Document Title:
===============
My File Explorer v1.3.1 iOS - Multiple Web Vulnerabilities
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1107
Release Date:
=============
2013-10-09
Vulnerability Laboratory ID (VL-ID):
====================================
1107
Common Vulnerability Scoring System:
====================================
6.6
Product & Service Introduction:
===============================
My File Explorer lets you easily view, manage and store files on your iPhone, iPad, iPad mini or iPod touch.
You can also easily transfer your Photos from your device to your PC/MAC via Wi-Fi Transfer option.
You don`t need iTunes anymore by using the mobile application.
Key Features:
- Store, view or manage any documents on your iPhone, iPad or iPod Touch
- Direct access to Photo Library from a PC or Mac via Wi-Fi and batch photo download.
- Upload pictures from your PC to your photo library via Wi-Fi.
- Easy file transfer via Wi-Fi (Browser or FTP), Bluetooth or iTunes File Sharing
- Voice Record
- In App File Name Search
- In App Browser Support for Internet Downloads
- Copy, paste, move, delete and create text files.
- Simple and Advanced PDF Reader
- Email your files.
- Backup & Email in app notes easily.
- Open email attachments.
- Zip, unzip and unrar support. Also supports password protected zip and rar files.
- Dropbox integration
- Passcode protected folders
- Universal (iPhone & iPad support)
- Several file listing and sorting options
Supported File Formats:
- Plain Text Files
- Zip and Rar files
- Audio (WAV, MP3, M4A, ...)
- Images (JPG, PNG, GIF, ...)
- Movies (MP4, MOV, ...)
- iWorks (Pages, numbers, and Keynote)
- Microsoft Office (Word, Excel and PowerPoint)
- RTF (Rich Text Format)
- PDF Documents
- HTML web pages.
( Copy of the Homepage: https://itunes.apple.com/de/app/my-file-explorer/id571929068 )
Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered multiple web vulnerabilities in the My File Explorer v1.3.1 iOS mobile web-application.
Vulnerability Disclosure Timeline:
==================================
2013-10-09: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
Apple
Product: My File Explorer - Mobile Web Application 1.3.1
Exploitation Technique:
=======================
Remote
Severity Level:
===============
High
Technical Details & Description:
================================
1.1
A local command/path injection web vulnerability is detected in the My File Explorer v1.3.1 iOS mobile application (Apple iOS - iPad & iPhone).
The local vulnerability allows to inject local commands by using system setting values to compromise the apple mobile iOS web-application.
The application vulnerability is located in the index file dir listing module when processing to request a manipulated iPad or iPhone deviceName.
Local attackers can change the name of the apple device to inject the own code to request any local path or inject commands on application-side.
The malicious code is executed from either attacker or by a user when calling the web-page.
Exploitation of the web vulnerability requires a local privileged iOS device account with restricted access and no user interaction.
Successful exploitation of the vulnerability results unauthorized execution of system specific commands and path requests.
Vulnerable Parameter(s):
[+] deviceName
Affected Module(s):
[+] Index File Dir List
[+] Sub Category List
1.2
A local path traversal and file include vulnerability is detected in the My File Explorer v1.3.1 iOS mobile application (Apple iOS - iPad & iPhone).
The path traversal allows remote attackers to unauthorized switch or access folder to access application, device or system information.
The web vulnerability allows to bypass the regular path to folder generate by exploitation of the `Create Directory` function. The remote attacker
can create a directory by using a manipulated second path with a frame to load. The vulnerability can be exploited by requesting the mobile
application with a manipulated path value and the same op parameter. The redirect will load the wrong path value and redirect the user to the local
mobile application or device system path.
Exploitation of the path/directory web vulnerability requires no user interaction and non privileged mobile web.application user account.
Successful exploitation of the vulnerability results in the unauthorized access of remote users to local application path or system/device files.
Vulnerable Module(s):
[+] Create Directory (Add Folder)
Vulnerable Parameter(s):
[+] name
[+] path
Proof of Concept (PoC):
=======================
1.1
The local command inject web vulnerability via device name can be exploited by remote attackers with physical device access and
low user interaction. For demonstration or reproduce ...
1. Start the iphone or ipad device with iOS
2. Install the my file explorer mobile web application
3. Open in the iphone or ipad settings menu the device name information box
4. Change the device name to your malicious script code or payload with a path/folder command
5. Close the settings menu with a save and open the already downloaded mobile application
6. Open the wifi settings and click to share to open the web-server
7. After the web server is started we open the index file listing in our web-browser by using your local ip + port 8080
8. Click to the index and to the sub categories, the test code will be executed persistent in all websites of the mobile app
9. Successful reproduced!
PoC: deviceName
>"<[LOCAL COMMAND/PATH INJECT VULNERABILITY!]>
Root
1.2
The path traversal and local path inject web vulnerability can be exploited by remote attackers without privileged application user account
and also without user interaction. For demonstration or reproduce ...
PoC: Example
http://localhost:8080/?path=/[FOLDER A]/[FRAME TO PATH B]/&op=[PATH B]
PoC:
http://localhost:8080/?path=/PENTEST-A/%3Cx%20src=%3Cx%20src=b%3E>/&op=%3Cix%20src=b%3E
Note: By requesting a regular folder with a manipulated second path value to the vulnerable op parameter its possible to exploit the vulnerability.
The second path needs to match with the op parameter value to request the path from the second location.
Review: Source (Vulnerable %% )