Document Title: =============== HiDisk 2.4 iOS - (currentFolderPath) Persistent Vulnerability References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=1496 Release Date: ============= 2015-05-19 Vulnerability Laboratory ID (VL-ID): ==================================== 1496 Common Vulnerability Scoring System: ==================================== 3.5 Product & Service Introduction: =============================== HiDisk is such an app.it`s a Safe,a File Manager,a Media Player,a Files Reader. As a Safe － Provide Password System to secure your private stuff (photo,video,audio,note,docs,etc.) As a File Manager － Easily add folder&subfolder and quickly organize your files with few taps. As a Media Player － Play music,voice memos and video within the app. As a Files Reader - Not only provide slideshow just like native photo app,but also provide viewing docs(iWork,Windows office,etc.) (Copy of the Homepage: https://itunes.apple.com/en/app/hidisk-pro-schutz-privat-foto/id575070537 ) Abstract Advisory Information: ============================== The Vulnerability Laboratory Core Research Team discovered an application-side input validation vulnerability in the HiDisk v2.4 iOS mobile application. Vulnerability Disclosure Timeline: ================================== 2015-05-19: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Elite Tracy Product: HiDisk - iOS Mobile Web Application 2.4 Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ A persistent input validation web vulnerability has been discovered in the official HiDisk v2.4 iOS mobile web-application. The vulnerability allows remote attacker or low privilege user accounts to inject malicious codes to the application-side of the affected mobile iOS web-application. The application-side vulnerability is located in the `name` value (currentFolderPath) of the `folder add` module. Local attackers with low privilege user accounts are able to inject own malicious script codes via folder name input to compromise the `Wifi Web Access` interface web-application. The attack vector is located on the application-side of the wifi web access interface and the request method to inject is an app sync. The injection point is the add folder input and the execution occurs in the index path dir listing. The security risk of the application-side web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.5. Exploitation of the application-side web vulnerability requires a low privilege web-application user account and low or medium user interaction. Successful exploitation of the vulnerabilities results in persistent phishing mails, session hijacking, persistent external redirect to malicious sources and application-side manipulation of affected or connected module context. Request Method(s): [+] Sync Vulnerable Module(s): [+] Folder Add (Ordner Hinzufuegen) Vulnerable Parameter(s): [+] name (currentFolderPath) Affected Module(s): [+] Index Path Listing [+] Subfolder Path Listing Proof of Concept (PoC): ======================= The persistent input validation web vulnerability can be exploited by local attackers with low privilege application user account and low or medium user interaction. For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue. PoC: #1

hello

test path var

PoC: #2