Editing FailMail
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
FailMail is an Exploit in the | == Introduction == | ||
FailMail is an Exploit in the PSVita Mail application, | |||
that allowed for System Uri Calling, (which resulted in an Arbitrary File Read) and Arbitrary File Writing | |||
It was patched in [[3.55]] and above firmware's | |||
= | == Arbitrary File Writing == | ||
This is achieved by making the name of the attachment be "../../../" and then the path to the file you wanted to overwrite, | |||
this worked because on [[3.55]] email attachments are saved to ux0:/temp/email/ as there full name which would become ux0:/temp/email/../../../ux0:/id.dat which would overwrite id.dat. | |||
however, in 3.55 and above, there is an additional check to get the filename of the email excluding the path and write it there with that name instead, and in later firmwares, you cant do "../" to leave the current partition either. | |||
== System URI Calling == | |||
(system uri's are URI's defined in param.sfo surrounded by triangle brackets. and they can only be run by the system and not the browser) | |||
This was achieved simply by receiving an email with an <a href to a System URI for example. if you did <a href="psnreg:">Run PSN Reg</a> | |||
when you clicked the link inside the email app. it'd run it, this was also fixed in [[3.55]] simply by adding a check if the URI you clicked on | |||
is not a SYSTEM uri. | |||
== System URI | |||
There was also a bug that came about because of this that allowed you to dump any file you wanted, if you called 'email:send?attach=' and then a path to a file you could add any file on the system that you wanted as an attachment and then send it to yourself. this was addressed in [[3.57]] where now the email application can only attach files from photo0: and ux0:/calendar anywhere else will result in a 0byte file being sent. | There was also a bug that came about because of this that allowed you to dump any file you wanted, if you called 'email:send?attach=' and then a path to a file you could add any file on the system that you wanted as an attachment and then send it to yourself. this was addressed in [[3.57]] where now the email application can only attach files from photo0: and ux0:/calendar anywhere else will result in a 0byte file being sent. | ||