Exploit-DB #28975
Description: My File Explorer 1.3.1 iOS - Multiple Web Vulnerabilities
Type: webapps
Platform: ios
Date: 2013-10-15
Author: Vulnerability-Lab

Exploit:
Document Title:
===============
My File Explorer v1.3.1 iOS - Multiple Web Vulnerabilities


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1107


Release Date:
=============
2013-10-09


Vulnerability Laboratory ID (VL-ID):
====================================
1107


Common Vulnerability Scoring System:
====================================
6.6


Product & Service Introduction:
===============================
My File Explorer lets you easily view, manage and store files on your iPhone, iPad, iPad mini or iPod touch. 
You can also easily transfer your Photos from your device to your PC/MAC via Wi-Fi Transfer option. 
You don`t need iTunes anymore by using the mobile application.

Key Features:
- Store, view or manage any documents on your iPhone, iPad or iPod Touch
- Direct access to Photo Library from a PC or Mac via Wi-Fi and batch photo download.
- Upload pictures from your PC to your photo library via Wi-Fi.
- Easy file transfer via Wi-Fi (Browser or FTP), Bluetooth or iTunes File Sharing
- Voice Record
- In App File Name Search
- In App Browser Support for Internet Downloads
- Copy, paste, move, delete and create text files.
- Simple and Advanced PDF Reader
- Email your files.
- Backup & Email in app notes easily.
- Open email attachments.
- Zip, unzip and unrar support. Also supports password protected zip and rar files.
- Dropbox integration
- Passcode protected folders
- Universal (iPhone & iPad support)
- Several file listing and sorting options

Supported File Formats:
- Plain Text Files
- Zip and Rar files
- Audio (WAV, MP3, M4A, ...)
- Images (JPG, PNG, GIF, ...)
- Movies (MP4, MOV, ...)
- iWorks (Pages, numbers, and Keynote)
- Microsoft Office (Word, Excel and PowerPoint)
- RTF (Rich Text Format)
- PDF Documents
- HTML web pages.

( Copy of the Homepage: https://itunes.apple.com/de/app/my-file-explorer/id571929068 )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered multiple web vulnerabilities in the My File Explorer v1.3.1 iOS mobile web-application.



Vulnerability Disclosure Timeline:
==================================
2013-10-09:    Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Apple
Product: My File Explorer - Mobile Web Application 1.3.1


Exploitation Technique:
=======================
Remote


Severity Level:
===============
High


Technical Details & Description:
================================
1.1
A local command/path injection web vulnerability is detected  in the My File Explorer v1.3.1 iOS mobile application (Apple iOS - iPad & iPhone).
The local vulnerability allows to inject local commands by using system setting values to compromise the apple mobile iOS web-application.

The application vulnerability is located in the index file dir listing module when processing to request a manipulated iPad or iPhone deviceName.
Local attackers can change the name of the apple device to inject the own code to request any local path or inject commands on application-side.
The malicious code is executed from either attacker or by a user when calling the web-page.

Exploitation of the web vulnerability requires a local privileged iOS device account with restricted access and no user interaction.
Successful exploitation of the vulnerability results unauthorized execution of system specific commands and path requests.


Vulnerable Parameter(s):
				[+] deviceName

Affected Module(s):
				[+] Index File Dir List
				[+] Sub Category List




1.2
A local path traversal and file include vulnerability is detected in the My File Explorer v1.3.1 iOS mobile application (Apple iOS - iPad & iPhone).
The path traversal allows remote attackers to unauthorized switch or access folder to access application, device or system information.

The web vulnerability allows to bypass the regular path to folder generate by exploitation of the `Create Directory` function. The remote attacker 
can create a directory by using a manipulated second path with a frame to load. The vulnerability can be exploited by requesting the mobile 
application with a manipulated path value and the same op parameter. The redirect will load the wrong path value and redirect the user to the local 
mobile application or device system path.

Exploitation of the path/directory web vulnerability requires no user interaction and non privileged mobile web.application user account.
Successful exploitation of the vulnerability results in the unauthorized access of remote users to local application path or system/device files.


Vulnerable Module(s):
				[+] Create Directory (Add Folder)

Vulnerable Parameter(s):
				[+] name
				[+] path



Proof of Concept (PoC):
=======================
1.1
The local command inject web vulnerability via device name can be exploited by remote attackers with physical device access and 
low user interaction. For demonstration or reproduce ...

1. Start the iphone or ipad device with iOS
2. Install the my file explorer mobile web application
3. Open in the iphone or ipad settings menu the device name information box
4. Change the device name to your malicious script code or payload with a path/folder command
5. Close the settings menu with a save and open the already downloaded mobile application
6. Open the wifi settings and click to share to open the web-server
7. After the web server is started we open the index file listing in our web-browser by using your local ip + port 8080
8. Click to the index and to the sub categories, the test code will be executed persistent in all websites of the mobile app
9. Successful reproduced!


PoC:  deviceName

<div class="deviceName">
        >"<[LOCAL COMMAND/PATH INJECT VULNERABILITY!]><div style