监控宝apache server status可公开访问 | wooyun-2014-062185| WooYun.org

漏洞概要关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-062185

漏洞标题：监控宝apache server status可公开访问

漏洞作者：木头影子

提交时间：2014-05-29 18:43

修复时间：2014-07-13 18:44

公开时间：2014-07-13 18:44

漏洞类型：系统/服务运维配置不当

危害等级：中

自评Rank：8

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签：无

4人收藏收藏
分享漏洞：

漏洞详情

披露状态：

2014-05-29：细节已通知厂商并且等待厂商处理中
2014-05-29：厂商已经确认，细节仅向厂商公开
2014-06-08：细节向核心白帽子及相关领域专家公开
2014-06-18：细节向普通白帽子公开
2014-06-28：细节向实习白帽子公开
2014-07-13：细节向公众公开

简要描述：

监控宝apache service status限制不够严谨，仍然可以直接访问。

详细说明：

细节决定成败，如果同样错误犯多次，还可以原谅么？
http://www.jiankongbao.com/server-status
一年前，就已经被提交漏洞
WooYun: 监控宝apache信息泄露
如今，这个问题还是存在，怎么说？
当然偶尔会报权限不够，不过还是可以轻易访问啊。
只能再敲打敲打了。

漏洞证明：

Apache Server Status for www.jiankongbao.com
Server Version: Apache/2.2.22 (Ubuntu) PHP/5.3.10-1ubuntu3 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1
Server Built: Feb 13 2012 01:51:50
Current Time: Saturday, 24-May-2014 18:45:58 HKT
Restart Time: Friday, 18-Apr-2014 18:16:32 HKT
Parent Server Generation: 8
Server uptime: 36 days 29 minutes 26 seconds
Total accesses: 54534579 - Total Traffic: 220.1 GB
CPU Usage: u977.93 s173.99 cu0 cs0 - .037% CPU load
17.5 requests/sec - 74.2 kB/second - 4333 B/request
4 requests currently being processed, 25 idle workers
________W__W____G_____G____....__...............................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
................
Scoreboard Key:
"_" Waiting for Connection, "S" Starting up, "R" Reading Request,
"W" Sending Reply, "K" Keepalive (read), "D" DNS Lookup,
"C" Closing connection, "L" Logging, "G" Gracefully finishing,
"I" Idle cleanup of worker, "." Open slot with no current process
Srv	PID	Acc	M	CPU	SS	Req	Conn	Child	Slot	Client	VHost	Request
0-8	12999	0/938/1826730	_	19.36	1	0	0.0	4.78	7575.02	127.0.0.1	www.jiankongbao.com	HEAD /check.txt HTTP/1.1
1-8	13601	0/412/1818229	_	8.62	1	0	0.0	2.65	7551.74	127.0.0.1	www.jiankongbao.com	HEAD /check.txt HTTP/1.1
2-8	13402	0/460/1812651	_	9.90	2	0	0.0	3.75	7485.91	127.0.0.1	www.jiankongbao.com	GET /img/yunzhihui/yongyou-logo.png HTTP/1.1
3-8	13611	0/398/1801382	_	8.75	2	8	0.0	3.91	7435.57	127.0.0.1	www.jiankongbao.com	GET /signin.php?refer=%2Fajax_wrapper.php%3Fcommand%3Dget_new_m
4-8	13613	0/392/1793341	_	8.91	0	663	0.0	3.35	7415.81	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=04c60792e00000001790000025148056d0b59c
5-8	13379	0/552/1784638	_	11.97	2	17	0.0	3.61	7344.28	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=c831717f0800000024970000284596ab423e19
6-8	13003	0/930/1774677	_	19.67	2	16	0.0	6.22	7303.93	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=75492 HTTP/
7-8	13022	0/913/1762395	_	19.56	0	21	0.0	4.74	7312.67	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=8b43122cd60000002729000000050837d6eb8c
8-8	13080	0/753/1751093	W	14.74	1	0	0.0	3.81	7251.16	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=84ec8349b200000029370000165468d5e8b728
9-8	13624	0/392/1745106	_	8.73	1	283	0.0	2.15	7242.85	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=940c174bd500000024650000278248f886ed76
10-8	13686	0/299/1732702	_	6.24	1	295	0.0	2.40	7186.19	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=ddaade203a0000000543000015624183c8e706
11-8	13629	0/329/1718096	W	7.24	0	0	0.0	2.32	7112.20	127.0.0.1	www.jiankongbao.com	GET /server-status HTTP/1.1
12-8	13630	0/332/1707778	_	7.46	1	0	0.0	1.70	7019.45	127.0.0.1	www.jiankongbao.com	GET /favicon.ico HTTP/1.1
13-8	13631	0/340/1698576	_	7.08	0	565	0.0	2.24	7017.30	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=050b04a98400000018530000263574214f5de0
14-8	13081	0/758/1675493	_	14.92	2	259	0.0	5.87	6922.68	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=6af9579c21000000113100002514801b994e6f
15-8	13993	0/157/1666299	_	3.83	0	787	0.0	0.47	6885.83	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=80a949bc7600000023570000147713e18cea8a
16-2	5936	0/108/616956	G	2.32	2019706	0	0.0	1.08	2412.14	127.0.0.1	www.jiankongbao.com	GET /sms.php HTTP/1.1
17-8	13694	0/297/1634983	_	5.22	0	469	0.0	2.36	6765.79	127.0.0.1	www.jiankongbao.com	POST /agent_post.php?key=d93abaf0080000000018000000595537ed58ea
18-8	13711	0/221/1630887	_	5.41	0	343	0.0	1.85	6741.01	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=134d01146100000008200000148209aaab8477
19-8	13259	0/718/1606401	_	16.04	2	628	0.0	4.13	6623.39	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=a4766c664700000011270000251480a23d695f
20-8	13262	0/692/1587513	_	14.09	1	64	0.0	6.24	6530.21	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=13917 HTTP/
21-8	13268	0/658/1565445	_	14.57	1	59	0.0	4.49	6433.88	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=30763 HTTP/
22-4	23546	0/538/1156831	G	10.88	802933	0	0.0	2.33	4388.83	127.0.0.1	www.jiankongbao.com	POST /jkb/account_dashboard_load/alert_sum/x HTTP/1.1
23-8	13301	0/593/1511862	_	11.89	0	258	0.0	2.64	6272.81	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=6af9579c21000000113100002514801b994e6f
24-8	13714	0/220/1484233	_	5.12	2	334	0.0	1.39	6160.81	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=bfdd63351f000000289000002845197a460644
25-8	13997	0/107/1467864	_	2.67	0	691	0.0	0.79	6050.13	127.0.0.1	www.jiankongbao.com	GET /jkb_status.php HTTP/1.1
26-8	14019	0/42/1418968	_	0.97	1	15	0.0	0.24	5886.75	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=696a0e81e700000031090000285177a9bf8959
27-8	-	0/0/1383206	.	12.68	1196	66	0.0	0.00	5710.33	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=87107 HTTP/
28-8	-	0/0/1324532	.	19.70	298	24	0.0	0.00	5490.69	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=bec5823061000000113000002514805b230544
29-8	-	0/0/1255632	.	20.79	71	4	0.0	0.00	5168.84	127.0.0.1	www.jiankongbao.com	GET /css/yunzhihui/css/bootstrap.min.css HTTP/1.1
30-8	-	0/0/1159664	.	20.14	77	56	0.0	0.00	4824.93	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=45849 HTTP/
31-8	13312	0/607/1014635	_	13.89	2	898	0.0	6.11	4276.15	127.0.0.1	www.jiankongbao.com	GET /img/yunzhihui/jkb-qrcode.jpg HTTP/1.1
32-8	13313	0/601/852271	_	12.72	1	64	0.0	3.89	3617.19	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=66550 HTTP/
33-8	-	0/0/674711	.	21.22	1678	0	0.0	0.00	2861.61	127.0.0.1	www.jiankongbao.com	GET /css/jkb.css HTTP/1.1
34-8	-	0/0/564274	.	19.58	1651	11	0.0	0.00	2381.09	127.0.0.1	www.jiankongbao.com	GET / HTTP/1.1
35-8	-	0/0/444608	.	18.36	5014	1458	0.0	0.00	1909.82	127.0.0.1	www.jiankongbao.com	GET /img/yunzhihui/jkb_photo_family.png HTTP/1.1
36-8	-	0/0/369496	.	15.74	30138	269	0.0	0.00	1571.02	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=a08a006e7600000024170000272458901a874a
37-8	-	0/0/292189	.	17.11	30102	69	0.0	0.00	1237.01	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_thumb_data&task_id=241683&tas
38-8	-	0/0/198628	.	16.96	30106	58	0.0	0.00	856.01	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=44581 HTTP/
39-8	-	0/0/164736	.	17.96	56525	61	0.0	0.00	712.39	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=21035 HTTP/
40-8	-	0/0/152370	.	18.17	56544	8	0.0	0.00	630.51	127.0.0.1	www.jiankongbao.com	GET / HTTP/1.1
41-8	-	0/0/142279	.	0.08	58740	0	0.0	0.00	593.49	127.0.0.1	www.jiankongbao.com	GET /scripts/jquery.datepick.package-3.7.1/flora.datepick.css H
42-8	-	0/0/121411	.	15.96	56990	4499	0.0	0.00	523.86	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=e37437092c00000010690000176254667c45f5
43-8	-	0/0/89407	.	19.96	56514	60	0.0	0.00	390.23	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=94195 HTTP/
44-8	-	0/0/66062	.	0.07	90797	32	0.0	0.00	284.37	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=4f869cbe7b000000131000002514808a7bfab6
45-8	-	0/0/49666	.	0.06	90806	75	0.0	0.00	208.91	125.39.31.6	qiye.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=67916 HTTP/
46-8	-	0/0/31292	.	25.32	89295	60	0.0	0.00	141.55	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=52284 HTTP/
47-8	-	0/0/22098	.	0.58	117777	63	0.0	0.00	96.79	124.207.192.114	qiye.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=23261 HTTP/
48-8	-	0/0/21192	.	0.28	177767	46	0.0	0.00	85.75	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=8137b0f516000000213800002514803982d299
49-8	-	0/0/25150	.	20.67	176422	61	0.0	0.00	98.33	111.206.74.120	qiye.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=24014 HTTP/
50-8	-	0/0/17809	.	0.22	177762	328	0.0	0.00	72.02	127.0.0.1	www.jiankongbao.com	GET /jkb/account_dashboard_load/fault_list_ing/x HTTP/1.1
51-8	-	0/0/14394	.	0.25	177769	13	0.0	0.00	60.21	127.0.0.1	www.jiankongbao.com	GET / HTTP/1.1
52-8	-	0/0/20153	.	22.63	176412	58	0.0	0.00	79.22	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=45093 HTTP/
53-8	-	0/0/21100	.	22.71	176423	62	0.0	0.00	82.73	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=19398 HTTP/
54-8	-	0/0/16976	.	0.09	177782	74	0.0	0.00	68.96	127.0.0.1	www.jiankongbao.com	GET /chart_data_cpu_time.php?task_id=197334&period=today&range=
55-8	-	0/0/15486	.	0.21	177766	15	0.0	0.00	64.77	127.0.0.1	www.jiankongbao.com	POST /jkb/account_dispose/signin/s HTTP/1.1
56-8	-	0/0/22135	.	22.66	176405	10	0.0	0.00	87.76	127.0.0.1	www.jiankongbao.com	GET /monitorip.php HTTP/1.1
57-8	-	0/0/19579	.	0.25	177765	0	0.0	0.00	74.32	127.0.0.1	www.jiankongbao.com	GET /scripts/jquery.datepick.package-3.7.1/jquery.datepick-zh-C
58-8	-	0/0/17966	.	0.11	177781	85	0.0	0.00	65.59	127.0.0.1	www.jiankongbao.com	GET /chart_data_netio_time.php?task_id=197336&ifname=p2p1&perio
59-8	-	0/0/11389	.	23.46	176378	13	0.0	0.00	51.14	127.0.0.1	www.jiankongbao.com	GET / HTTP/1.1
60-8	-	0/0/9522	.	22.37	176416	260	0.0	0.00	37.65	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=5af8dcdb4b00000016290000251480d52871ea
61-8	-	0/0/10088	.	20.71	176422	15	0.0	0.00	39.42	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=74717 HTTP/
62-8	-	0/0/8033	.	0.00	177787	453	0.0	0.00	27.80	127.0.0.1	www.jiankongbao.com	POST /agent_post.php?key=d93abaf0080000000018000000595537ed58ea
63-8	-	0/0/5675	.	0.78	201068	9	0.0	0.00	22.51	127.0.0.1	www.jiankongbao.com	GET / HTTP/1.1
64-8	-	0/0/7461	.	19.55	199927	11	0.0	0.00	28.12	127.0.0.1	api.jiankongbao.com	GET /v2/site/lists.json?access_token=&start_date=2014-05-22&end
65-8	-	0/0/3942	.	6.35	200701	59	0.0	0.00	16.12	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=57524 HTTP/
66-8	-	0/0/1597	.	1.31	287373	0	0.0	0.00	7.17	127.0.0.1	www.jiankongbao.com	GET /images/16-sinaweibo.gif HTTP/1.1
67-8	-	0/0/6550	.	2.77	287315	34	0.0	0.00	24.06	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=3cf7e7ecde000000107000002514806d5c0d75
68-8	-	0/0/2613	.	0.24	287463	67	0.0	0.00	8.42	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_user_notice_num&cache=65876 H
69-8	-	0/0/1833	.	0.76	287360	0	0.0	0.00	6.41	127.0.0.1	www.jiankongbao.com	GET /css/jkb.css HTTP/1.1
70-8	-	0/0/4501	.	20.88	286107	26	0.0	0.00	15.64	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=c357a0cb020000002359000028263189993e88
71-8	-	0/0/3197	.	0.08	287504	0	0.0	0.00	14.00	127.0.0.1	www.jiankongbao.com	GET /images/sn_add_images/mail/sn_telephone_icon.png HTTP/1.1
72-8	-	0/0/3477	.	21.61	286125	32	0.0	0.00	14.37	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=3cf7e7ecde000000107000002514806d5c0d75
73-8	-	0/0/4449	.	0.17	287419	82629	0.0	0.00	16.22	127.0.0.1	www.jiankongbao.com	GET /user_report_chart.php?t=5b3a4cc92ec6b528a8d6d8d5a5b92ddf04
74-8	-	0/0/2385	.	0.99	287418	59	0.0	0.00	9.39	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=17369 HTTP/
75-8	-	0/0/4397	.	0.18	287495	6633	0.0	0.00	18.22	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=af5e805b1900000009140000242833c14a2b45
76-8	-	0/0/6657	.	0.07	287487	35	0.0	0.00	22.80	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=6fc249334a00000012200000251480ad306a01
77-8	-	0/0/3933	.	0.08	287502	0	0.0	0.00	12.34	127.0.0.1	www.jiankongbao.com	GET /images/16-sinaweibo.gif HTTP/1.1
78-8	-	0/0/1898	.	6.10	287475	262	0.0	0.00	6.97	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=a4405462bf000000136700002514807c087a4c
79-8	-	0/0/2252	.	0.02	287510	21	0.0	0.00	9.68	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=5d52577fdb000000055900001477134021fc19
80-8	-	0/0/1512	.	0.60	287465	54	0.0	0.00	7.07	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=36099 HTTP/
81-8	-	0/0/4795	.	1.48	287398	62	0.0	0.00	18.02	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=3488 HTTP/1
82-8	-	0/0/6161	.	0.26	287478	0	0.0	0.00	22.67	127.0.0.1	www.jiankongbao.com	GET /images/16-qqweibo.gif HTTP/1.1
83-8	-	0/0/2776	.	5.79	287482	1	0.0	0.00	10.45	127.0.0.1	www.jiankongbao.com	GET /css/jkb.css HTTP/1.1
84-8	-	0/0/5865	.	5.51	287409	25	0.0	0.00	20.89	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=e65b78642c00000012220000251480d541876b
85-8	-	0/0/3146	.	0.37	287460	25	0.0	0.00	9.91	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=d64c50957300000014170000251480cf5d35ce
86-8	-	0/0/4486	.	5.25	287417	134437	0.0	0.00	17.53	127.0.0.1	api.jiankongbao.com	GET /site/task/438825/report.json HTTP/1.1
87-8	-	0/0/5133	.	0.91	287434	0	0.0	0.00	19.48	127.0.0.1	www.jiankongbao.com	GET /scripts/main.js?v1.4.4 HTTP/1.1
88-8	-	0/0/3225	.	0.57	287358	237	0.0	0.00	12.85	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=8137b0f516000000213800002514803982d299
89-8	-	0/0/5197	.	6.86	287347	306	0.0	0.00	18.51	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=834b1bb14d000000113200002514803ca08f77
90-8	-	0/0/5486	.	2.37	287356	0	0.0	0.00	21.80	127.0.0.1	www.jiankongbao.com	GET /css/siteview.css HTTP/1.1
91-8	-	0/0/3271	.	6.59	287404	0	0.0	0.00	14.05	127.0.0.1	www.jiankongbao.com	HEAD /check.txt HTTP/1.1
92-8	-	0/0/1438	.	1.65	287399	61	0.0	0.00	5.18	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=97110 HTTP/
93-8	-	0/0/726	.	5.43	287408	25	0.0	0.00	3.53	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=af5e805b1900000009140000242833c14a2b45
94-8	-	0/0/4716	.	5.36	287455	325	0.0	0.00	15.39	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=213bffdd0800000016750000226296bd54c38d
95-8	-	0/0/2660	.	0.15	287488	17	0.0	0.00	11.68	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=24285 HTTP/
96-8	-	0/0/364	.	0.56	287834	0	0.0	0.00	1.05	127.0.0.1	www.jiankongbao.com	GET /js/yunzhihui/html5shiv.min.js HTTP/1.1
97-4	-	0/0/416	.	1.90	977015	72	0.0	0.00	1.51	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=89607 HTTP/
98-4	-	0/0/1542	.	0.74	977041	0	0.0	0.00	6.04	127.0.0.1	www.jiankongbao.com	GET /css/agent.css HTTP/1.1
99-4	-	0/0/1192	.	23.39	975884	0	0.0	0.00	3.39	127.0.0.1	www.jiankongbao.com	HEAD /check.txt HTTP/1.1
100-4	-	0/0/1203	.	3.38	977092	73	0.0	0.00	4.29	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=53381 HTTP/
101-4	-	0/0/182	.	0.33	977081	84	0.0	0.00	0.51	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=83228 HTTP/
102-4	-	0/0/2053	.	26.54	975887	64	0.0	0.00	7.73	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=31405 HTTP/
103-4	-	0/0/1797	.	23.81	976908	67	0.0	0.00	5.29	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=81896 HTTP/
104-4	-	0/0/3172	.	29.31	976002	37	0.0	0.00	10.47	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=72a20354190000001792000025148062c942e0
105-4	-	0/0/1064	.	8.18	976980	629	0.0	0.00	4.81	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=22e29c6c32000000248800001654160bc20aee
106-4	-	0/0/498	.	8.55	977058	0	0.0	0.00	1.73	127.0.0.1	www.jiankongbao.com	GET /images/sn_add_images/index/area_bottom_line.png HTTP/1.1
107-4	-	0/0/854	.	8.97	977096	0	0.0	0.00	2.52	192.168.2.4	www.jiankongbao.com	HEAD /check.txt HTTP/1.1
108-4	-	0/0/2785	.	2.99	977064	0	0.0	0.00	10.18	127.0.0.1	www.jiankongbao.com	GET /images/sn_add_images/index/function_area_api_blur.png HTTP
109-4	-	0/0/2033	.	24.96	975708	74	0.0	0.00	6.61	127.0.0.1	www.jiankongbao.com	GET /ajax_wrapper.php?command=get_new_msg_sum&cache=97993 HTTP/
110-4	-	0/0/1577	.	25.71	975797	28	0.0	0.00	3.95	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=1110c8d88100000011290000251480501b04f0
111-4	-	0/0/1105	.	21.87	975786	0	0.0	0.00	3.69	127.0.0.1	www.jiankongbao.com	GET /scripts/index.js?1387787460 HTTP/1.1
112-4	-	0/0/1156	.	23.09	975782	113	0.0	0.00	3.86	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=9607710f5d0000001791000025148046982643
113-4	-	0/0/592	.	12.25	977089	0	0.0	0.00	1.53	127.0.0.1	www.jiankongbao.com	GET /images/sn_add_images/product/http.png HTTP/1.1
114-4	-	0/0/1361	.	5.44	976777	37	0.0	0.00	4.20	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=b51197e47d000000196200002514807f57dda4
115-4	-	0/0/1234	.	0.85	977035	20	0.0	0.00	5.59	127.0.0.1	plugin.jiankongbao.com	POST /agent_post.php?key=eacc8fff8800000027160000286899c4352790
116-4	-	0/0/2454	.	19.65	977063	0	0.0	0.00	8.52	127.0.0.1	www.jiankongbao.com	GET /images/logo/xibushuma.gif HTTP/1.1
117-4	-	0/0/2203	.	3.25	977073	0	0.0	0.00	7.26	127.0.0.1	www.jiankongbao.com	GET /images/logo/yupoo.gif HTTP/1.1
118-4	-	0/0/610	.	4.28	977013	0	0.0	0.00	2.15	127.0.0.1	www.jiankongbao.com	GET /images/logo/51idc.gif HTTP/1.1
119-4	-	0/0/454	.	11.00	977033	0	0.0	0.00	1.70	127.0.0.1	plugin.jiankongbao.com	GET /agent/plugin/CustomPlugin.py HTTP/1.1
Srv	Child Server number - generation
PID	OS process ID
Acc	Number of accesses this connection / this child / this slot
M	Mode of operation
CPU	CPU usage, number of seconds
SS	Seconds since beginning of most recent request
Req	Milliseconds required to process most recent request
Conn	Kilobytes transferred this connection
Child	Megabytes transferred this child
Slot	Total megabytes transferred this slot
SSL/TLS Session Cache Status:
cache type: SHMCB, shared memory: 512000 bytes, current sessions: 15
subcaches: 32, indexes per subcache: 133
time left on oldest entries' SSL sessions: avg: 191 seconds, (range: 66...204)
index usage: 0%, cache usage: 0%
total sessions stored since starting: 31472
total sessions expired since starting: 31457
total (pre-expiry) sessions scrolled out of the cache: 0
total retrieves since starting: 38505 hit, 15669 miss
total removes since starting: 0 hit, 0 miss
Apache/2.2.22 (Ubuntu) Server at www.jiankongbao.com Port 80

