Exploit-DB #30215
Description: Photo Video Album Transfer 1.0 iOS - Multiple Vulnerabilities
Type: webapps
Platform: ios
Date: 2013-12-11
Author: Vulnerability-Lab

Exploit:
Document Title:
===============
Photo Video Album Transfer 1.0 iOS - Multiple Vulnerabilities


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1166


Release Date:
=============
2013-12-10


Vulnerability Laboratory ID (VL-ID):
====================================
1166


Common Vulnerability Scoring System:
====================================
8.8


Product & Service Introduction:
===============================
Download the photos & videos from your iPhones Library to computer / PC;Upload photos & videos from your computer;
Transfer photos in full resolution in *.png, *.jpg, *.zip formats;No limit of the number, size or quality of the 
transferred photos;Photo Video Album Transfer is a multifunctional and easy-to-use app. It allows to transfer 
photos and videos from iPhone to iPhone, from iPhone to computer and reverse. Now you can easily manage your 
photo or video transfer and forget about cables, additional hardware and expensive programs. Transfer any number 
of photos and videos using this irreplaceable application for iPhone.

(Copy of the Homepage: https://itunes.apple.com/en/app/photo-video-album-transfer/id682294794 )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered multiple web vulnerabilities in the official Photo Video Album Transfer v1.0 mobile app for apple iOS.


Vulnerability Disclosure Timeline:
==================================
2013-12-09:    Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Apple AppStore
Product: Photo Video Album Transfer - Mobile Application (Igor Ciobanu) 1.0


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Critical


Technical Details & Description:
================================
1.1
A local file/path include web vulnerability has been discovered in the official Photo Video Album Transfer v1.0 mobile app for apple iOS.
The file include vulnerability allows remote attackers to include (upload) local file or path requests to compromise the application or service.

The remote file include web vulnerability is located in the vulnerable filename value of the iOS Transfer Utility (web interface) module. 
Remote attackers can manipulate the filename value in the POST method request of the browse file upload form to cpmpromise the mobile app.
Remote attackers are able to include own local files by usage of the browse file upload module. The attack vecotor is persistent and the 
request method is POST. The file include execute occcurs in the main file dir index list were the filenames are visible listed. The security 
risk of the local file include web vulnerability is estimated as high(+) with a cvss (common vulnerability scoring system) count of 8.8(+).

Exploitation of the local file include web vulnerability requires no user interaction or privileged web-application user account with password. 
Successful exploitation of the vulnerability results in unauthorized local file uploads and path requests to compromise the device or mobile app.

Request Method(s):
				[+] [POST]

Vulnerable Module(s):
				[+] Browse File Upload - File send & arrival (web interface)

Vulnerable Parameter(s):
				[+] filename

Affected Module(s):
				[+] Index File Dir Listing (http://localhost:8080)



1.2
An arbitrary file upload web vulnerability has been discovered in the official Print n Share v5.5 mobile application for apple iOS.
The arbitrary file upload issue allows remote attackers to upload files with multiple extensions to bypass the web-server or system validation.

The vulnerability is located in the upload file module. Remote attackers are able to upload a php or js web-shells by renaming the file with 
multiple extensions to bypass the file restriction mechanism. The attacker uploads for example a web-shell with the following name and extension 
`image.jpg.gif.js.php.jpg`. After the upload the attacker needs to open the file in the web application. He deletes the .jpg & . gif file 
extension and can access the application with elevated access rights. The security risk of the arbitrary file upload web vulnerability is 
estimated as high with a cvss (common vulnerability scoring system) count of 6.7(+).

Exploitation of the arbitrary file upload web vulnerability requires no user interaction or privilege application user account with password.
Successful exploitation of the vulnerability results in unauthorized file access because of a compromise after the upload of web-shells.


Request Method(s):
				[+] [POST]

Vulnerable Module(s):
				[+] Browse File Upload - File send & arrival (web interface)

Vulnerable Parameter(s):
				[+] filename (multiple extensions)

Affected Module(s):
				[+] Index File Dir Listing (http://localhost:8080)



Proof of Concept (PoC):
=======================
1.1
The local file include web vulnerability in the file name can be exploited by remote attackers without user interaction or privileged mobile
web-application user account. For security demonstration or to reproduce the vulnerability follow the provided steps and information below.

Module:	Upload
Input: 	Browse File
Method:	POST


Manual stepst to reproduce the vulnerability ... 

1. Install and start the vulnerable mobile application
2. Open the web-server wifi transfer (localhost:8080)
Note: Start to tamper the browser (http) request and response session of the next POST Request 
3. Click the browse file to upload button and choose a random file of your local hd
4. Change in the POST method request of the upload the filename value and inject your own webshell, remote- or local file
5. The execute after the inject occurs in the main index file dir listing of the iOS Transfer Utility
6. Succ