A flaw in the iOS camera QR code URL parser could expose users to attacks
28.3.2018 securityaffairs iOS

A vulnerability in the iOS Camera App could be exploited by hackers to redirect users to a malicious website, the issue affects the built-in QR code reader.
The iOS Camera App is affected by a bug that could be exploited by hackers to redirect users to a malicious website, the issue resides in the built-in QR code reader.

The flaw affects the latest Apple iOS 11 for iPhone, iPad, and iPod touch devices.

The problem ties a new feature that was implemented in iOS 11 to allow users to automatically read QR codes while using the camera app without requiring any third-party QR code reader app.

To read a QR code, users need to open the Camera app on their Apple devices and point the iPhone or the iPad at a QR code, in this way if the code an URL, the system will give the users a notification with the link address. Tapping the notification the users can visit the URL in Safari browser, but according to the security researcher Roman Mueller who discovered the vulnerability, the URL visited could be changed.

The expert discovered that the URL parser of built-in QR code reader for iOS camera app doesn’t correctly detect the hostname in the URL making it possible to change the displayed URL in the notification and hijacking to users to malicious websites.

“The URL parser of the camera app has a problem here detecting the hostname in this URL in the same way as Safari does.” wrote the expert in a blog post.

“It probably detects “xxx\” as the username to be sent to “facebook.com:443”.
While Safari might take the complete string “xxx\@facebook.com” as a username and “443” as the password to be sent to infosec.rm-it.de.”
“This leads to a different hostname being displayed in the notification compared to what actually is opened in Safari.”

Mueller created a QR code containing the following URL:

https://xxx\@facebook.com:443@infosec.rm-it.de/

When he scanned it he noticed that the device was showing the following notification:

Open “facebook.com” in Safari

Once tapped it opened https://infosec.rm-it.de/ instead Facebook.

The expert successfully tested the issue on his iPhone X running iOS 11.2.6.

The researcher had already reported this flaw to Apple in December last year, but Apple hasn’t yet fixed the bug to the date.

The bug is very dangerous and opens the doors to numerous attack scenarios.

Mueller reported the vulnerability to the Apple security team on 2017-12-23, but at the time I was writing the flaw is still present.