Document Title:
===============
iGet Sharp v1.1.2 iOS - Multiple Web Vulnerabilities
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=991
Release Date:
=============
2013-06-29
Vulnerability Laboratory ID (VL-ID):
====================================
991
Common Vulnerability Scoring System:
====================================
6.5
Product & Service Introduction:
===============================
iGet Sharp is a powerful tool to download and share files app which allows you to download free legal music, videos,books,
picture etc by your device, then effective management, view and share your downloaded files!
*specifically as follows:
*Download Management
** Built-in browser, automatically detect the download link
** download e-mail attachment, download via password validation
** Bookmark Support
** Download history
** Multiple simultaneous downloads,add download task Manually
** Interrupt and resume downloading at any time
** Live download progress bar and speed indicator
*File Sharing
** USB File Sharing via iTunes
** Http File Sharing via WiFi
** Email multiple files, folder Supported
** Open files using other applications
*File Manage
** New Folder
** Sorting by file name, create date and file type
** View, copy, move, delete, rename, email, zip Compression and unzip files/folders
** Glide deleting function
** Select all and Cancel all
** Photo import Supported
** Bookmark supported
*File View
** New plain text(default encoding UTF-8),Convert plain file encoding (Unicode,UTF-8 etc) [.txt]
** External file content copy or paste
** Photo View, Zoom [.png .jpg .jpeg .gif .bmp .xbm .tif .tiff etc];
** Document reader [.pdf .rtf .csv .rtfd .doc .docx .xls .xlsx .ppt .pptx (office 2003 or later) etc]
** Video Player [.mp4 flv,asf,rmvb,avi,mpg,mkv,wmv]
** File Compression and Decompression [.zip .rar]
** Multi-touch Supported, Zoom files
** Landscape mode supported
** iPad-compatible
(Copy of the Vendor Homepage: https://itunes.apple.com/de/app/iget-sharp+/id454162356 )
Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the iGet Sharp v1.1.2 apple iOS application.
Vulnerability Disclosure Timeline:
==================================
2013-06-30: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
Apple AppStore
Product: iGet Sharp - Mobile Application 1.1.2
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Medium
Technical Details & Description:
================================
1.1
A local file include and arbitrary file upload web vulnerability via POST method request is detected in the iGet Sharp v1.1.2 apple iOS application.
The vulnerability allows remote attackers via POST method to upload files with multiple extensions to unauthorized access them on application-side of the service.
The vulnerability is located in the upload file module of the web-server (http://localhost:41492/) when processing to request a manipulated
filename via POST. The execution of the injected path or file request will occur when the attacker/target is processing to reload to index listing
of the affected module. Remote attackers can exchange the filename with a tripple extension to bypass the filter and can execute the files located
on the little web-server of the application.
Exploitation of the vulnerability requires no user interaction and also without privilege application user account (no password standard).
Successful exploitation of the vulnerability results in unauthorized path or file access via local file include or arbitrary file upload.
Vulnerable Application(s):
[+] iGet Sharp v1.1.2 - ITunes or AppStore (Apple)
Vulnerable Module(s):
[+] File Upload (Web Server) [Remote]
Vulnerable Parameter(s):
[+] filename as resource
[+] file extensions (multiple)
Affected Module(s):
[+] iGet Sharp File Index Listing
1.2
A persistent input validation web vulnerability is detected in the iGet Sharp v1.1.2 apple iOS application.
The bug allows an attacker (remote) to implement/inject malicious script code on the application-side (persistent) of the app web service.
The vulnerability is located in the index file dir listing module of the web-server (http://localhost:41492/filename) when processing to
display via POST request method injected manipulated `Path & File Names`. The persistent script code will be executed in the main index file dir
listing module when the service is processing to list the new malicious injected file & path names as item.
Exploitation of the persistent web vulnerability requires low or medium user interaction without application user account.
Successful exploitation of the vulnerability can lead to persistent session hijacking (customers), account steal via persistent web
attacks, persistent phishing or stable (persistent) certificate mail notification context manipulation.
Vulnerable Application(s):
[+] iGet Sharp v1.1.2 - ITunes or AppStore (Apple)
Vulnerable Module(s):
[+] Add File
Vulnerable Parameter(s):
[+] path name
[+] file name
Affected Module(s):
[+] iGet Sharp File Index Listing
Proof of Concept (PoC):
=======================
1.1
The arbitrary file upload web vulnerability and extension filter issue can be exploited by remote attackers without privilege application
user account and also without required user interaction. For demonstration or reproduce ...
21:26:18.956[0ms][total 0ms] Status: pending[]
POST http://localhost:41492/?upload=true&guid=9A0A7235-3AEF-442A-B589-9B2D292207F3
Load Flags[LOAD_BYPASS_CACHE ] Content Size[unknown] Mime Type[unknown]
Request Headers:
Host[localhost:41492]
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[en-US,en;q=0.5]
Accept-Encoding[gzip, deflate]
DNT[1]
If-Modified-Since[Mon, 26 Jul 1997 05:00:00 GMT]
Cache-Control[no-cache]
X-Requested-With[XMLHttpRequest]
X-File-Name[327.png]
X-File-Size[27920]
Content-Type[multipart/form-data]
Referer[http://localhost:41492/]
Content-Length[27920]
Post Data:
POST_DATA[ÿØÿà
1.2
The persistent input validation web vulnerabilities can be exploited by remote attackers without privilege application user account and
with low or medium required user interaction. For demonstration or reproduce ...
1.2.1
Downloads \..[PERSISTENT INJECTED SCRIPT CODE AS PATHNAME]