Title: HTC / Windows Mobile OBEX FTP Service Directory Traversal |
 |
Summary
HTC devices running Windows Mobile 6 and Windows Mobile 6.1 are prone to a directory traversal vulnerability in the Bluetooth OBEX FTP Service. Exploiting this issue allows a remote authenticated attacker to list arbitrary directories, and write or read arbitrary files, via a ../ in a pathname. This can be leveraged for code execution by writing to a Startup folder.
Description
Presently most Windows Mobile phones are shipped with a Bluetooth stack, which provides Bluetooth communications with other remote devices. Among all the Bluetooth services that may be implemented in the stack, File Transfer Profile (OBEX FTP) is the most common service.
The OBEX FTP Service
The OBEX FTP service can be used to share files over the Bluetooth wireless communications protocol. This service can be used for sending files from the phone to other remote devices but also allows remote devices to browse shared folders and download files from the phone.
Usually, the FTP service is configured in such a way that a specific directory is shared and the user can place here files to be shared. The default directory is My Device\My Documents\Bluetooth Share (in the English edition) or My Device\My Documents\Compartimiento de Bluetooth (in the Spanish edition). A different directory may be selected; however the user is not allowed to specify any directory of the filesystem out of My Device\My Documents\ or Memory Card\My Documents\ paths. This is for safety reasons, so users cannot expose sensitive files over Bluetooth.
The OBEX FTP Service Directory Traversal vulnerability
There exists a Directory Traversal vulnerability in the OBEX FTP Service in the Bluetooth Stack implemented in HTC devices running Windows Mobile 6 and Windows Mobile 6.1. The OBEX FTP server is located in \Windows\obexfile.dll. Microsoft states this is a 3rd party driver developed by HTC and installed on HTC devices running Windows Mobile, so the vulnerability only affects to this vendor specifically.
A remote attacker (who previously owned authentication and authorization rights) can use tools like ObexFTP or gnomevfs-ls from a Linux box to traverse to parent directories out of the default Bluetooth shared folder by using ../ or ..\\ marks.
Requirements to exploit the vulnerability
The only requirement is that the attacker must have authentication and authorization privileges over Bluetooth. Pairing up with the remote device should be enough to get it; however, more sophisticated attacks, such as sniffing the Bluetooth pairing, linkkey cracking and MAC address spoofing, can be used in order to avoid this. In case the attacker succeeded in getting the proper privileges, further actions will be transparent to the user.
Devices must have Bluetooth enabled and File Sharing over Bluetooth service active when the attack is performed.
Scope of the attack
The Directory Traversal vulnerability allows the attacker to traverse to parent directories out of the default Bluetooth shared folder by using ../ or ..\\ marks. This security flaw leads to browse folders located anywhere in the file system, download files contained in any folder as well as upload files to any folder.
A remote attacker who previously owned authentication and authorization rights over Bluetooth can perform three risky actions on the device:
1) Browse directories located out of the limits of the default shared folder
An attacker can discover the structure of the file system and access to any directory within it, including:
- The flash hard drive
- The external storage card
- The internal mass storage memory, included in devices like HTC TOUCH DIAMOND™
Indeed the file system can be browsed through with Nautilus file explorer...
2) Download files without permission
An attacker can download sensitive files located anywhere in the file system, such as:
- personal pictures and documents located in \My Documents or any other directory
- emails located in \Windows\Messaging
- Contacts, Calendar & Tasks information located in \PIM.vol (only if PIM.vol copied into a different directory). Despite being structured in database format, the information is written in plain text and easily accessible.
- Temporary internet cache and cookies located in \Windows\Profiles\guest\
3) Upload malicious files
An attacker can replace third party or system executable files with malicious files as well as upload trojans to any place in the filesystem, such as \Windows\Startup and, therefore, shall be executed the next time Windows Mobile inits.
