iScan Online Mobile 2.0.1 on iOS Settings deviceName privileges management

Summaryinfo

A vulnerability, which was classified as problematic, has been found in iScan Online Mobile 2.0.1 on iOS. The impacted element is an unknown function of the component Settings Module. The manipulation of the argument deviceName as part of HTTP POST Request leads to privileges management. Moreover, an exploit is present.

Detailsinfo

A vulnerability was found in iScan Online Mobile 2.0.1 on iOS (iOS App Software). It has been rated as problematic. This issue affects an unknown functionality of the component Settings Module. The manipulation of the argument deviceName as part of a HTTP POST Request leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. The advisory summarizes:

iScan Online keeps your device from being the next hacking headline. It gives both you and your IT department confidence that your device is vulnerability free, complies with PCI, HIPAA and other regulatory rules and does not contain any restricted information like credit card numbers. iScan Online also offers advance mobile device management features like remote wipe, remote lock, geo-location of your device, password policy management and more.

The weakness was disclosed 06/02/2014 by Benjamin Kunz Mejri with Vulnerability Laboratory Research Team as VL-ID 1271 as not defined advisory (Website). It is possible to read the advisory at vulnerability-lab.com. The vendor was not involved in the public release. Attacking locally is a requirement. The successful exploitation needs a simple authentication. Technical details as well as a public exploit are known. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

A public exploit has been developed by Benjamin Kunz Mejri in HTTP POST Request and been published immediately after the advisory. The exploit is available at vulnerability-lab.com. It is declared as proof-of-concept. The advisory illustrates:

The local command inject web vulnerability can be exploited by remote attackers with local low privileged iOS device account without user interaction. For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue. Manual steps to reproduce the vulnerability ... 1. Login to your iOS device and download+install the mobile application ( https://itunes.apple.com/us/app/iscan-online-mobile/id658461644 ) 2. Change the iOS devicename (device information > settings) to the local command inject payload and save the details after the update Note: Request mobile var path or application files with local command 3. Open the iscan online mobile application and click the settings button on the buttom of the app navigation 4. The local command execution occurs in the `Device Name` output context of the registration information 5. Successful reproduce of the local command inject web vulnerability!

The advisory contains the following remark:

The local command inject web vulnerability can be patched by a secure parse and encode of vulnerable devicename output context in the registration information (settings) module.

seclists.org is providing further details. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• iOS App Software

Name

• iScan Online Mobile

Version

• 2.0.1

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion