoom PDFs and other documents

File Manger supports PDF, MS Office, iWorks and the most common file types. The new iCloud module and sync is also 
enabled and an very 
useful ability for the applicaiton.

(Copy of the Vendor Homepage:  https://itunes.apple.com/us/app/file-manager/id550412070 )


Abstract:
=========
The Vulnerability Laboratory Research Team discovered a file include web vulnerability in the mobile Remote File 
Manager v1.2 app for the apple ipad & iphone.


Report-Timeline:
================
2013-02-20:     Public Disclosure


Status:
========
Published


Affected Products:
==================
Apple
Product: Remote File Manager 1.2


Exploitation-Technique:
=======================
Remote


Severity:
=========
Critical


Details:
========
1.1
A local file include web vulnerability via POST request method is detected in the mobile Remote File Manager v1.2 app 
for the apple ipad & iphone.
The vulnerability allows remote attackers via POST method to inject local app webserver folders to request unauthorized 
local webserver files.

The vulnerbility is located in the upload file module of the webserver (http://192.168.0.10:63114/) when processing to 
request a manipulated 
filename via POST. The execution of the vulnerable values as filename will occur when the attacker is processing to 
watch the file dir listing 
in the main index site.

Exploitation of the vulnerability requires no user interaction and can be done without privileged application user 
account (no password standard).
Successful exploitation of the vulnerability results in unauthorized path or file access via local file or path include 
attack.

Vulnerable Application(s):
                                [+] Remote File Manager v1.2 - ITunes or AppStore (Apple)

Vulnerable Module(s):
                                [+] File Upload  (Web Server) [Remote]

Vulnerable Parameter(s):
                                [+] filename

Affected Module(s):
                                [+] File - Index Dir Listing



1.2
A persistent input validation vulnerability is detected in the mobile Remote File Manager v1.2 app for the apple ipad & 
iphone.
The bug allows an attacker (remote) to implement/inject malicious script code on the application side (persistent) of 
the app web service. 

The vulnerability is located in the index file dir listing module of the webserver (http://192.168.0.10:63114/) when 
processing to display
injected and via POST request method manipulated filenames. The persistent script code will be executed out of the main 
index file dir 
listing module when the service is processing to list the new malicious injected filename as item.

Exploitation of the persistent web vulnerability requires low or medium user interaction without privileged application 
user account.
Successful exploitation of the vulnerability can lead to persistent session hijacking (customers), account steal via 
persistent web 
attacks, persistent phishing or stable (persistent) certificate mail notification context manipulation.

Vulnerable Application(s):
                                [+] Remote File Manager v1.2 - ITunes or AppStore (Apple)

Vulnerable Module(s):
                                [+] File Upload  (Web Server) [Remote]

Vulnerable Parameter(s):
                                [+] filename

Affected Module(s):
                                [+] Filename - Index File Dir Listing


Proof of Concept:
=================
1.1
The file include web vulnerability can be exploited by remote attackers without application user account and also 
without user interaction.
For demonstration or reproduce ...


POSTDATA =-----------------------------246901308427809
Content-Disposition: form-data; name="file"; filename="[../../>[UNAUTHORIZED LOCAL FILE/PATH INCLUDE 
VULNERABILITY]].png"
Content-Type: image/png
ÿØÿà


Review: Index File Dir Listing - Filename

<div id="bodyspace"><div id="main_menu"><h1>File Manager</h1></div><div id="main_left">
<img src="http://www.iusbdisk.com/images/wifilogo2.png"; alt="" title="" border="0"><ul class="menu"><li class="item-101 
current active">
<a href="http://filemanager.ezypages.com.au/"; target="_blank">Hilfe</a></li><li class="item-110">
<a href="http://filemanager.ezypages.com.au/index.php/feedback-support"; target="_blank">Kontakt / 
Feedback</a></li></ul></div>
<div id="module_main"><bq>Files</bq><p><a href="..">..</a><br>
<a href="1234.png.txt.iso.php.asp">1234.png.txt.iso.php.asp</a>         (    95.8 Kb, 2013-02-11 07:41:12 +0000)<br>
<a href="[../../>[UNAUTHORIZED LOCAL FILE/PATH INCLUDE VULNERABILITY]]">[../../>[UNAUTHORIZED LOCAL FILE/PATH INCLUDE 
VULNERABILITY]]</a>
(    27.3 Kb, 2013-02-11 07:45:01 +0000)<br />
<a href="About/">About/</a>             (     0.1 Kb, 2012-10-10 18:20:14 +0000)<br />
</p><form action="" method="post" enctype="multipart/form-data" name="form1" id="form1"><label>upload file
<input type="file" name="file" id="file" /></label><label><input type="submit" name="button" id="button" value="Submit" 
/>
</label></form></div></center></body></html></iframe></a></p></div></div>



