Exploit-DB #34196
Description: WiFi HD 7.3.0 iOS - Multiple Vulnerabilities
Type: webapps
Platform: ios
Date: 2014-07-29
Author: Vulnerability-Lab

Exploit:
Document Title:
===============
WiFi HD v7.3.0 iOS - Multiple Web Vulnerabilities


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1283


Release Date:
=============
2014-07-29


Vulnerability Laboratory ID (VL-ID):
====================================
1283


Common Vulnerability Scoring System:
====================================
7.4


Product & Service Introduction:
===============================
Turn your iPhone into a wireless, mobile external hard drive! Works over any WiFi connection. You can now share, copy, and backup your 
files to and from your PC / Mac / Linux / or another phone! Very easy to use. No other software necessary! This is a simple, one stop, 
stand alone File Sharing solution.

(Copy of the Homepage: https://itunes.apple.com/us/app/wifi-hd/id310425060 )


Abstract Advisory Information:
==============================
The Vulnerbaility Laboratory Research Team discovered multiple vulnerabilities in the official WiFI HD v7.3 iOS mobile web application.


Vulnerability Disclosure Timeline:
==================================
2014-07-29: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Savy Soda
Product: WiFI HD - iOS Mobile Web Application 7.3


Exploitation Technique:
=======================
Local


Severity Level:
===============
High


Technical Details & Description:
================================
1.1
A local file include web vulnerability has been discovered in the official Savy Soda - WiFI HD v7.3.0 iOS mobile web-application.
The local file include web vulnerability allows remote attackers to unauthorized include local file/path requests or system specific 
path commands to compromise the mobile web-application.

The web vulnerability is located in the `filename` value of the `upload` (submit file) module. Remote attackers are able to inject 
own files with malicious `filename` values in the `upload` POST method request to compromise the mobile web-application. The local 
file/path include execution occcurs in the index file/folder list context next to the vulnerable filename value. The attacker is able 
to inject the local file request by usage of the available `wifi interface` for file exchange/share.

Remote attackers are also able to exploit the filename validation issue in combination with persistent injected script codes to execute 
different local malicious attacks requests. The attack vector is on the application-side of the wifi service and the request method to 
inject is POST. 

The security risk of the local file include web vulnerability is estimated as high with a cvss (common vulnerability scoring system) 
count of 6.9. Exploitation of the local file include web vulnerability requires no privileged web-application user account or user interaction. 
Successful exploitation of the local file include web vulnerability results in mobile application or connected device component compromise.


Request Method(s):
				[+] [POST]

Vulnerable Service(s):
				[+] WiFi HD v7.3.0

Vulnerable Module(s):
				[+] Upload > Submit

Vulnerable Parameter(s):
				[+] filename

Affected Module(s):
				[+] Index File/Folder Dir Listing (http://localhost/)



1.2
A directory traversal web vulnerability has been discovered in the official Savy Soda - WiFI HD v7.3.0 iOS mobile web-application.
The issue allows remote attackers to include own path directory values to unauthorized request a system/device path or file.

The issue is located in the `Create New Folder` function with the vulnerable `Enter folder name` input. Attackers are able to include 
own local path requests to compromise the application path itself or to unauthorized request local device files. The attack vector of 
the issue is on the application-side and the request method to implement is POST. The application-side execution occurs on top of the 
index next to the path directory listing of /home.

The security risk of the directory traversal web vulnerability is estimated as high with a cvss (common vulnerability scoring system) 
count of 6.4. Exploitation of the directory traversal web vulnerability requires no privileged web-application user account or user interaction. 
Successful exploitation of the path traversal web vulnerability results in mobile application or connected device component compromise.


Request Method(s):
				[+] [POST]

Vulnerable Service(s):
				[+] WiFi HD v7.3.0

Vulnerable Module(s):
				[+] Create New Folder

Vulnerable Input(s):
				[+] Enter folder name

Affected Module(s):
				[+] Index Path Dir Listing on top (http://localhost/)



1.3
A local command/path injection web vulnerabilities has been discovered in the official Savy Soda - WiFI HD v7.3.0 iOS mobile web-application.
The vulnerability allows attackers to inject local commands via vulnerable system values to compromise the apple mobile iOS application.

The vulnerability is located in the vulnerable `devicename` value of the `File Dir Index` module. Local attackers are able to inject own 
malicious system specific commands or path value requests in the vulnerable `devicename` value. The execution of the local command inject 
occurs in the `File Dir Index` module of the wifi hd v7.3.0 mobile application. The attacker is able to manipulate the settings module of the 
application by preparing to change the local devicename. The encoding of the vulnerable values in the index module is broken and allows an 
attacker to inject own commands successfully.

The attack vector is located on the application-side and the injection requires physical device access or a local low privileged user account. 
Local attackers are also able to exploit the filename validation issue in combination with persistent injected script codes to execute different 
types