当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-087669

漏洞标题：某APP平台数据库未授权访问 (移动mm网页支付)

相关厂商：豪腾嘉科

漏洞作者： 龍 、

提交时间：2014-12-18 14:53

修复时间：2015-02-01 14:54

公开时间：2015-02-01 14:54

漏洞类型：未授权访问/权限绕过

危害等级：高

自评Rank：20

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-12-18： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-02-01： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

移动mm网页支付-我方私钥:

详细说明：

QQ图片20141218135922.png


QQ图片20141218140225.png


QQ图片20141218140247.jpg


114.215.143.59


/* 0 */
{
  "_id" : "com.hortorgames.bonus2",
  "clientKey" : "54fca2e7bde84b00ae941d7963a8d466",
  "name" : "疯狂来找钱2",
  "notifyUrl" : "",
  "notifyUrlProduction" : "",
  "notifyUrlSandbox" : "",
  "secret" : {
    "appstore" : "ba7f7f31baff4c7485aafc619dae66ce",
    "chinaunicom" : "bonus2-unicom",
    "chinatelecom" : "bonus2-telecom"
  },
  "serverKey" : "5dae9a006a5a4363b60959ea0873e455"
}
/* 1 */
{
  "_id" : "com.hortorgames.minigames",
  "name" : "疯狂小游戏",
  "serverKey" : "f0d3648339efbf43d58c2d1e",
  "clientKey" : "7abbc8efe816413244358c9c",
  "__v" : 0,
  "secret" : {
    "chinamobile_web_hortor_public" : "-----BEGIN PUBLIC KEY-----\nMIIBtzCCASwGByqGSM44BAEwggEfAoGBANqAIVtMgOloJ/rDECZRysiHphdEjw01\njwA65JFs3MX6896C8KsjiT5mrOhLFg71D+HDYhSkbtZop3Wn1yhfU7G+TH6hr3Nm\nN5M5p4tAz+JExuSMEbwWvWSCxGD49yy7+u6+9BRAyhalswJA8Qbl9sfPzy+r4M2n\n1RxkepqpljcVAhUA7wfjHo/GRFc+3cCp/cvMF1XjzWkCgYEAw9RZiEfFnaTKby1O\naqPlX2iDQs9uW/tQB3x7gIqZzyx90ZckH6CP4aFkN1iFtndF5UZCzk2+EzokF2+v\nge262iABlJEzoTb0S+TWLdsoPx5fd95eABhIldSmeRCgBgapk52Ztn0q5k/iK2YE\nisgWwHo9Gs6ZnjDD1OLfEbSXH2sDgYQAAoGAayta0oKxJHxZofwVjPEGi6NB0F8k\nnHlq2isKVRRuFUDjecbsR8bM8+PeitPHAv6qUY81EGWzEXONnvIMy9FgIV2Vx0Is\nMkZqspzwzlhuZY7OBbx91sw/uM3ZYLUxga19F0baRR0l3CRaYI0H4oljUjnE1Y93\n3rMTkgB881k3tWU=\n-----END PUBLIC KEY-----",
    "chinamobile_web_hortor_private" : "-----BEGIN DSA PRIVATE