Document Title: =============== Mobile Atlas Creator 1.9.12 - Command Inject Vulnerability References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=945 Release Date: ============= 2013-09-08 Vulnerability Laboratory ID (VL-ID): ==================================== 945 Common Vulnerability Scoring System: ==================================== 6.1 Product & Service Introduction: =============================== Mobile Atlas Creator (formerly known as TrekBuddy Atlas Creator) is an open source (GPL) program which creates offline atlases for GPS handhelds and cell phone applications like TrekBuddy, AndNav and other Android and WindowsCE based applications. For the full list of supported applications please see the features section. Additionally individual maps can be exported as one large PNG image with calibration MAP file for OziExplorer. As source for an offline atlas Mobile Atlas Creator can use a large number of different online maps such as OpenStreetMap and other online map providers. (Copy of the Vendor Homepage: http://mobac.sourceforge.net/ ) Abstract Advisory Information: ============================== The independent vulnerability laboratory researcher (Ateeq Khan) discovered a command injection vulnerability in the Mobile Atlas Creator v1.9.12 software. Vulnerability Disclosure Timeline: ================================== 2013-05-09: Public Disclosure Discovery Status: ================= Published Affected Product(s): ==================== MOBAC Product: Mobile Atlas Creator 1.9.12 Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ A local command injection web vulnerability is detected in the Mobile Atlas Creator v1.9.12 software. The vulnerability allows remote attackers to load with a system user account local commands via injection in the software context. The vulnerability is located in the in the atlas module when processing to add a manipulated atlas name. The context will be executed on application-side in the main map listing window context. The vulnerability can also be exploited by remote attacker. The attacker can save a file with the malicious command injection values to a local file and path to compromise after a map exchange the target computers. Vulnerable Module(s): [+] Atlas Vulnerable Input Field(s) [+] Atlas Name Vulnerable Function(s): [+] Add Affected Module(s): [+] Software Map Index Listing Proof of Concept (PoC): ======================= The vulnerability can be exploited by local attackers with restricted system account and no user interaction. The vulnerability can be exploited by remote attackers with restricted system account user and low or medium user interaction. Manually steps to reproduce ... 1) Install and open application 2) In the menu, goto Atlas --> New Atlas 3) Use the following payload as the Atlas name >" and Click OK 4) Right click on the atlas content and click show details 5) You should be able to see the local file and a direct execution of the local requested file from the software context maps Note: Upon further investigation, I was also able to load files from my local system where the application is installed. Please also note, I was able to cause multiple types of exception errors while trying different payloads which means there is a possibility of multiple attack vectors through the same vulnerable name field. The scope of this bug is critical because the vulnerable atlas profiles can be saved in a file and sent to other users and upon opening the malicious payload will be executed. Solution - Fix & Patch: ======================= Proper user input sanatization should be performed and all special / illegal characters should be filtered out to prevent any such / similar attacks. Security Risk: ============== The security risk of the local command injection web vulnerability is estimated as high(-). Credits & Authors: ================== Ateeq Khan [www.curreit.com] Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability- Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission. Copyright © 2013 | Vulnerability Laboratory