Document Title:
===============
SeasonApps iTransfer 1.1 - Persistent UI Vulnerability
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1347
Release Date:
=============
2014-10-27
Vulnerability Laboratory ID (VL-ID):
====================================
1347
Common Vulnerability Scoring System:
====================================
2.5
Product & Service Introduction:
===============================
Do you want to access your PhotoLibrary`s file on the website? Do you want to transfer files from PC to iDevice easily and
read or send them every where? So the iTransfer will give all these to you.
1. You can get all photos and videos in the Photo Library of your device.
2. Wifi Sharing! These make our life more easy, Isn`t it?
3.A file box for you that you can store and get files on the document dictionary of the App. also you can manage the files via Wifi Sharing !
4. Supper File Manager, you can open files with document format as pdf,doc,ppt,txt,rtf,png,jpg… and media format as mp3,mp4 and so on.
5.Zip and Unzip which will make you manage your local files early.
6.You can share the files to your friend with email.
7. You can access the files on this app via USB and iTunes.
8.Support for iOS7
9.Add upload feature to Library sharing, you can upload image to your photo library now.
10.Add file manage feature to the Local Sharing, just like create dictionary and delete files(dictionary)
11.Add Authentication feature to he sharing feature, you can safe browse your sharing right now!
12.Add feedback feature, please give us your advice or your bug to us. thanks!
(Copy of the Homepage: https://itunes.apple.com/us/app/itransferpro-transfer-photos/id777151284 )
Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered a persistent input validation vulnerability in the official iTransferPro v1.1 iOS mobile application.
Vulnerability Disclosure Timeline:
==================================
2014-10-27: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
SeasonApps iTransfer
Product: iTransfer - iOS Mobile Web Application (Wifi) 1.1
Exploitation Technique:
=======================
Local
Severity Level:
===============
Medium
Technical Details & Description:
================================
An application-side input validation web vulnerability has been discovered in the official SeasonApps iTransferPro v1.1 iOS mobile application.
The vulnerability allows a local attacker to inject own script code as payload to the application-side of the vulnerable service function or module.
The vulnerability is located in the albumname value. Local attackers with low privileged device user accounts are able to manipulate the albumname
values by usage of the wifi sync function in the `Share Photo Library` module. The attack vector is persistent on the application-side and the request
method to inject is a app sync. The issue allows to stream persistent malicious script codes to the front site of the wifi photo library interface.
The security risk of the application-side web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 2.5.
Exploitation of the application-side web vulnerability requires a low privileged web-application user account and low or medium user interaction.
Successful exploitation of the vulnerabilities result in persistent phishing mails, session hijacking, persistent external redirect to malicious
sources and application-side manipulation of affected or connected module context.
Request Method(s):
[+] Sync
Vulnerable Module(s):
[+] Share Photo Library
Vulnerable Parameter(s):
[+] items - group (albumname)
Affected Module(s):
[+] Wifi Interface - Share Photo Library Index (http://localhost:8888/)
Proof of Concept (PoC):
=======================
The persistent input validation web vulnerability can be exploited by local attackers with low privileged device user account and low or medium user interaction.
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.
PoC: Wifi Interface - Share Photo Library Index (http://localhost:8888/)
iTransfer
