BugTraq
iVault Private P&V 1.1 iOS - Path Traversal Vulnerability Apr 10 2014 11:57AM
Vulnerability Lab (research vulnerability-lab com)
Document Title:
===============
iVault Private P&V 1.1 iOS - Path Traversal Vulnerability

References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1253

Release Date:
=============
2014-04-09

Vulnerability Laboratory ID (VL-ID):
====================================
1253

Common Vulnerability Scoring System:
====================================
6.8

Product & Service Introduction:
===============================
The BEST and MOST convenient private Photo&Video App! It provides multiple security mechanisms, and perfectly keeps your privacy
away from peeping eyes. First, you need to add your â??SPECIALâ?? photos&videos into iVault, it provides many convenient features.
Second, you may concern about the security things. Third, iVault can provide more than you can imagine.

(Copy of the Homepage: https://itunes.apple.com/us/app/ivault-private-photo.s-video.s/id7801241
44 )

Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the official iVault Private Photos & Videos v1.1 iOS mobile application.

Vulnerability Disclosure Timeline:
==================================
2014-04-09: Public Disclosure (Vulnerability Laboratory)

Discovery Status:
=================
Published

Affected Product(s):
====================
Arvin Brook
Product: iVault - Private Photos & Videos Vault + Secrets Folders Manager 1.1

Exploitation Technique:
=======================
Remote

Severity Level:
===============
High

Technical Details & Description:
================================
The application-side path/directory traversal web vulnerability has been discovered in the official iVault Private Photos & Videos v1.1 iOS mobile application.
The vulnerability allows an local attacker to unauthorized access path- or directories values to leak information or compromise the mobile application privacy.

The first vulnerability is located in the `path & directory` value of the wifi web-access module. Remote attackers are able to request the via vulnerable path
value any application content even if protected. The attackers are able to include local frames as path value to request an internal application path to
unauthorized access stored private images/files. The issue can be combined with script-code attacks but is not limited to the condition only. The attack vector
is located on the application-side and the method to include the malicious path value request is a sync (device). The security risk of the
directory traversal vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 6.8(+)|(-)6.9.

Exploitation of the local `path & directory` vulnerability requires a low privileged device user account with physical device access and without user interaction.
Successful exploitation of the vulnerability results in unauthorized picture or file access, information disclosure and further application-side attacks.

Vulnerable Input(s):
[+] Path

Vulnerable Module(s):
[+] Directory

Vulnerable Parameter(s):
[+] Oberverzeichnis > aktuell:(x)

Affected Module(s):
[+] Path Dir Listing (each WiFi web access side)

Proof of Concept (PoC):
=======================
The application-side vulnerability can be exploited by local attackers with physical device access and low privileged user account.
User interaction is not required. For security demonstration or to reproduce the vulnerability follow the provided information
and steps below to continue.

PoC: Source

<script language="javascript">
var currentFolderPath = '/"<../../var/mobile/Applications[PATH/DIRECTORY TRAVERSAL VULNERABILITY!]';
var alertMessage = "%%ALERT_MESSAGE%%";
var actionType = "Show";
var submitting = false;
var tipHiddenTop = -200;
var tipShownTop = -80;
var lastShownTipDate;

var maxNumberOfImageCurrentEvent = 48;
var maxNumberOfVideoCurrentEvent = 5;
var limitationMsg = "Die Anzahl deiner Dokumente hat schon an der Grenze der freien Edition (maximal 50 Bilder oder Fotos, 5 Videos) erreicht.
Möchtest du nicht eine volle Edition bekommen und damit alle Einschränkungen weglassen? No thanks ;) -bkm";

var videoTypes = ["MOV", "MP4", "MPV", "M4V"];

function tippable() {
var currentTop = document.getElementById("tip").style.top;
currentTop = currentTop.substring(0, currentTop.length-2);
currentTop = Number(currentTop);

var not = ((currentTop > tipHiddenTop) && (currentTop < tipShownTop))
return !not;

PoC: Execution

<div id="content" onselectstart="return false;">
<a href="/logout.html" style="float:right; margin:10px;">outloggen</a>

<h1 style="padding:0 15px 0">WiFi web access</h1>
<div id="buttons" style="position:relative; left:10px; height:60px; padding-top:10x;">

<a href="/back.html" style="text-decoration:none; top:0; left:0;"><img src="/Web/back2.png" style="width:30px; height:30px;
border:none; margin:-9px 6px;">Oberverzeichnis [aktuell:/>"<../../var/mobile/Applications[PATH/DIRECTORY TRAVERSAL VULNERABILITY!]>]</a>

Reference(s):
http://localhost:9900/

Solution - Fix & Patch:
=======================
The vulnerability can be patched by a secure restriction and filter process of the `path` and `directory` value request.
Parse and encode also the vulnerable `Oberverzeichnis > aktuell:(x)` output values on each wifi web access page to prevent directory traversal attacks.

Security Risk:
==============
The security risk of the local directory/path traversal web vulnerability is estimated as high(-).

Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm (at) evolution-sec (dot) com [email concealed]) [www.vulnerability-lab.com]

Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
or trade with fraud/stolen material.

Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
Contact: admin (at) vulnerability-lab (dot) com [email concealed] - research (at) vulnerability-lab (dot) com [email concealed] - admin (at) evolution-sec (dot) com [email concealed]
Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
modify, use or edit our material contact (admin (at) vulnerability-lab (dot) com [email concealed] or research (at) vulnerability-lab (dot) com [email concealed]) to get a permission.

Copyright © 2014 | Vulnerability Laboratory [Evolution Security]

--
VULNERABILITY LABORATORY RESEARCH TEAM
DOMAIN: www.vulnerability-lab.com
CONTACT: research (at) vulnerability-lab (dot) com [email concealed]

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus