漏洞概要 关注数(24) 关注此漏洞
缺陷编号:wooyun-2015-0136221
漏洞标题:e家洁存在严重安全漏洞可导致所有会员泄密
相关厂商:1jiajie.com
漏洞作者: Budi
提交时间:2015-09-09 19:27
修复时间:2015-10-25 20:34
公开时间:2015-10-25 20:34
漏洞类型:设计缺陷/逻辑错误
危害等级:高
自评Rank:15
漏洞状态:厂商已经确认
漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]
Tags标签: 无
漏洞详情
披露状态:
2015-09-09: 细节已通知厂商并且等待厂商处理中
2015-09-10: 厂商已经确认,细节仅向厂商公开
2015-09-20: 细节向核心白帽子及相关领域专家公开
2015-09-30: 细节向普通白帽子公开
2015-10-10: 细节向实习白帽子公开
2015-10-25: 细节向公众公开
简要描述:
e家洁的Session设置存在严重安全漏洞,可导致所有会员泄密
详细说明:
1、首先我们先了解一下e家洁是干什么的呢,原来是一家线上家政服务公司,且盛大和腾讯投资的,看来有点来头
2、首先用自己的账号和错误的密码登录,下面是登录的请求报文和响应报文
从下面的响应报文可以发现,虽然登录失败,但报文里返回了两个奇怪自段old_user_id和new_user_id,这个两个字段有什么用处呢,稍后你就明白了
3、用自己的账号和正确的密码登录,并抓取其请求报文如下:
4、尝试查询自己的个人信息、历史订单、地址信息,由此可以推断出系统工具session_id区分客户的
漏洞证明:
根据以上session_id=dfc904a70bcc646e425617b695a7378d-47796448,可以发现Session的最后是一个数字串就是new_user_id字段,由此我们可以尝试以下攻击,
第一步:使用任意手机号尝试登录,虽然登录失败,但服务器返回了new_user_id字段,因此可以所有会员的new_user_id字段
第二步:伪造Session,获取其他会员的个人信息
1、使用任意手机号尝试登录,获取其他会员的new_user_id
(1)尝试手机号189××××8××4,获取new_user_id=48182262
(2)尝试土豪手机号18×××××××××,获取new_user_id=14512
4、伪造Session,获取其他会员的个人信息
(1)使用session_id=dfc904a70bcc646e425617b695a7378d-48182262获取会员的个人信息
(2)使用session_id=dfc904a70bcc646e425617b695a7378d-14152获取会员的个人信息
(3)使用session_id=dfc904a70bcc646e425617b695a7378d-48182262获取会员的地址信息
Unicode转中文为:
{"code":"ok","msg":{"address":[{"city":"北京","latitude":"39.884578","longitude":"116.624272","street":"北京东旭花园","place_detail":"×单元×01","address":"北京东旭花园×单元×01","address_id":"1629979"}],"alertMsg":""}}
(4)使用session_id=dfc904a70bcc646e425617b695a7378d-14152获取会员的地址信息
(5)使用session_id=dfc904a70bcc646e425617b695a7378d-48182262获取会员的订单信息
(6)使用session_id=dfc904a70bcc646e425617b695a7378d-14152获取会员的个人订单信息
Unicode转中文为:
{"code":"ok","msg":{"orderList":[{"extend_info":"没有特殊需求","id":"221674","service_type":"4","place_detail":"北京中南海","reserve_time":"2014-04-19 08:00","status":"-1","worker_list":"","create_time":"2014-04-13 15:39:35","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"网站预约","order_id":"221674","service_main":"专业保洁","service_second":"卫生间保洁","create_way":"","sub_order":[],"order_status":["2014-04-13 15:39 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"没有特殊需求","id":"90078","service_type":"1","place_detail":"朝阳湖","reserve_time":"2013-11-21 07:00","status":"-1","worker_list":"","create_time":"2013-11-16 08:22:02","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"90078","service_main":"专业保洁","service_second":"家庭保洁","create_way":"","sub_order":[],"order_status":["2013-11-16 08:22 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"没有特殊需求","id":"90077","service_type":"1","place_detail":"朝阳湖","reserve_time":"2013-11-18 07:00","status":"-1","worker_list":"","create_time":"2013-11-16 08:21:38","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"90077","service_main":"专业保洁","service_second":"家庭保洁","create_way":"","sub_order":[],"order_status":["2013-11-16 08:21 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"没有特殊需求","id":"90076","service_type":"1","place_detail":"朝阳湖","reserve_time":"2013-11-18 07:00","status":"-1","worker_list":"","create_time":"2013-11-16 08:20:51","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"90076","service_main":"专业保洁","service_second":"家庭保洁","create_way":"","sub_order":[],"order_status":["2013-11-16 08:20 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"没有特殊需求","id":"90074","service_type":"1","place_detail":"朝阳湖","reserve_time":"2013-11-16 10:30","status":"-1","worker_list":"","create_time":"2013-11-16 08:19:02","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"90074","service_main":"专业保洁","service_second":"家庭保洁","create_way":"","sub_order":[],"order_status":["2013-11-16 08:19 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"没有特殊需求","id":"90071","service_type":"1","place_detail":"朝阳湖","reserve_time":"2013-11-16 10:30","status":"-1","worker_list":"","create_time":"2013-11-16 08:16:12","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"90071","service_main":"专业保洁","service_second":"家庭保洁","create_way":"","sub_order":[],"order_status":["2013-11-16 08:16 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"没有特殊需求","id":"90069","service_type":"1","place_detail":"朝阳湖","reserve_time":"2013-11-21 07:00","status":"-1","worker_list":"","create_time":"2013-11-16 08:14:49","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"90069","service_main":"专业保洁","service_second":"家庭保洁","create_way":"","sub_order":[],"order_status":["2013-11-16 08:14 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"客户号码空号","id":"63452","service_type":"1","place_detail":"朝阳湖","reserve_time":"2013-11-17 07:00","status":"-1","worker_list":"","create_time":"2013-11-15 10:03:28","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"63452","service_main":"专业保洁","service_second":"家庭保洁","create_way":"","sub_order":[],"order_status":["2013-11-15 10:03 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"已发短信,超出服务区","id":"16031","service_type":"2","place_detail":"朝阳湖","reserve_time":"2013-10-17 13:00","status":"-1","worker_list":"","create_time":"2013-10-16 05:02:50","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"16031","service_main":"专业保洁","service_second":"新居开荒","create_way":"","sub_order":[],"order_status":["2013-10-16 05:02 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""}],"workerList":[],"alertMsg":"","pageNum":"1","totalPage":"1","totalNum":"9"}}
保洁还去中南海。。。。
修复方案:
其实系统还存在另外一个问题,那就是不管什么时候登录,Session都一样
1、不要使用可以推断出来的Session
2、系统不管该会员什么时候登录,均使用同一个Session
版权声明:转载请注明来源 Budi@乌云
漏洞回应
厂商回应:
危害等级:高
漏洞Rank:16
确认时间:2015-09-10 20:33
厂商回复:
多谢发现者
最新状态:
2015-09-14:能帮助测试一下吗,已经修改了