2015-09-16: 细节已通知厂商并且等待厂商处理中 2015-09-17: 厂商已经确认,细节仅向厂商公开 2015-09-17: 厂商已经修复漏洞并主动公开,细节向公众公开
上一个漏洞:http://www.wooyun.org/bugs/wooyun-2015-0140660说好的小礼物都没送我,这是第二发了!求礼物!!
上次提交的第一个漏洞,说好的小礼物都不给我!这次再来一个大点的。源于某处配置不当,导致目录遍历,可下载备份文件,内含大量敏感信息,包括不限于用户姓名/密码/家庭住址/联系方式!还有驴妈妈和新浪的一些信息,包括众多个人微信的案例!0x00:起初,由于未授权访问引起:
http://api.social-touch.com/log/ 上级目录不重要,重要的就是备份的1.5G的文件
大图来了:
由于信息量过大,只能点到为止!因此分为四个部分一一列举出部分重点:第一部分:
用户数十万详细信息信息包括:会员等级/新老会员/会员姓名/联系方式/家庭住址/消费途径……各种,看表头,以下四张表不同的,每张数据量过万!!*路径下所针对文件夹内月份销售以及赠送详细信息 #由于Excel文档用户数据过多,单个文件已经不能用用户量表示,直接用大小吧。月份allmember_info 28MB!
第二部分:
详细过万物流信息+部分账户cookie
随便贴出一小部分:
2015/05/28 14:56:22 服务名:query_trace 返回内容:{"response":{"isSuccess":"T","traceList":[{"trace":[{"billCode":669046284454,"desc":"快件已签收,签收人是【图片】","optTime":"2015-04-07 16:23:52","optType":"签收"},{"billCode":669046284454,"operateSite":"朝阳十三部","nextSite":"朝阳十三部","desc":"[朝阳十三部]的【孙浩18401689711】正在派件, 电话:010-57232725","optTime":"2015-04-07 08:35:11","optType":"派件"},{"billCode":669046284454,"operateSite":"朝阳十三
第三部分:
用户登陆设备敏感信息,我们发现了大量的微信请求。包括微信账户信息,地址等敏感信息
第四部分:
驴妈妈以及新浪的一些请求等
再赠一个:
大量的crocs_info/系统配置
随便贴出一个Crocs_info:
2015/07/13 08:06:35 array ( 'flag' => 0, 'data' => 'lack of openid', 'openId' => '', 'info' => '', 'func' => 'getrelation',)2015/07/13 08:06:35 array ( 'flag' => 0, 'data' => 'lack of openid', 'openId' => '', 'info' => '', 'func' => 'getrelation',)2015/07/13 08:06:36 array ( 'func' => 'oauth', 'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode', 'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3F1aXplLz9ybmQ9MTQxOTcxMTgzOSZzaWQ9MTIzMTUmZnJvbT10aW1lbGluZSZpc2FwcGluc3RhbGxlZD0w%26rid%3D651a22fd1533e12c8a68bd018dc27cbc&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect', 'rid' => '651a22fd1533e12c8a68bd018dc27cbc',)2015/07/13 08:06:36 array ( 'func' => 'oauth', 'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode', 'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3F1aXplLz9ybmQ9MTQxOTcxMTgzOSZzaWQ9MTIzMTUmZnJvbT10aW1lbGluZSZpc2FwcGluc3RhbGxlZD0w%26rid%3D6e6edfe0385c8fa1a46bc58ca4e8ecd8&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect', 'rid' => '6e6edfe0385c8fa1a46bc58ca4e8ecd8',)2015/07/13 08:06:36 array ( 'func' => 'oauth', 'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode', 'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3F1aXplLz9ybmQ9MTQxOTcxMTgzOSZzaWQ9MTIzMTUmZnJvbT10aW1lbGluZSZpc2FwcGluc3RhbGxlZD0w%26rid%3D6e6edfe0385c8fa1a46bc58ca4e8ecd8&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect', 'rid' => '6e6edfe0385c8fa1a46bc58ca4e8ecd8',)2015/07/13 08:20:01 array ( 'flag' => 0, 'data' => 'lack of openid', 'openId' => '', 'info' => '', 'func' => 'getrelation',)2015/07/13 08:20:01 array ( 'func' => 'oauth', 'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode', 'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3F1aXplLz9ybmQ9MTQxOTcxMTgzOSZzaWQ9MTIzMTUmZnJvbT10aW1lbGluZSZpc2FwcGluc3RhbGxlZD0w%26rid%3Df87f6083275c9288ac39ece509494be4&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect', 'rid' => 'f87f6083275c9288ac39ece509494be4',)2015/07/13 08:20:03 array ( 'func' => 'getcode', 'url' => 'http://event.gemground.com/crocs.draw2014/index.php/callback/authorize/?redirect=http://event.gemground.com/crocs.draw2014/index.php/entrance/share/quize/?rnd=1419711839&sid=12315&from=timeline&isappinstalled=0&rid=6e6edfe0385c8fa1a46bc58ca4e8ecd8&openid=', 'cache_openid' => false, 'mark' => 2,)2015/07/13 09:20:11 array ( 'flag' => 0, 'data' => 'lack of openid', 'openId' => '', 'info' => '', 'func' => 'getrelation',)2015/07/13 09:20:12 array ( 'func' => 