CVE-2021-47921
📋 TL;DR
Free Photo & Video Vault 0.0.2 contains a directory traversal vulnerability that allows remote attackers to manipulate web requests and access sensitive system files. Attackers can exploit this without authentication to retrieve environment variables and access unauthorized system paths. Users of version 0.0.2 on iOS are affected.
💻 Affected Systems
- Free Photo & Video Vault
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through access to sensitive files like /etc/passwd, SSH keys, or application credentials, potentially leading to data theft or further system exploitation.
Likely Case
Unauthorized access to application data, configuration files, and environment variables, potentially exposing user photos/videos and system information.
If Mitigated
Limited impact with proper network segmentation and access controls, restricting exposure to internal network only.
🎯 Exploit Status
Exploitation requires network access to the application's web interface, typically on port 8080.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Check App Store for updated version
2. If no update available, uninstall the application
3. Consider alternative secure photo vault applications
🔧 Temporary Workarounds
Disable WiFi Transfer Feature
allTurn off the web interface that exposes the vulnerable component
Network Segmentation
allRestrict access to the application's web interface to trusted networks only
🧯 If You Can't Patch
- Disable the application's WiFi transfer feature immediately
- Isolate the device on a separate VLAN with no internet access
🔍 How to Verify
Check if Vulnerable:
Check if Free Photo & Video Vault version 0.0.2 is installed and if the WiFi transfer feature is enabledCheck Version:
Check iOS App Store purchase history or device application listVerify Fix Applied:
Verify application is uninstalled or updated to a version later than 0.0.2📡 Detection & Monitoring
Log Indicators:
- Unusual file path requests in web server logs
- Multiple ../ sequences in URL parameters
- Access attempts to system files
Network Indicators:
- HTTP requests with ../ sequences to port 8080
- Unusual file access patterns from external IPs
SIEM Query:
source="web_logs" AND (url="*../*" OR url="*/etc/*") AND dest_port=8080🔗 References
- https://apps.apple.com/us/app/free-photo-video-vault-wifi-transfer/id981034501
- https://www.vulncheck.com/advisories/free-photo-video-vault-directory-traversal-vulnerability-via-web-request
- https://www.vulnerability-lab.com/get_content.php?id=2271
- https://www.vulnerability-lab.com/get_content.php?id=2271