KEY-----\nMIIBuwIBAAKBgQDagCFbTIDpaCf6wxAmUcrIh6YXRI8NNY8AOuSRbNzF+vPegvCr\nI4k+ZqzoSxYO9Q/hw2IUpG7WaKd1p9coX1Oxvkx+oa9zZjeTOaeLQM/iRMbkjBG8\nFr1kgsRg+Pcsu/ruvvQUQMoWpbMCQPEG5fbHz88vq+DNp9UcZHqaqZY3FQIVAO8H\n4x6PxkRXPt3Aqf3LzBdV481pAoGBAMPUWYhHxZ2kym8tTmqj5V9og0LPblv7UAd8\ne4CKmc8sfdGXJB+gj+GhZDdYhbZ3ReVGQs5NvhM6JBdvr4HtutogAZSRM6E29Evk\n1i3bKD8eX3feXgAYSJXUpnkQoAYGqZOdmbZ9KuZP4itmBIrIFsB6PRrOmZ4ww9Ti\n3xG0lx9rAoGAayta0oKxJHxZofwVjPEGi6NB0F8knHlq2isKVRRuFUDjecbsR8bM\n8+PeitPHAv6qUY81EGWzEXONnvIMy9FgIV2Vx0IsMkZqspzwzlhuZY7OBbx91sw/\nuM3ZYLUxga19F0baRR0l3CRaYI0H4oljUjnE1Y933rMTkgB881k3tWUCFDmhePw9\n6GVTZlVRkX8bUjVelgTc\n-----END DSA PRIVATE KEY-----",
    "chinamobile_web_cmcc_public" : "-----BEGIN PUBLIC KEY-----\nMIIBuDCCASwGByqGSM44BAEwggEfAoGBAP1/U4EddRIpUt9KnC7s5Of2EbdSPO9E\nAMMeP4C2USZpRV1AIlH7WT2NWPq/xfW6MPbLm1Vs14E7gB00b/JmYLdrmVClpJ+f\n6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E+4P208UewwI1VBNaFpEy9nXzrith1yrv\n8iIDGZ3RSAHHAhUAl2BQjxUjC8yykrmCouuEC/BYHPUCgYEA9+GghdabPd7LvKtc\nNrhXuXmUr7v6OuqC+VdMCz0HgmdRWVeOutRZT+ZxBxCBgLRJFnEj6EwoFhO3zwky\njMim4TwWeotUfI0o4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImog9/h\nWuWfBpKLZl6Ae1UlZAFMO/7PSSoDgYUAAoGBAOMqE8A3Wob9LSSGjlz2E9l7Y4FH\n6Jz1mQVqTYueApYLASJC4sQQwmy86eBvvbn9R1IrXDfHFSpBOAO3dOq5y1WBo+pY\n6SprDlvtP+Zq3m3xsA8x//2phzSkbRwR0rdJd/r8OCg4B9jlOzz12be/kpE4Ings\nXuC4MK01r7qYt/zC\n-----END PUBLIC KEY-----"
  }
}
/* 2 */
{
  "_id" : "com.hortorgames.crazycaicai",
  "name" : "疯狂猜猜猜",
  "secret" : {
    "appstore" : "ba7f7f31baff4c7485aafc619dae66ce"
  },
  "serverKey" : "320ee92e9d76da6cadb23bf6",
  "clientKey" : "f16e153235a0130e9f5e6ac9",
  "__v" : 0
}
/* 3 */
{
  "_id" : "com.hortorgames.lianliankan",
  "name" : "疯狂连连看",
  "serverKey" : "9f8ce9739dd48878537c68d1",
  "clientKey" : "ad28d7f28e740d4bf31f7a58",
  "__v" : 0
}
/* 4 */
{
  "_id" : "com.hortorgames.playground",
  "clientKey" : "945cf3a329e9591e22cf2d57",
  "name" : "疯狂游乐场",
  "notifyUrl" : "http://api.pg.hortorgames.com/player/recharge",
  "notifyUrlProduction" : "http://test.api.pg.hortorgames.com:8080/player/recharge",
  "notifyUrlSandbox" : "http://test.api.pg.hortorgames.com/player/recharge",
  "secret" : {
    "appstore" : "ba7f7f31baff4c7485aafc619dae66ce",
    "chinaunicom" : "pgunicom",
    "chinatelecom" : "pgtelecom",
    "chinamobile_web_hortor_public" : "-----BEGIN PUBLIC KEY-----\nMIIBtzCCASwGByqGSM44BAEwggEfAoGBANqAIVtMgOloJ/rDECZRysiHphdEjw01\njwA65JFs3MX6896C8KsjiT5mrOhLFg71D+HDYhSkbtZop3Wn1yhfU7G+TH6hr3Nm\nN5M5p4tAz+JExuSMEbwWvWSCxGD49yy7+u6+9BRAyhalswJA8Qbl9sfPzy+r4M2n\n1RxkepqpljcVAhUA7wfjHo/GRFc+3cCp/cvMF1XjzWkCgYEAw9RZiEfFnaTKby1O\naqPlX2iDQs9uW/tQB3x7gIqZzyx90ZckH6CP4aFkN1iFtndF5UZCzk2+EzokF2+v\nge262iABlJEzoTb0S+TWLdsoPx5fd95eABhIldSmeRCgBgapk52Ztn0q5k/iK2YE\nisgWwHo9Gs6ZnjDD1OLfEbSXH2sDgYQAAoGAayta0oKxJHxZofwVjPEGi6NB0F8k\nnHlq2isKVRRuFUDjecbsR8bM8+PeitPHAv6qUY81EGWzEXONnvIMy9FgIV2Vx0Is\nMkZqspzwzlhuZY7OBbx91sw/uM3ZYLUxga19F0baRR0l3CRaYI0H4oljUjnE1Y93\n3rMTkgB881k3tWU=\n-----END PUBLIC KEY-----",
    "chinamobile_web_cmcc_public" : "-----BEGIN PUBLIC KEY-----\nMIIBuDCCASwGByqGSM44BAEwggEfAoGBAP1/U4EddRIpUt9KnC7s5Of2EbdSPO9E\nAMMeP4C2USZpRV1AIlH7WT2NWPq/xfW6MPbLm1Vs14E7gB00b/JmYLdrmVClpJ+f\n6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E+4P208UewwI1VBNaFpEy9nXzrith1yrv\n8iIDGZ3RSAHHAhUAl2BQjxUjC8yykrmCouuEC/BYHPUCgYEA9+GghdabPd7LvKtc\nNrhXuXmUr7v6OuqC+VdMCz0HgmdRWVeOutRZT+ZxBxCBgLRJFnEj6EwoFhO3zwky\njMim4TwWeotUfI0o4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImog9/h\nWuWfBpKLZl6Ae1UlZAFMO/7PSSoDgYUAAoGBALcatZanPRt62/VskSDATpbw1Jht\nqPr1FVshZE6Dy9KqSvDZGpRyHPG8nurnhXKpJCANLQQehYl144LLFtNmoZL0nURz\nC6970NN34BSF7JkNDFzoWXAwiWxnQW+oV8nsrEQ0wbv/oS3nq//Rlv8ppKatUMhx\nwUhd9zg8+01Rx8MM\n-----END PUBLIC KEY-----",
    "chinamobile_web_hortor_private" : "-----BEGIN DSA PRIVATE KEY-----\nMIIBuwIBAAKBgQDagCFbTIDpaCf6wxAmUcrIh6YXRI8NNY8AOuSRbNzF+vPegvCr\nI4k+ZqzoSxYO9Q/hw2IUpG7WaKd1p9coX1Oxvkx+oa9zZjeTOaeLQM/iRMbkjBG8\nFr1kgsRg+Pcsu/ruvvQUQMoWpbMCQPEG5fbHz88vq+DNp9UcZHqaqZY3FQIVAO8H\n4x6PxkRXPt3Aqf3LzBdV481pAoGBAMPUWYhHxZ2kym8tTmqj5V9og0LPblv7UAd8\ne4CKmc8sfdGXJB+gj+GhZDdYhbZ3ReVGQs5NvhM6JBdvr4HtutogAZSRM6E29Evk\n1i3bKD8eX3feXgAYSJXUpnkQoAYGqZOdmbZ9KuZP4itmBIrIFsB6PRrOmZ4ww9Ti\n3xG0lx9rAoGAayta0oKxJHxZofwVjPEGi6NB0F8knHlq2isKVRRuFUDjecbsR8bM\n8+PeitPHAv6qUY81EGWzEXONnvIMy9FgIV2Vx0IsMkZqspzwzlhuZY7OBbx91sw/\nuM3ZYLUxga19F0baRR0l3CRaYI0H4oljUjnE1Y933rMTkgB881k3tWUCFDmhePw9\n6GVTZlVRkX8bUjVelgTc\n-----END DSA PRIVATE KEY-----"
  },
  "serverKey" : "286b8f21cf06e9c2fcb05289"
}

漏洞证明：

/* 0 */
{
  "_id" : "com.hortorgames.bonus2",
  "clientKey" : "54fca2e7bde84b00ae941d7963a8d466",
  "name" : "疯狂来找钱2",
  "notifyUrl" : "",
  "notifyUrlProduction" : "",
  "notifyUrlSandbox" : "",
  "secret" : {
    "appstore" : "ba7f7f31baff4c7485aafc619dae66ce",
    "chinaunicom" : "bonus2-unicom",
    "chinatelecom" : "bonus2-telecom"
  },
  "serverKey" : "5dae9a006a5a4363b60959ea0873e455"
}
/* 1 */
{
  "_id" : "com.hortorgames.minigames",
  "name" : "疯狂小游戏",
  "serverKey" : "f0d3648339efbf43d58c2d1e",
  "clientKey" : "7abbc8efe816413244358c9c",
  "__v" : 0,
  "secret" : {
    "chinamobile_web_hortor_public" : "-----BEGIN PUBLIC KEY-----\nMIIBtzCCASwGByqGSM44BAEwggEfAoGBANqAIVtMgOloJ/rDECZRysiHphdEjw01\njwA65JFs3MX6896C8KsjiT5mrOhLFg71D+HDYhSkbtZop3Wn1yhfU7G+TH6hr3Nm\nN5M5p4tAz+JExuSMEbwWvWSCxGD49yy7+u6+9BRAyhalswJA8Qbl9sfPzy+r4M2n\n1RxkepqpljcVAhUA7wfjHo/GRFc+3cCp/cvMF1XjzWkCgYEAw9RZiEfFnaTKby1O\naqPlX2iDQs9uW/tQB3x7gIqZzyx90ZckH6CP4aFkN1iFtndF5UZCzk2+EzokF2+v\nge262iABlJEzoTb0S+TWLdsoPx5fd95eABhIldSmeRCgBgapk52Ztn0q5k/iK2YE\nisgWwHo9Gs6ZnjDD1OLfEbSXH2sDgYQAAoGAayta0oKxJHxZofwVjPEGi6NB0F8k\nnHlq2isKVRRuFUDjecbsR8bM8+PeitPHAv6qUY81EGWzEXONnvIMy9FgIV2Vx0Is\nMkZqspzwzlhuZY7OBbx91sw/uM3ZYLUxga19F0baRR0l3CRaYI0H4oljUjnE1Y93\n3rMTkgB881k3tWU=\n-----END PUBLIC KEY-----",
    "chinamobile_web_hortor_private" : "-----BEGIN DSA PRIVATE KEY-----\nMIIBuwIBAAKBgQDagCFbTIDpaCf6wxAmUcrIh6YXRI8NNY8AOuSRbNzF+vPegvCr\nI4k+ZqzoSxYO9Q/hw2IUpG7WaKd1p9coX1Oxvkx+oa9zZjeTOaeLQM/iRMbkjBG8\nFr1kgsRg+Pcsu/ruvvQUQMoWpbMCQPEG5fbHz88vq+DNp9UcZHqaqZY3FQIVAO8H\n4x6PxkRXPt3Aqf3LzBdV481pAoGBAMPUWYhHxZ2kym8tTmqj5V9og0LPblv7UAd8\ne4CKmc8sfdGXJB+gj+GhZDdYhbZ3ReVGQs5NvhM6JBdvr4HtutogAZSRM6E29Evk\n1i3bKD8eX3feXgAYSJXUpnkQoAYGqZOdmbZ9KuZP4itmBIrIFsB6PRrOmZ4ww9Ti\n3xG0lx9rAoGAayta0oKxJHxZofwVjPEGi6NB0F8knHlq2isKVRRuFUDjecbsR8bM\n8+PeitPHAv6qUY81EGWzEXONnvIMy9FgIV2Vx0IsMkZqspzwzlhuZY7OBbx91sw/\nuM3ZYLUxga19F0baRR0l3CRaYI0H4oljUjnE1Y933rMTkgB881k3tWUCFDmhePw9\n6GVTZlVRkX8bUjVelgTc\n-----END DSA PRIVATE KEY-----",
