Document Title:
===============
Files Document & PDF 2.0.2 iOS - Multiple Vulnerabilities
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1341
Release Date:
=============
2014-10-14
Vulnerability Laboratory ID (VL-ID):
====================================
1341
Common Vulnerability Scoring System:
====================================
8.7
Product & Service Introduction:
===============================
Store and view your documents, transferring them easily from any Mac or PC. High quality viewers, including support for PDF,
Office, iWork & images. Full integration with Box, Dropbox, Google Drive & OneDrive [Pro feature]. Play music; watch movies;
access your cloud storage or download from the internet.
(Copy of the Vendor Homepage: https://itunes.apple.com/us/app/files-document-pdf-reader/id294150896 )
Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the official Files Document & PDF Reader 2.0.2 iOS mobile application.
Vulnerability Disclosure Timeline:
==================================
2014-10-14: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
Olive Toast Software Ltd.
Product: Files Document & PDF Reader - iOS Mobile WebDav Application (Wifi) 2.0.2
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Critical
Technical Details & Description:
================================
1.1
A code execution web vulnerability has been discovered in the official Files Document & PDF Reader 2.0.2 iOS mobile application.
The issue allows an attacker to compromise the application and connected device components by exploitation of system specific
code execution vulnerability in the webdisk interface.
The vulnerability is located in the MKCOL request of the `Ordner Erstellen` input module. The main web-dav index provides a function to add folder as
path through a regular input form form which is not correctly encoding the input. Own malicious context can be injected to the add folder function and
the results is the application-side execution of system specific malicious codes. The input field of the upload modules executes the input wrong encoded
via POST method request as filename value. Remote attackers are also able to execute own malicious codes by usage of a script code payload in combination
with the affected values. The execution of the code occurs in the main web-dav file dir web listing context. The attack vector is located on application-side
and the request method to attack the service is MKCOL.
The security risk of the remote code execution web vulnerability is estimated as critical with a cvss (common vulnerability scoring system) count of 8.6
Exploitation of the remote code execution web vulnerability requires no privileged application user account (passwd default blank) or user interaction.
Successful exploitation of the code execution vulnerability results in mobile application compromise and connected or affected device component compromise.
Vulnerable Method(s):
[+] MKCOL
Vulnerable Module(s):
[+] Ordner Erstellen (Folder Add)
Vulnerable Parameter(s):
[+] ot_notification
Affected Module(s):
[+] Web Dav - Interface Path Dir Listing
1.2
A local file include web vulnerability has been discovered in the official Files Document & PDF Reader 2.0.2 iOS mobile application.
The local file include web vulnerability allows remote attackers to unauthorized include local file/path requests or system specific
path commands to compromise the mobile web-application.
The web vulnerability is located in the `filename` values of the `rename` input. Remote attackers are able to inject own files with malicious
`filename` values in the `Move` request to compromise the mobile web-application. The attacker is able to inject the local file include requests
by usage of the `wifi interface` in connection with the vulnerable create to add request. The local file/path include execution occcurs in the web
dav file dir listing.
Remote attackers are also able to exploit the filename validation issue in combination with persistent injected script codes to execute different
local malicious attacks requests. The attack vector is on the application-side of the file wifi mobile app.
The security risk of the local file include web vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 7.1.
Exploitation of the file include web vulnerability requires no user interaction or privileged web-application user account. Successful exploitation
of the local file include web vulnerability results in mobile application or connected device component compromise.
Vulnerable Method(s):
[+] [Created]
Vulnerable Module(s):
[+] Rename
Vulnerable Parameter(s):
[+] filename
Affected Module(s):
[+] Web Dav - Interface File Dir Listing
1.3
A local command/path injection web vulnerability has been discovered in the official Files Document & PDF Reader 2.0.2 iOS mobile application.
The remote web vulnerability allows to inject local commands via vulnerable system values to compromise the apple iOS mobile web-application.
The vulnerability is located in the in the device name value of the web dav index header context module. Local attackers are able to inject own
script codes by changing the local iOS devicename to malicious context with special chars. The execute of the injected script code occurs with
persistent attack vector in the header section of the wifi web-interface.
The security risk of the command/path inject vulnerabilities are estimated as medium with a cvss (common vulnerability scoring system) count of 5.2.
Exploitation of the command/path inject vulnerability requires a local low privileged iOS device account with restricted access and no user interaction.
Successful exploitation of the vulnerability results in unauthorized execute of system specific commands or unauthorized path requests.
Request Method(s):
[+] [GET]
Vulnerable Parameter(s):
[+] devicename
Affected Module(s):
[+] Web Dav - Web Interface Wifi [Application Header Context]
Proof of Concept (PoC):
=======================
1.1
The local command inject web vulnerability can be exploited by local attackers with physcial device access by low privileged accounts and without user interaction.
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.
PoC: Web Dav Server - Interface Index
Files - bkm337"><[LOCAL COMMAND INJECT VULNERABILITY VIA DEVICE NAME VALUE!]>
1.2
The code execution vulnerability can be exploited by remote attackers without privileged application user account and also without user interaction.
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.
PoC: ot_notification name > Ordner Erstellen
Auswählen: Alle|Keine
Neu laden
Erstellen von '"><[PERSISTENT INJECTED SCRIPT CODE VIA FOLDERNAME!]">' fehlgeschlagen
--- PoC Session Logs [MKCOL] ---
Status: 200[OK]
MKCOL http://localhost:8080/Documents/%22%3E%3C-[CODE EXECUTION VULNERABILITY VIA FOLDERNAME VALUE!]; Load Flags[LOAD_BACKGROUND ] Größe des Inhalts[unknown] Mime Type[unknown]
Request Header:
Host[localhost]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[de,en-US;q=0.7,en;q=0.3]
Accept-Encoding[gzip, deflate]
X-Requested-With[XMLHttpRequest]
Referer[http://localhost/Documents/]
Content-Length[0]
Content-Type[text/plain; charset=UTF-8]
Cookie[otsessionid=; otsessionid=]
Status: 200[OK]
MKCOL http://localhost:8080/Documents/-[CODE EXECUTION VULNERABILITY VIA FOLDERNAME VALUE!]; Load Flags[LOAD_DOCUMENT_URI ] Größe des Inhalts[unknown] Mime Type[unknown]
Request Header:
Host[localhost]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[de,en-US;q=0.7,en;q=0.3]
Accept-Encoding[gzip, deflate]
Referer[http://localhost/Documents/]
Cookie[otsessionid=; otsessionid=]
1.3
The local file include web vulnerability can be exploited by local attackers without privileged application user account and without user interaction.
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.
PoC: localhost:8080/Documents/ - Web Dav via Rename function