Mobile Atlas Creator 1.9.12 - Command Inject Vulnerability

Document Title:
===============
Mobile Atlas Creator 1.9.12 - Command Inject Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=945


Release Date:
=============
2013-09-08


Vulnerability Laboratory ID (VL-ID):
====================================
945


Common Vulnerability Scoring System:
====================================
6.1


Product & Service Introduction:
===============================
Mobile Atlas Creator (formerly known as TrekBuddy Atlas Creator) is an open source (GPL) program which creates offline atlases for GPS 
handhelds and cell phone applications like TrekBuddy, AndNav and other Android and WindowsCE based applications. For the full list of 
supported applications please see the features section. Additionally individual maps can be exported as one large PNG image with 
calibration MAP file for OziExplorer. As source for an offline atlas Mobile Atlas Creator can use a large number of different online maps such 
as OpenStreetMap and other online map providers. 

(Copy of the Vendor Homepage: http://mobac.sourceforge.net/ )


Abstract Advisory Information:
==============================
The independent vulnerability laboratory researcher (Ateeq Khan) discovered a command injection vulnerability in the Mobile Atlas Creator v1.9.12 software.


Vulnerability Disclosure Timeline:
==================================
2013-05-09:	Public Disclosure


Discovery Status:
=================
Published


Affected Product(s):
====================
MOBAC
Product: Mobile Atlas Creator 1.9.12 


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Technical Details & Description:
================================
A local command injection web vulnerability is detected in the Mobile Atlas Creator v1.9.12 software.
The vulnerability allows remote attackers to load with a system user account local commands via injection in the software context.

The vulnerability is located in the in the atlas module when processing to add a manipulated atlas name. The context will be executed 
on application-side in the main map listing window context.
The vulnerability can also be exploited by remote attacker. The attacker can save a file with the malicious command injection values 
to a local file and path to compromise after a map exchange the target computers.

Vulnerable Module(s):
                                                     [+] Atlas

Vulnerable Input Field(s)
                                                     [+] Atlas Name

Vulnerable Function(s):
                                                     [+] Add

Affected Module(s):
                                                     [+] Software Map Index Listing



Proof of Concept (PoC):
=======================
The vulnerability can be exploited by local attackers with restricted system account and no user interaction.
The vulnerability can be exploited by remote attackers with restricted system account user and low or medium user interaction.


Manually steps to reproduce ...

1) Install and open application
2) In the menu, goto Atlas --> New Atlas
3) Use the following payload as the Atlas name >"<x src=C:\Program Files (x86)\programme\netcat.exe> and Click OK
4) Right click on the atlas content and click show details
5) You should be able to see the local file and a direct execution of the local requested file from the software context maps

Note:
Upon further investigation, I was also able to load files from my local system where the application is installed. Please also note, 
I was able to cause multiple types of exception errors while trying different payloads which means there is a possibility of multiple 
attack vectors through the same vulnerable name field. The scope of this bug is critical because the vulnerable atlas profiles can be 
saved in a file and sent to other users and upon opening the malicious payload will be executed.


Solution - Fix & Patch:
=======================
Proper user input sanatization should be performed and all special / illegal characters should be filtered out to prevent any such / similar attacks.


Security Risk:
==============
The security risk of the local command injection web vulnerability is estimated as high(-).


Credits & Authors:
==================
Ateeq Khan  [www.curreit.com]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       - www.vulnerability-lab.com/register
Contact:    [email protected] 	- [email protected] 	       - [email protected]
Section:    video.vulnerability-lab.com 	- forum.vulnerability-lab.com 		       - news.vulnerability-lab.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       - youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact ([email protected] or [email protected]) to get a permission.

    				   	Copyright © 2013 | Vulnerability Laboratory