IOTransfer CVE-2022-24562: Insecure API Analysis Leading to Arbitrary File Read/Write and RCE

Vulnerability Overview Vulnerability Name: Exploiting IOTransfer insecure API CVE-2022-24562 Vulnerability Description: IOTransfer is a program that allows users to transfer files between an iPhone and a PC, similar to Apple's iTunes. The program uses a Node.js server for communication, and its API is unobfuscated and lacks any access control or security measures. Understanding this communication can lead to arbitrary reading and writing to any location on the computer, potentially resulting in Remote Code Execution (RCE). Scope of Impact Affected Software: IOTransfer Vulnerability Type: Insecure API Impact: Arbitrary file read and write, which may lead to Remote Code Execution Remediation Recommendation: Since IOTransfer's AirServ lacks any security measures, it is recommended that Blue Team personnel be aware of this and block the IOTransfer communication port (7193) unless it is not in use. Disclosure Timeline: - February 24, 2022 - Vulnerability disclosed to IObit - February 29, 2022 - IObit replied stating they would analyze the information - March 5, 2022 - RCE disclosed to IOTransfer, no response - March 7, 2022 - Second email sent to the IOTransfer team - March 21, 2022 - Received CVE number (CVE-2022-24562) from MITRE - March 3, 2022 - Received CVE numbers for four other vulnerabilities from MITRE POC Code Detailed Analysis 1. Background: - IOTransfer uses a Node.js server for communication; the API is unobfuscated and lacks security measures. - IOTransfer was found to be listening on a TCP port using Process Hacker, and the process runs with elevated privileges. 2. First Clue Discovery: - The process is named "AirServ.exe," and the command line ends with "iot_filetransfer.js." - The API consists of 5 files, with "iot_filetransfer.js" being the main implementation of the API. 3. Code Review: - AirServ uses a task system to execute operations; users need to specify a to upload/download files. - Creating a task requires sending specific fields, after which the server returns a new . - Setting task details includes file size, save path, full path, MD5, and file type. - The final request uses the "newuploadtask" function to upload local files. 4. Conclusion: - IOTransfer's AirServ lacks any security measures; it is recommended to block its communication port. The above is a concise Chinese summary of the key vulnerability information from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

IOTransfer CVE-2022-24562: Insecure API Analysis Leading to Arbitrary File Read/Write and RCE