2013-02-11 07:45:01 +0000)br / a href=About/About//a ( 0.1 Kb， iPod or iPad - Zoom PDFs and other documents File Manger supports PDF， iWorks and the most common file types. The new iCloud module and sync is also enabled and an very useful ability for the applicaiton. (Copy of the Vendor Homepage: https://itunes.apple.com/us/app/file-manager/id550412070 ) 摘要: ========= The Vulnerability Laboratory Research Team discovered a file include web vulnerability in the mobile Remote File Manager v1.2 app for the apple ipad iphone. 转台 Published 影响产品 ================== Apple Product: Remote File Manager 1.2 剖析: ======== 1.1 A local file include web vulnerability via POST request method is detected in the mobile Remote File Manager v1.2 app for the apple ipad iphone. The vulnerability allows remote attackers via POST method to inject local app webserver folders to request unauthorized local webserver files. The vulnerbility is located in the upload file module of the webserver (:63114/) when processing to request a manipulated filename via POST. The execution of the vulnerable values as filename will occur when the attacker is processing to watch the file dir listing in the main index site. Exploitation of the vulnerability requires no user interaction and can be done without privileged application user account (no password standard). Successful exploitation of the vulnerability results in unauthorized path or file access via local file or path include attack. Vulnerable Application(s): [+] Remote File Manager v1.2 - ITunes or AppStore (Apple) Vulnerable Module(s): [+] File Upload (Web Server) [Remote] Vulnerable Parameter(s): [+] filename Affected Module(s): [+] File - Index Dir Listing 1.2 A persistent input validation vulnerability is detected in the mobile Remote File Manager v1.2 app for the apple ipad iphone. The bug allows an attacker (remote) to implement/inject malicious script code on the application side (persistent) of the app web service. The vulnerability is located in the index file dir listing module of the webserver (:63114/) when processing to display injected and via POST request method manipulated filenames. The persistent script code will be executed out of the main index file dir listing module when the service is processing to list the new malicious injected filename as item. Exploitation of the persistent web vulnerability requires low or medium user interaction without privileged application user account. Successful exploitation of the vulnerability can lead to persistent session hijacking (customers)。

persistent phishing or stable (persistent) certificate mail notification context manipulation. Vulnerable Application(s): [+] Remote File Manager v1.2 - ITunes or AppStore (Apple) Vulnerable Module(s): [+] File Upload (Web Server) [Remote] Vulnerable Parameter(s): [+] filename Affected Module(s): [+] Filename - Index File Dir Listing 证明测试================= 1.1 The file include web vulnerability can be exploited by remote attackers without application user account and also without user interaction. For demonstration or reproduce ... POSTDATA =-----------------------------246901308427809 Content-Disposition: form-data; name=file; filename=[../../[UNAUTHORIZED LOCAL FILE/PATH INCLUDE VULNERABILITY]].png Content-Type: image/png Review: Index File Dir Listing - Filename div id=bodyspacediv id=main_menuh1File Manager/h1/divdiv id=main_left

多个 Remote File Manager v1.2 缺陷

版权声明：本站内容均来源于互联网 如有侵权联系删除