1.2
The persistent script code inject web vulnerability via POST can be exploited by remote attackers without privileged 
application user account 
and with low or medium required user interaction. For demonstration or reproduce ...


Review: Index File Dir Listing - Filename

<div id="bodyspace"><div id="main_menu"><h1>File Manager</h1></div><div id="main_left">
<img src="http://www.iusbdisk.com/images/wifilogo2.png"; alt="" title="" border="0"><ul class="menu"><li class="item-101 
current active">
<a href="http://filemanager.ezypages.com.au/"; target="_blank">Hilfe</a></li><li class="item-110">
<a href="http://filemanager.ezypages.com.au/index.php/feedback-support"; target="_blank">Kontakt / 
Feedback</a></li></ul></div>
<div id="module_main"><bq>Files</bq><p><a href="..">..</a><br>
<a href="[PERSISTENT INJECTED SCRIPT CODE!].png.txt.iso.php.asp">[PERSISTENT INJECTED SCRIPT 
CODE!].png.txt.iso.php.asp</a>
(    95.8 Kb, 2013-02-11 07:41:12 +0000)<br>
<a href="[PERSISTENT INJECTED SCRIPT CODE!]">[PERSISTENT INJECTED SCRIPT CODE!]</a>
(    27.3 Kb, 2013-02-11 07:45:01 +0000)<br />
<a href="About/">About/</a>             (     0.1 Kb, 2012-10-10 18:20:14 +0000)<br />
</p><form action="" method="post" enctype="multipart/form-data" name="form1" id="form1"><label>upload file
<input type="file" name="file" id="file" /></label><label><input type="submit" name="button" id="button" value="Submit" 
/>
</label></form></div></center></body></html></iframe></a></p></div></div>


Risk:
=====
1.1
The security risk of the local file/path include web vulnerability via POST request method is estimated as high(+).

1.2
The security risk of the persistent input validation web vulnerability via POST request method is estimated as 
medium(+).


Credits:
========
Vulnerability Laboratory [Research Team]  -    Benjamin Kunz Mejri (bkm () vulnerability-lab com)


Disclaimer:
===========
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all 
warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. 
Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss 
of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such 
damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing 
limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack 
into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com           - www.vuln-lab.com                             - 
www.vulnerability-lab.com/register
Contact:    admin () vulnerability-lab com      - support () vulnerability-lab com             - research () 
vulnerability-lab com
Section:    video.vulnerability-lab.com         - forum.vulnerability-lab.com                  - 
news.vulnerability-lab.com
Social:     twitter.com/#!/vuln_lab             - facebook.com/VulnerabilityLab                - 
youtube.com/user/vulnerability0lab
Feeds:      vulnerability-lab.com/rss/rss.php   - vulnerability-lab.com/rss/rss_upcoming.php   - 
vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability 
Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the 
use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, 
videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, 
list (feed), 
modify, use or edit our material contact (admin () vulnerability-lab com or support () vulnerability-lab com) to get a 
permission.

                                        Copyright © 2013 | Vulnerability Laboratory



-- 
VULNERABILITY RESEARCH LABORATORY
LABORATORY RESEARCH TEAM
CONTACT: research () vulnerability-lab com


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
  • Remote File Manager v1.2 iOS - Multiple Web Vulnerabilities Vulnerability Lab (Mar 06)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]