    "chinamobile_web_cmcc_public" : "-----BEGIN PUBLIC KEY-----\nMIIBuDCCASwGByqGSM44BAEwggEfAoGBAP1/U4EddRIpUt9KnC7s5Of2EbdSPO9E\nAMMeP4C2USZpRV1AIlH7WT2NWPq/xfW6MPbLm1Vs14E7gB00b/JmYLdrmVClpJ+f\n6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E+4P208UewwI1VBNaFpEy9nXzrith1yrv\n8iIDGZ3RSAHHAhUAl2BQjxUjC8yykrmCouuEC/BYHPUCgYEA9+GghdabPd7LvKtc\nNrhXuXmUr7v6OuqC+VdMCz0HgmdRWVeOutRZT+ZxBxCBgLRJFnEj6EwoFhO3zwky\njMim4TwWeotUfI0o4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImog9/h\nWuWfBpKLZl6Ae1UlZAFMO/7PSSoDgYUAAoGBAOMqE8A3Wob9LSSGjlz2E9l7Y4FH\n6Jz1mQVqTYueApYLASJC4sQQwmy86eBvvbn9R1IrXDfHFSpBOAO3dOq5y1WBo+pY\n6SprDlvtP+Zq3m3xsA8x//2phzSkbRwR0rdJd/r8OCg4B9jlOzz12be/kpE4Ings\nXuC4MK01r7qYt/zC\n-----END PUBLIC KEY-----"
  }
}
/* 2 */
{
  "_id" : "com.hortorgames.crazycaicai",
  "name" : "疯狂猜猜猜",
  "secret" : {
    "appstore" : "ba7f7f31baff4c7485aafc619dae66ce"
  },
  "serverKey" : "320ee92e9d76da6cadb23bf6",
  "clientKey" : "f16e153235a0130e9f5e6ac9",
  "__v" : 0
}
/* 3 */
{
  "_id" : "com.hortorgames.lianliankan",
  "name" : "疯狂连连看",
  "serverKey" : "9f8ce9739dd48878537c68d1",
  "clientKey" : "ad28d7f28e740d4bf31f7a58",
  "__v" : 0
}
/* 4 */
{
  "_id" : "com.hortorgames.playground",
  "clientKey" : "945cf3a329e9591e22cf2d57",
  "name" : "疯狂游乐场",
  "notifyUrl" : "http://api.pg.hortorgames.com/player/recharge",
  "notifyUrlProduction" : "http://test.api.pg.hortorgames.com:8080/player/recharge",
  "notifyUrlSandbox" : "http://test.api.pg.hortorgames.com/player/recharge",
  "secret" : {
    "appstore" : "ba7f7f31baff4c7485aafc619dae66ce",
    "chinaunicom" : "pgunicom",
    "chinatelecom" : "pgtelecom",
    "chinamobile_web_hortor_public" : "-----BEGIN PUBLIC