[prev in list] [next in list] [prev in thread] [next in thread]
List: full-disclosure
Subject: [Full-disclosure] YingZhi Python Directory Traversal and Arbitrary File Upload Vulnerabilities
From: larry Cashdollar <larry0 () me ! com>
Date: 2012-09-27 16:06:17
Message-ID: 26f6a18f-3225-c7ea-d9fc-ad26a2f57c00 () me ! com
[Download RAW message or body]
[Attachment #2 (multipart/alternative)]
YingZhi Python Programming Language for iOS
Vendor: XiaoWen Huang, YingZhi Python for iOS.
Ver 1.9.
Product Websites
http://sosilen.blog.163.com
http://www.iphoneappstorm.com/iphone-apps/utilities/com.yingzhi.python/yingzhipython.php?id=493505744 \
YingZhi
Description:
Python Interpreter is a native python development application for the iPad/iPhone. It is \
available for iOS 4 and above.
The product is packaged with its own httpd and ftpd servers. Enabling the local daemons for \
development by Touching Computer<->This Machine starts up an httpd server and ftpd server, \
both daemons are bound to device IP not localhost.
Vulnerabilities:
httpd server allows upload of arbitrary files to root WWW directory.
Browsing to http://<target_ip>:8080/ presents an index page in which anyone can upload files to \
the web servers root directory.
ftp server vulnerable to ../ bug
The ftp server doesn't sanitize user input and allows remote users to read and possibly write \
to the devices storage.
ftp://192.168.0.24:10000/../../../../../../../private/etc/passwd
The ftp server doesn't bother authenticating users, any username/password combination will \
allow you in.
Larry Cashdollar @lcashdol
advisory with pictures : http://vapid.dhs.org/advisories/python_for_ipad.html
[Attachment #5 (multipart/related)]
[Attachment #7 (text/html)]
<html><body><div><pre>YingZhi Python Programming Language for iOS
Vendor: XiaoWen Huang, YingZhi Python for iOS.
Ver 1.9.
Product Websites
http://sosilen.blog.163.com
http://www.iphoneappstorm.com/iphone-apps/utilities/com.yingzhi.python/yingzhipython.php?id=493505744 \
YingZhi
Description:
Python Interpreter is a native python development application for the iPad/iPhone. It is \
available for iOS 4 and above.
The product is packaged with its own httpd and ftpd servers. Enabling the local daemons for \
development <br>by Touching Computer<->This Machine starts up an httpd server and ftpd \
server, both daemons are bound to <br>device IP not localhost.
Vulnerabilities:
httpd server allows upload of arbitrary files to root WWW directory.
Browsing to http://<target_ip>:8080/ presents an index page in which anyone can upload \
files to the web servers root directory.
ftp server vulnerable to ../ bug
The ftp server doesn't sanitize user input and allows remote users to read and possibly write \
to the devices storage.
ftp://192.168.0.24:10000/../../../../../../../private/etc/passwd
The ftp server doesn't bother authenticating users, any username/password combination will \
allow you in.
Larry Cashdollar @lcashdol
advisory with pictures : http://vapid.dhs.org/advisories/python_for_ipad.html \
<br></pre></div></body></html>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic