Exploit-DB #27655
Description: Copy to WebDAV 1.1 iOS - Multiple Vulnerabilities
Type: webapps
Platform: ios
Date: 2013-08-17
Author: Vulnerability-Lab

Exploit:
Title:
======
Copy to WebDAV v1.1 iOS - Multiple Web Vulnerabilities


Date:
=====
2013-08-08


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=1044


VL-ID:
=====
1044


Common Vulnerability Scoring System:
====================================
8.9


Introduction:
=============
Copy to WebDAV is designed for use with iWork`s app, which allows you get document from your Keynote, Numbers and Pages 
apps on your iPhone, iPad or iPod Touch, then you can read, edit and share with other more professional apps.

Copy to WebDAV is running as an local WebDAV and HTTTP Server for iPhone / iPad, it lets you upload / download documents 
to this virtual server directly by any web browser(IE, Safari, Firefox…) or webdav client from Mac / PC, such as Cyberduck. 
However, your safari, some webdav client iPhone / iPad apps can find this virtual server too. 

(Copy of the Homepage: https://itunes.apple.com/de/app/copy-to-webdav-virtual-webdav/id505898859 )


Abstract:
=========
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the Copy to WebDAV v1.1 application (Apple iOS - iPad & iPhone).


Report-Timeline:
================
2013-08-08:    Public Disclosure (Vulnerability Laboratory)


Status:
========
Published


Affected Products:
==================
Apple AppStore
Product: Copy to WebDAV - Mobile Application 1.1


Exploitation-Technique:
=======================
Remote


Severity:
=========
Critical


Details:
========
1.1
A file include web vulnerability is detected in the Copy to WebDAV v1.1 mobile application (Apple iOS - iPad & iPhone).
The file include vulnerability allows remote attackers to include (upload) local file or path requests to compromise the application or service.

The vulnerability is located in the upload module when processing to upload files with manipulated filename value in the POST method request.
The attacker can inject local files or path to request own context and compromise the mobile device. The validation has a bad side effect 
which impacts the risk to combine the attack with persistent injected script code.

Exploitation of the local file include web vulnerability requires no user interaction or privilege application user account with password. 
Successful exploitation of the vulnerability results in unauthorized local file and path requests to compromise the device or application.

Vulnerable Application(s):
				[+] Copy to WebDAV v1.1 - ITunes or AppStore (Apple)

Vulnerable Module(s):
				[+] Upload (Files) - (http://localhost:8080)

Vulnerable Parameter(s):
				[+] filename 

Affected Module(s):
				[+] Index File Dir Listing



1.2
An arbitrary file upload web vulnerability is detected in the Copy to WebDAV v1.1 mobile application (Apple iOS - iPad & iPhone).
The arbitrary file upload issue allows a remote attacker to upload files with multiple extensions to bypass the validation for unauthorized access.

The vulnerability is located in the upload module when processing to upload files with multiple ending extensions. Attackers are able to upload 
a php or js web-shells by renaming the file with multiple extensions. The attacker uploads for example a web-shell with the following name and 
extension image.jpg.js.php.jpg . At the end the attacker deletes in the request after the upload the jpg to access unauthorized the malicious 
file (web-shell) to compromise the web-server or mobile device.

Exploitation of the arbitrary file upload web vulnerability requires no user interaction or privilege application user account with password.
Successful exploitation of the vulnerability results in unauthorized file access because of a compromise after the upload of web-shells.

Vulnerable Application(s):
				[+] Copy to WebDAV v1.1 - ITunes or AppStore (Apple)

Vulnerable Module(s):
				[+] Upload (Files) - (http://localhost:8080)

Vulnerable Parameter(s):
				[+] filename (multiple extensions)

Affected Module(s):
				[+] Index File Dir Listing


1.3
A local command/path injection web vulnerability is detected  in the Copy to WebDAV v1.1 application (Apple iOS - iPad & iPhone).
The vulnerability allows to inject local commands via vulnerable system values to compromise the apple mobile iOS application.

The vulnerability is located in the index file dir listing module when processing to request and list the ipad or iphone devicename.
Local attackers can change the name of the device to inject the code and request any local path or inject commands on application-side.
The malicious context with the path request executes when a user or victim is watching the file dir index listing.

Exploitation of the web vulnerability requires a local privilege iOS device account with restricted access and no user interaction.
Successful exploitation of the vulnerability results unauthorized execution of system specific commands and path requests.

Vulnerable Application(s):
				[+] Copy to WebDAV v1.1  - ITunes or AppStore (Apple)

Vulnerable Parameter(s):
				[+] device name

Affected Module(s):
				[+] Index File Dir Listing



Proof of Concept:
=================
1.1
The local file/path include web vulnerability can be exploited by remote attackers without privilege application user account and 
also without user interaction. For demonstration or reproduce ...


POSTDATA =----------------------------[PII_REDACTED]5855 1
Content-Disposition: form-data; name="file"; filename="<../var/mobile/[File/Path Include Vulnerability]>ben37.png"
Content-Type: image/png
URL=http://localhost:8080/#

PoC: Upload > Filename - INDEX File Dir Listing

<p>
<a href="..">Documents/..</a><br>
<a href="../var/mobile/[File/Path Include Vulnerability]>ben37.png"><../var/mobile/[File/Path Include Vulnerability]">ben37.png</a>	
<font size="1" style="color:gray">(51.8K, 2013-08-07 22:35)</font><br />
<a