KEY-----\nMIIBtzCCASwGByqGSM44BAEwggEfAoGBANqAIVtMgOloJ/rDECZRysiHphdEjw01\njwA65JFs3MX6896C8KsjiT5mrOhLFg71D+HDYhSkbtZop3Wn1yhfU7G+TH6hr3Nm\nN5M5p4tAz+JExuSMEbwWvWSCxGD49yy7+u6+9BRAyhalswJA8Qbl9sfPzy+r4M2n\n1RxkepqpljcVAhUA7wfjHo/GRFc+3cCp/cvMF1XjzWkCgYEAw9RZiEfFnaTKby1O\naqPlX2iDQs9uW/tQB3x7gIqZzyx90ZckH6CP4aFkN1iFtndF5UZCzk2+EzokF2+v\nge262iABlJEzoTb0S+TWLdsoPx5fd95eABhIldSmeRCgBgapk52Ztn0q5k/iK2YE\nisgWwHo9Gs6ZnjDD1OLfEbSXH2sDgYQAAoGAayta0oKxJHxZofwVjPEGi6NB0F8k\nnHlq2isKVRRuFUDjecbsR8bM8+PeitPHAv6qUY81EGWzEXONnvIMy9FgIV2Vx0Is\nMkZqspzwzlhuZY7OBbx91sw/uM3ZYLUxga19F0baRR0l3CRaYI0H4oljUjnE1Y93\n3rMTkgB881k3tWU=\n-----END PUBLIC KEY-----",
    "chinamobile_web_cmcc_public" : "-----BEGIN PUBLIC KEY-----\nMIIBuDCCASwGByqGSM44BAEwggEfAoGBAP1/U4EddRIpUt9KnC7s5Of2EbdSPO9E\nAMMeP4C2USZpRV1AIlH7WT2NWPq/xfW6MPbLm1Vs14E7gB00b/JmYLdrmVClpJ+f\n6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E+4P208UewwI1VBNaFpEy9nXzrith1yrv\n8iIDGZ3RSAHHAhUAl2BQjxUjC8yykrmCouuEC/BYHPUCgYEA9+GghdabPd7LvKtc\nNrhXuXmUr7v6OuqC+VdMCz0HgmdRWVeOutRZT+ZxBxCBgLRJFnEj6EwoFhO3zwky\njMim4TwWeotUfI0o4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImog9/h\nWuWfBpKLZl6Ae1UlZAFMO/7PSSoDgYUAAoGBALcatZanPRt62/VskSDATpbw1Jht\nqPr1FVshZE6Dy9KqSvDZGpRyHPG8nurnhXKpJCANLQQehYl144LLFtNmoZL0nURz\nC6970NN34BSF7JkNDFzoWXAwiWxnQW+oV8nsrEQ0wbv/oS3nq//Rlv8ppKatUMhx\nwUhd9zg8+01Rx8MM\n-----END PUBLIC KEY-----",
    "chinamobile_web_hortor_private" : "-----BEGIN DSA PRIVATE KEY-----\nMIIBuwIBAAKBgQDagCFbTIDpaCf6wxAmUcrIh6YXRI8NNY8AOuSRbNzF+vPegvCr\nI4k+ZqzoSxYO9Q/hw2IUpG7WaKd1p9coX1Oxvkx+oa9zZjeTOaeLQM/iRMbkjBG8\nFr1kgsRg+Pcsu/ruvvQUQMoWpbMCQPEG5fbHz88vq+DNp9UcZHqaqZY3FQIVAO8H\n4x6PxkRXPt3Aqf3LzBdV481pAoGBAMPUWYhHxZ2kym8tTmqj5V9og0LPblv7UAd8\ne4CKmc8sfdGXJB+gj+GhZDdYhbZ3ReVGQs5NvhM6JBdvr4HtutogAZSRM6E29Evk\n1i3bKD8eX3feXgAYSJXUpnkQoAYGqZOdmbZ9KuZP4itmBIrIFsB6PRrOmZ4ww9Ti\n3xG0lx9rAoGAayta0oKxJHxZofwVjPEGi6NB0F8knHlq2isKVRRuFUDjecbsR8bM\n8+PeitPHAv6qUY81EGWzEXONnvIMy9FgIV2Vx0IsMkZqspzwzlhuZY7OBbx91sw/\nuM3ZYLUxga19F0baRR0l3CRaYI0H4oljUjnE1Y933rMTkgB881k3tWUCFDmhePw9\n6GVTZlVRkX8bUjVelgTc\n-----END DSA PRIVATE KEY-----"
  },
  "serverKey" : "286b8f21cf06e9c2fcb05289"
}

修复方案：

版权声明：转载请注明来源 龍 、@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