Exploit-DB #31618
Description: jDisk (stickto) 2.0.3 iOS - Multiple Vulnerabilities
Type: webapps
Platform: ios
Date: 2014-02-12
Author: Vulnerability-Lab

Exploit:
Document Title:
===============
jDisk (stickto) v2.0.3 iOS - Multiple Web Vulnerabilities


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1196


Release Date:
=============
2014-02-12


Vulnerability Laboratory ID (VL-ID):
====================================
1196


Common Vulnerability Scoring System:
====================================
9.4


Product & Service Introduction:
===============================
jDisk turns your iPhone`iPad`iPod into a flash drive / disk. jDisk provides a purely web-based management UI, what you 
need do is visit it in your browser, no client installation is needed. What`s more, jDisk embeds a native file manager, 
you can organize your files/folders on your device directly, open files, edit them, preview them, etc. All in all, jDisk 
empowers your iPhone/iPad, make it work as a moving disk / flash drive.

(Copy of the Homepage: https://itunes.apple.com/de/app/jdisk-convert-your-device/id604793088 )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the official sticktos jDisk v2.0.3 iOS mobile web-application.


Vulnerability Disclosure Timeline:
==================================
2014-02-12:    Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Apple AppStore
Product: jDisk (stickto) iOS - Mobile Web Application 2.0.3


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Critical


Technical Details & Description:
================================
1.1
Multiple remote code execution web vulnerabilities has been discovered in the official sticktos jDisk v2.0.3 iOS mobile web-application.
The vulnerability allows remote attackers to execute unauthorized system specific codes or commands to compromise the affected system/service.

The vulnerabilities are located in the `New+ Text file` and `New+ Folder` function of the jdisk wifi application file manager web-interface. 
Remote attackers are able to inject own system specific codes by manipulation of the folder- & file name value in the add procedure. 
The code execution occurs in the main file dir index and sub category listing, the add new edit file but also in the the app status 
notification message context. The security risk of the remote code execution vulnerabilities in the add new folder- & text file function 
are estimated as critical with a cvss (common vulnerability scoring system) count of 9.4(+)|(-)9.5.

Exploitation of the code execution vulnerability requires no user interaction or privileged mobile web-application user account with password. 
Successful exploitation of the remote code execution vulnerabilities results in mobile application or connected device component compromise.

Request Method(s):
				[+] [POST]

Vulnerable Module(s):
				[+] New/Add Folder
				[+] New/Add Text File

Vulnerable Parameter(s):
				[+] folder name
				[+] text-file name

Affected Module(s):
				[+] Index & Sub Category - File Dir Listing
				[+] Notification Message
				[+] File Edit - Header


1.2
A directory-traversal web vulnerability has been discovered in the official sticktos jDisk v2.0.3 iOS mobile web-application.
The vulnerability allows remote attackers to unauthorized access system path variables or web-server data to compromise the application.

The local vulnerability is located in the `folderContent to folder` value of the mobile application. Remote attackers can exploit the bug 
by usage of a manipulated GET method request to unauthorized access app/device paths or folders. The local issue is a classic directory-traversal 
web vulnerability. The execution of the malicious dt string in the foldercontent to folder path request occurs in the context of the requested 
interface page itself. The security risk of the directory traversal web vulnerability is estimated as high(-) with a cvss (common vulnerability 
scoring system) count of 6.6(+)|(-)6.7.

Exploitation of the directory traversal web vulnerability requires no user interaction or privileged mobile web-application user account with password. 
Successful exploitation of the path traversal web vulnerability results in mobile application or connected device component compromise.

Request Method(s):
				[+] [GET]

Vulnerable Module(s):
				[+] __FD__?action

Vulnerable Parameter(s):
				[+] folderContent&folder=

Affected Module(s):
				[+] Index & Sub Category - File Dir Listing



1.3
A local file include web vulnerability has been discovered in the official sticktos jDisk v2.0.3 iOS mobile web-application.
The local file include web vulnerability allows remote attackers to unauthorized include local file/path requests or system 
specific path commands to compromise the web-application or mobile device.

The web vulnerability is located in the `file name` value of the `Upload > Uplaod Files` module POST method request. Remote attackers 
are able to inject own files with malicious filename to compromise the mobile application. The attack vector is persistent and the 
request method is POST. The local file/path include execution occcurs in the main file dir index- or sub category item listing of 
the file manager. The security risk of the local file include web vulnerability is estimated as high with a cvss (common vulnerability 
scoring system) count of 8.3(+)|(-)8.4.

Exploitation of the local file include web vulnerability requires no user interaction or privileged web-application user account 
with password. Successful exploitation of the local web vulnerability results in mobile application or connected device component 
compromise by unauthorized local file include web attacks.

Request Method(s):
				[+] [POST]

Vulnerable Input(s):
				[+]