Document Title:
===============
Appologics AirBeam v1.9.2 iOS - Multiple Web Vulnerabilities
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1140
Release Date:
=============
2013-11-20
Vulnerability Laboratory ID (VL-ID):
====================================
1140
Common Vulnerability Scoring System:
====================================
7.2
Product & Service Introduction:
===============================
AirBeam turns your iPhones, iPods or iPads into a realtime audio and video surveillance system. AirBeam streams
live video and audio from the cameras and microphones of any number of iPhones, iPods or iPads. You can watch
the stream on any other iDevice, Mac or Web browser - even on multiple screens simultaneously.
Use your iDevices as luxury babyphones, for serious surveillance, to keep an eye on your pets, a FPV cam in your
remote control toys…there are hundreds of useful and not so useful things you can do with it. Even if you have
just a single device AirBeam is an awesome tool for motion controlled video recording.
(Copy of the Vendor Homepage: https://itunes.apple.com/en/app/airbeam-hd-videouberwachung/id428767956 )
Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered multiple web vulnerabilities in the Appoligics UG AirBeam v1.9.2 iOS mobile application.
Vulnerability Disclosure Timeline:
==================================
2013-11-20: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
Apple AppStore
Product: AirBeam iOS - Appologics UG 1.9.2
Exploitation Technique:
=======================
Remote
Severity Level:
===============
High
Technical Details & Description:
================================
1.0
A command/path inject web vulnerability has been discovered in the official Appoligics UG AirBeam v1.9.2 iOS mobile application.
The command/path inject vulnerability allows local attackers to unauthorized inject system commands or path requests to compromise
the mobile web-application or UI online-service.
The local command/path inject web vulnerability is located in the name value of the iOS device. Local attackers with physical
device access and restricted user accounts can inject local path requests or execute system specific commands. After the inject
of the command or path request the code execute occurs in the tab header location with the listed device name on top. The security
risk of the local command/path inject web vulnerability in the device name is estimated as high with a cvss (common vulnerability
scoring system) count of 5.2(+)|(-)5.3
Exploitation of the web vulnerability requires a local privileged iOS device account with restricted access and no user interaction.
Successful exploitation of the vulnerability results unauthorized execute of system specific commands and path/file requests.
Vulnerable Service(s):
[+] Appoligics UG - AirBeam v1.9.2 (iOS)
Vulnerable Module(s):
[+] device name
Vulnerable Parameter(s):
[+] name
Affected Device(s):
[+] iPad
[+] iPhone
2.0
A client-side cross site vulnerability has been discovered in the official Appoligics UG AirBeam v1.9.2 iOS mobile application.
A xss web vulnerability allows remote attackers to manipulate via GET method inject web-application to browser requests (client-side).
The client-side cross site scripting web vulnerability is located in the vulnerable name value of the delete function. Remote attackers
are able to inject own script codes by manipulation of the GET method request to execute the malicious content on the client-side of
a victims web-browser. The security risk of the non-persistent web vulnerability in the delete function is estimated as medium with a
cvss (common vulnerability scoring system) count of 2.0(+)|(-)2.1.
Exploitation of the client-side cross site vulnerability requires no privileged web application user account and low or medium user interaction.
Successful exploitation of the client-side cross site scripting web vulnerabilities results in session hijacking, client-side phishing, client-side
unauthorized/open (external) redirects and client-side manipulation of the dhtml editor module context.
Vulnerable Service(s):
[+] Appoligics UG - AirBeam v1.9.2 (iOS)
Vulnerable Module(s):
[+] delete
Affected parameter(s):
[+] name
Affected Device(s):
[+] iPad
[+] iPhone
Proof of Concept (PoC):
=======================
1.0
The command/path inject web vulnerability can be exploited by remote attackers with privileged iOS device account and without user interaction.
For security demonstration or to reproduce the security vulnerability follow the information below.
Proof of Concept - Device Name
device benjamin.KM>"<<>"<[LOCAL COMMAND/PATH INJECT VULNERABILITY VIA DEVICENAME!]>
Hinweis: Manche Browser haben Schwierigkeiten die Aufzeichnungen direkt im Browser-Fenster abzuspielen.
In diesem Fall die Aufzeichnung mittels Rechts-Klick und "Speichern unter" herunterladen und dann anschauen.