HiDisk 2.4 iOS - (currentFolderPath) Persistent Vulnerability
Vulnerability Laboratory ID (VL-ID):
Common Vulnerability Scoring System:
Product & Service Introduction:
HiDisk is such an app.it`s a Safe,a File Manager,a Media Player,a Files Reader. As a Safe － Provide Password System to secure your
private stuff (photo,video,audio,note,docs,etc.) As a File Manager － Easily add folder&subfolder and quickly organize your files
with few taps. As a Media Player － Play music,voice memos and video within the app. As a Files Reader - Not only provide slideshow
just like native photo app,but also provide viewing docs(iWork,Windows office,etc.)
(Copy of the Homepage: https://itunes.apple.com/en/app/hidisk-pro-schutz-privat-foto/id575070537 )
Abstract Advisory Information:
The Vulnerability Laboratory Core Research Team discovered an application-side input validation vulnerability in the HiDisk v2.4 iOS mobile application.
Vulnerability Disclosure Timeline:
2015-05-19: Public Disclosure (Vulnerability Laboratory)
Product: HiDisk - iOS Mobile Web Application 2.4
Technical Details & Description:
A persistent input validation web vulnerability has been discovered in the official HiDisk v2.4 iOS mobile web-application.
The vulnerability allows remote attacker or low privilege user accounts to inject malicious codes to the application-side
of the affected mobile iOS web-application.
The application-side vulnerability is located in the `name` value (currentFolderPath) of the `folder add` module. Local attackers with low
privilege user accounts are able to inject own malicious script codes via folder name input to compromise the `Wifi Web Access` interface
web-application. The attack vector is located on the application-side of the wifi web access interface and the request method to inject is
an app sync. The injection point is the add folder input and the execution occurs in the index path dir listing.
The security risk of the application-side web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.5.
Exploitation of the application-side web vulnerability requires a low privilege web-application user account and low or medium user interaction.
Successful exploitation of the vulnerabilities results in persistent phishing mails, session hijacking, persistent external redirect to malicious
sources and application-side manipulation of affected or connected module context.
[+] Folder Add (Ordner Hinzufuegen)
[+] name (currentFolderPath)
[+] Index Path Listing
[+] Subfolder Path Listing
Proof of Concept (PoC):
The persistent input validation web vulnerability can be exploited by local attackers with low privilege application user account and low or medium user interaction.
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.