Title: ====== ePhoto Transfer v1.2.1 iOS - Multiple Web Vulnerabilities Date: ===== 2013-07-17 References: =========== http://www.vulnerability-lab.com/get_content.php?id=1017 VL-ID: ===== 1017 Common Vulnerability Scoring System: ==================================== 6.6 Introduction: ============= ePhoto Transfer lets you quickly transfer photos and videos between your iPhone, iPad, iPod Touch, Mac, PC, and even other non-iOS mobile devices via Wi-Fi. It turns your iPhone/iPad/iPod Touch into a USB drive from your PC or Mac, then all your photos and videos will be available for drag and drop. You don`t need to install any desktop software(even iTunes), so you can use it at home or in office. It also provides useful features to help you organize your photos. You can rename photos and videos, sort and search within your camera roll. You can choose which photos and videos to share, and set accessing password for the shared files. Transferring photos and videos over Personal Hotspot Wi-Fi is fully supported. It`s a universal app, download once, both your iPhone and iPad will have it. (Copy of the Vendor Homepage: https://itunes.apple.com/de/app/ephoto-transfer/id643118163 ) Abstract: ========= The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the ePhoto Transfer v1.2.1 application (Apple iOS - iPad & iPhone). Report-Timeline: ================ 2013-07-17: Public Disclosure (Vulnerability Laboratory) Status: ======== Published Affected Products: ================== Apple AppStore Product: ePhoto Transfer 1.2.1 Exploitation-Technique: ======================= Remote Severity: ========= High Details: ======== 1.1 A local command/path injection web vulnerability is detected in the ePhoto Transfer v1.2.1 application (Apple iOS - iPad & iPhone). The vulnerability allows local attackers to inject commands or path request on application -side of the vulnerable module. The vulnerability is located in the Index File Dir Listing module when processing to display manipulated Photo Picture Folder Names. Local attackers with physical device access can inject script code to the regular iOs photo application by renameing the visible folders. The attacker can save the changed foldername and to execute when accessing the index file dir listing module. Exploitation of the command injection web vulnerability does not require a privilege application user account or user interaction. Successful exploitation results in application-side command/path injection to unauthorized access files or to compromise the application or mobile device. Vulnerable Module(s): [+] File Dir Index Vulnerable Parameter(s): [+] Photo Album Name > FolderName 1.2 A remote denial of servicce vulnerability is detected in the ePhoto Transfer v1.2.1 application (Apple iOS - iPad & iPhone). The denial of service vulnerability allows a remote attacker to crash, slow down, block or shutdown the mobile application core. The vulnerability is located in the upload parameter when processing to request negative large integer values as filename. The attacker can open the url deletes the name of an exisiting file and includes a large negative integer value. As reaction because of the unfiltered input the application crashs. Exploitation of the denial of service vulnerability does not require a privilege application user account or user interaction. Successful exploitation of the vulnerability result in a stable application crash or shutdown. Vulnerable Module(s): [+] Upload Files Vulnerable Parameter(s): [+] upload 1.3 A client side cross site scripting vulnerability is detected in the ePhoto Transfer v1.2.1 application (Apple iOS - iPad & iPhone). The input validation vulnerability allows remote attackers to manipulate browser requests by client side script code injects in the web application. The vulnerability is located in the file download module when processing to request a manipulated download parameter via GET method. The script code will be executed when the service is redirecting user to the file dir menu listing. Exploitation of the vulnerability does not require a privilege application user account but low or medium user interaction. Successful exploitation of the vulnerability results in session hijacking, persistent phishing, persistent malicious external redirect and persistent module context manipulation. Vulnerable Module(s): [+] Files Download Vulnerable Parameter(s): [+] download Proof of Concept: ================= 1.1 - Local Command/Path Injection Vulnerability The local command/path inject web vulnerability can be exploited by remote attackers with physical device access and without user interaction. For demonstration or reproduce ... PoC: Index Listing - Foldername Parent Directory Misc Backgrounds2013-07-16 19:05 -- "%20> "