Document Title: =============== Apple iOS (Notify iTunes) - Bypass & Persistent Vulnerability References (Source): ==================== https://www.vulnerability-lab.com/get_content.php?id=2024 Followup ID: 654962036 Vulnerability Magazine: https://www.vulnerability-db.com/?q=articles/2016/12/22/apple-ios-102-notify-function-vulnerable-attacks-idevice-itunes-appstore Release Date: ============= 2017-01-16 Vulnerability Laboratory ID (VL-ID): ==================================== 2024 Common Vulnerability Scoring System: ==================================== 4.4 Product & Service Introduction: =============================== iOS is a mobile operating system created and developed by Apple Inc. exclusively for its hardware. It is the operating system that presently powers many of the company's mobile devices, including the iPhone, iPad, and iPod touch. (Copy of the Homepage: https://en.wikipedia.org/wiki/IOS ) iTunes is a media player, media library, online radio broadcaster, and mobile device management application developed by Apple Inc. It is used to play, download, and organize digital downloads of music and video (as well as other types of media available on the iTunes Store) on personal computers running the macOS and Microsoft Windows operating systems. The iTunes Store is also available on the iPhone, iPad, and iPod Touch. Through the iTunes Store, users can purchase and download music, music videos, television shows, audiobooks, podcasts, movies, and movie rentals in some countries, and ringtones, available on the iPhone and iPod Touch (fourth generation onward). Application software for the iPhone, iPad and iPod Touch can be downloaded from the App Store. iTunes 12.5 is the most recent major version of iTunes, available for Mac OS X v10.9.5 or later and Windows 7 or later; it was released on September 13, 2016. iTunes 12.2 added Apple Music to the application, along with the Beats 1 radio station, and iTunes 12.5 offers a refinement of the Apple Music interface. (Copy of the Homepage: https://en.wikipedia.org/wiki/ITunes ) Abstract Advisory Information: ============================== The vulnerability laboratory core research team discovered a persistent input validation vulnerability, a filter bypass and a malformed mail encode issue in the official apple ios 10.2 notify function and itunes online service web-application. Vulnerability Disclosure Timeline: ================================== 2016-12-15: Researcher Notification & Coordination (Benjamin Kunz Mejri - Evolution Security GmbH) 2016-12-16: Vendor Notification (Apple Product Security Team) 2016-12-16: Vendor Response/Feedback (Apple Product Security Team) 2017-01-16: Temp Vendor Fix/Patch (Apple Cupertino Service Developer Team) 2017-01-16: Public Disclosure (Vulnerability Laboratory) 2017-01-20: Security Acknowledgements (Apple Product Security Team) 2017-01-28: Vendor Fix/Patch (Apple Cupertino Service Developer Team) Discovery Status: ================= Published Affected Product(s): ==================== Apple Product: iTunes & AppStore - Online Service (Web-Application) 2016 Q4 Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ A persistent input validation vulnerability, a filter bypass and a malformed mail encode issue has been discovered in the official apple ios 10.2 notify function and itunes online service web-application. The persistent vulnerability allows remote attackers to inject own malicious script codes to the application-side of the vulnerable module or function. The vulnerability is located in the new iTunes and Appstore `Notify` function for iOS v10.2 devices. The function does take the user credentials of the icloud or devicename values to perform the notify. The performed outgoing email of the new-itunes services has not parse mechanism for the user credentials streamed through the email client. Thus allows remote attackers to inject own malicious payloads to execute them within the introduction word line were the name is visible in the email body of the notify message. The request method is a sync via the device and the attack vector is persistent. The injection point are the user credentials of the `firstname` parameter and the execution point occurs in the outgoing email by the "@new.itunes.com" email sender. The same type of vulnerability has been disclosed already by our team in the invoices of the appstore and itunes in 2015. (Ref: https://www.vulnerability-lab.com/get_content.php?id=1512 )The vulnerability can be exploited on restricted accessable ios devices to the main account holder inbox. The issue could be used as well to continue the calender spam activities. We identified as well an attack vector against the management application of the itunes service with persistent vector. The test payload executes on preview of the content within the backend management module of the new-itunes web-server. The client policy allows to execute scripts of the original sever with certificate. Thus allows to perform a malicious request outside the basic client conditions to provoke a direct execution in the ios mail client. The problem is in connection to the basic client delivery policy of original owner email with certificate. Therefore we suggest to remove the service because the management is processed by an external service provider. By saving another unverified email to the input the device can be shutdown and then opened to perform the itunes request. Another attack vector for us was an already smuggeled payload in the database with old name input conditions. The last case of attack was basically performed through a non icloud conneced account with malicious devicename parameter. The security risk of the persistent input validation and mail encoding web vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 4.4. Exploitation of the persistent input validation and mail encoding web vulnerability requires a low privilege apple (appstore/itunes) account and low or medium user interaction. Exploitation of the vulnerability results in session hijacking, persistent phishing attacks, persistent redirect to external sources and persistent manipulation of affected or connected service module. Vulnerable Module(s): [+] Notify (New Function) Vulnerable Paramter(s): [+] firstname & name Affected Module(s): [+] Outgoing Service Notify Email Body Affected Sender(s): [+] do_not_reply@new.itunes.com Proof of Concept (PoC): ======================= The persistent input validation and mail encode vulnerability can be exploited by remote attackers with low privilege user account and with low user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. PoC: Payload(s) >"

Query Builder