Wireless Photo Access 1.0.10 iOS - Multiple Vulnerabilities
2013-04-27
http://www.vulnerability-lab.com/get_content.php?id=934
934
5.6
Is it too difficult to get your photos and videos in original quality from your iPhone or iPad? Simply access them
from any nearby computer or another iPhone/iPod/iPad using Web Browser without need to install any 3rd party transfer utilities.
(Copy of the Homepage: https://itunes.apple.com/us/app/wifi-mediabox-photo-video/id422804836 )
The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the mobile Wireless Photo Access 1.0.10 iOS app (Apple - iPad|iPhone).
2013-04-27: Public Disclosure
Published
Apple AppStore
Product: Wireless Photo Access 1.0.10
Remote
High
1.1
A local command injection web vulnerability is detected in the mobile Wireless Photo Access 1.0.10 iOS app (Apple - iPad|iPhone).
The vulnerability allows to inject local commands via vulnerable system values to compromise the apple mobile iOS application.
The vulnerbility is located in the index toolbar module when processing to load a ipad or iphone device name. Local attackers can change
the ipad/iphone device name to system specific commands and file requests to provoke an execution when processing to watch the
main index listing of the pictures. The execution of the script code occurs in the device name web context when processing to
display the vulnerable name value.
Exploitation of the web vulnerability does not require an application user account with login (standard) or user interaction.
Successful exploitation of the vulnerability results unauthorized local execution of system specific commands and path requests.
Vulnerable Application(s):
[+] Wireless Photo Access 1.0.10 - ITunes or AppStore (Apple)
Vulnerable Module(s):
[+] Toolbar - Index
Vulnerable Parameter(s):
[+] device name
Affected Module(s):
[+] Toolbar Listing - Index
1.2
A remote denial of service vulnerability is detected in the mobile Wireless Photo Access 1.0.10 iOS app (Apple - iPad|iPhone).
The vulnerability allows a remote attackers to crash down the software process of the vulnerable iOS service application.
The vulnerability is located in the thumb and img (image) module of the application when processing to request an invalid or non exisiting
id via url parameter. The non exisiting or invalid id request via GET method results in a stable iOS web-server service app crash.
Exploitation of the vulnerability does not require an application user account with login or user interaction.
Successful exploitation of the denial of service vulnerability results in a stable iOS application and web-server crash.
Vulnerable Application(s):
[+] Wireless Photo Access 1.0.10 - ITunes or AppStore (Apple)
Vulnerable Module(s):
[+] thumb and img
Vulnerable Parameter(s):
[+] id
Affected Module(s):
[+] Web-Server
1.1
The local command injection web vulnerability can be exploited by remote attackers without an application user account
and also without user interaction. For demonstration or reproduce …
Manually steps to reproduce … Command Inject via Album Foldername
PoC: Device Name - Toolbar
<div class="toolbar">
<div id="left">
<div><font style="font-size:13px;"><b>Wireless Photo Access:</b> >%20>"
<iframe src="Wireless%20Photo%20Access%20for%20iOS_files/a.htm">
<i>(Free Lite version)</i></font></div>
</div>
<div id="right">
<a href="http://www.xxxxx.sk/wifiaccess"><button
class="button">Support</button></a>
</div>
</div>
1.2
The remote denial of service vulnerability can be exploited by remote attackers without an application user account or user interaction.
For demonstration or reproduce …
Standard Request:
http://localhost:8080/img.jpg?id=22 (IMAGE)
http://localhost:8080/thumb?id=23 (THUMBNAIL)
Manipulated Request:
http://localhost:8080/img.jpg?id=99999 (IMAGE)
http://localhost:8080/thumb?id=----- (THUMBNAIL)
http://localhost:8080/img.jpg?id=AAAAA (IMAGE)
http://localhost:8080/thumb?id=1+_s (THUMBNAIL)
1.1
The security risk of the local command/path injection web vulnerability is estimated as high.
1.2
The security risk of the remote denial of service web vulnerability is estimated as medium.
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri ([email protected])
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
or trade with fraud/stolen material.
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register
Contact: [email protected] - [email protected] - [email protected]
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
modify, use or edit our material contact ([email protected] or [email protected]) to get a permission.
Copyright © 2013 | Vulnerability Laboratory
– VULNERABILITY RESEARCH LABORATORY LABORATORY RESEARCH TEAM CONTACT: [email protected]