访问多次还是会报

You don't have permission to access /server-status on this server.
Apache/2.2.20 (Ubuntu) Server at www.jiankongbao.com Port 80

显然你们知道限制权限了，但是不够严谨。

修复方案：

仍借用上次漏洞作者的话，身为专业运维的你，肯定比我更懂啦。

版权声明：转载请注明来源木头影子@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：6

确认时间：2014-05-29 20:08

厂商回复：

非常感谢 “木头影子” 同学的“敲打”！

WooYun.org

漏洞概要关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-062185

漏洞标题：监控宝apache server status可公开访问

相关厂商：监控宝

漏洞作者：木头影子

提交时间：2014-05-29 18:43

修复时间：2014-07-13 18:44

公开时间：2014-07-13 18:44

漏洞类型：系统/服务运维配置不当

危害等级：中

自评Rank：8

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签：无

4人收藏收藏
分享漏洞：

漏洞详情

披露状态：

简要描述：

详细说明：

漏洞证明：

修复方案：

版权声明：转载请注明来源木头影子@乌云

漏洞回应

厂商回应：

厂商回复：

最新状态：

WooYun.org

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-062185

漏洞标题：监控宝apache server status可公开访问

相关厂商：监控宝

漏洞作者： 木头影子

提交时间：2014-05-29 18:43

修复时间：2014-07-13 18:44

公开时间：2014-07-13 18:44

漏洞类型：系统/服务运维配置不当

危害等级：中

自评Rank：8

漏洞状态：厂商已经确认

Tags标签： 无

4人收藏 收藏 var token=""; var id="wooyun-2014-062185"; $(".btn-fav").click(function(){ CollectBug(id,token); }); 分享漏洞：

漏洞详情

披露状态：

简要描述：

详细说明：

漏洞证明：

修复方案：

版权声明：转载请注明来源 木头影子@乌云

漏洞回应

厂商回应：

厂商回复：

最新状态：

漏洞概要关注数(24) 关注此漏洞

漏洞作者：木头影子

Tags标签：无

4人收藏收藏
分享漏洞：

版权声明：转载请注明来源木头影子@乌云