'oauth', 'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode', 'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3F1aXplLz9ybmQ9MTQxOTcxMTgzOSZzaWQ9MTIzMTUmZnJvbT10aW1lbGluZSZpc2FwcGluc3RhbGxlZD0w%26rid%3D7235561f7d037f46a330905b9c372a4c&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect', 'rid' => '7235561f7d037f46a330905b9c372a4c',)2015/07/13 22:43:54 array ( 'func' => 'oauth', 'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode', 'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL3Nob2Vib3gvZmV0Y2hlZC8%2Fcm5kPTE0MjI0MTMxOTQmZnJvbT10aW1lbGluZSZpc2FwcGluc3RhbGxlZD0w%26rid%3D0748c8c59509f301803fb99abf37d01e&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect', 'rid' => '0748c8c59509f301803fb99abf37d01e',)2015/07/13 22:48:06 array ( 'flag' => 0, 'data' => 'lack of openid', 'openId' => '', 'info' => '', 'func' => 'getrelation',)2015/07/13 22:48:06 array ( 'func' => 'oauth', 'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode', 'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3JlY3J1aXQvP3NpZD0yMjU5JmZyb209dGltZWxpbmUmaXNhcHBpbnN0YWxsZWQ9MA%3D%3D%26rid%3Dd9fddcdabbb52da6a62d7b3d69cfabde&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect', 'rid' => 'd9fddcdabbb52da6a62d7b3d69cfabde',)2015/07/13 22:48:06 array ( 'flag' => 0, 'data' => 'lack of openid', 'openId' => '', 'info' => '', 'func' => 'getrelation',)2015/07/13 22:48:07 array ( 'func' => 'oauth', 'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode', 'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3JlY3J1aXQvP3NpZD0yMjU5JmZyb209dGltZWxpbmUmaXNhcHBpbnN0YWxsZWQ9MA%3D%3D%26rid%3D9e960b247e655eec58e95a5cd2231ec4&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect', 'rid' => '9e960b247e655eec58e95a5cd2231ec4',)2015/07/13 22:48:11 array ( 'func' => 'getcode', 'result' => NULL, 'mark' => 1,)2015/07/13 22:48:11 array ( 'func' => 'getcode', 'url' => 'http://event.gemground.com/crocs.draw2014/index.php/callback/authorize/?redirect=http://event.gemground.com/crocs.draw2014/index.php/entrance/share/recruit/?sid=2259&from=timeline&isappinstalled=0&rid=9e960b247e655eec58e95a5cd2231ec4&openid=', 'cache_openid' => false, 'mark' => 2,)2015/07/13 22:48:21 array ( 'func' => 'getcode', 'result' => NULL, 'mark' => 1,)2015/07/13 22:48:21 array ( 'func' => 'getcode', 'url' => 'http://event.gemground.com/crocs.draw2014/index.php/callback/authorize/?redirect=http://event.gemground.com/crocs.draw2014/index.php/entrance/share/recruit/?sid=2259&from=timeline&isappinstalled=0&rid=9e960b247e655eec58e95a5cd2231ec4&openid=', 'cache_openid' => false, 'mark' => 2,)2015/07/13 23:01:40 array ( 'flag' => 0, 'data' => 'lack of openid', 'openId' => '', 'info' => '', 'func' => 'getrelation',)2015/07/13 23:01:40 array ( 'func' => 'oauth', 'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode', 'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3JlY3J1aXQvP3NpZD0yMjU5JmZyb209dGltZWxpbmUmaXNhcHBpbnN0YWxsZWQ9MA%3D%3D%26rid%3D93d083dc0291eee8bdb3bc43ff11cda8&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect', 'rid' => '93d083dc0291eee8bdb3bc43ff11cda8',)2015/07/13 23:17:14 array ( 'func' => 'oauth', 'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode', 'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL3Nob2Vib3gvZmV0Y2hlZC8%2Fcm5kPTE0MjI0MTMxOTQmZnJvbT10aW1lbGluZSZpc2FwcGluc3RhbGxlZD0w%26rid%3D7de0c2fc4b53533a98b70da791fdfcae&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect', 'rid' => '7de0c2fc4b53533a98b70da791fdfcae',)
已经第二发了,我是来找礼物的!
危害等级:低
漏洞Rank:1
确认时间:2015-09-17 13:05
旧的数据备份
2015-09-17:已经关闭这个链接,并删除旧的数据备份。