当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0141630

漏洞标题:时趣互动某漏洞可泄露数十万数据引发蝴蝶效应

相关厂商:social-touch.com

漏洞作者: 路人甲

提交时间:2015-09-16 18:47

修复时间:2015-09-17 13:06

公开时间:2015-09-17 13:06

漏洞类型:重要敏感信息泄露

危害等级:高

自评Rank:18

漏洞状态:厂商已经修复

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-09-16: 细节已通知厂商并且等待厂商处理中
2015-09-17: 厂商已经确认,细节仅向厂商公开
2015-09-17: 厂商已经修复漏洞并主动公开,细节向公众公开

简要描述:

上一个漏洞:http://www.wooyun.org/bugs/wooyun-2015-0140660
说好的小礼物都没送我,这是第二发了!
求礼物!!

详细说明:

上次提交的第一个漏洞,说好的小礼物都不给我!这次再来一个大点的。源于某处配置不当,导致目录遍历,可下载备份文件,内含大量敏感信息,包括不限于用户姓名/密码/家庭住址/联系方式!还有驴妈妈和新浪的一些信息,包括众多个人微信的案例!
0x00:起初,由于未授权访问引起:

http://api.social-touch.com/log/ 上级目录不重要,重要的就是备份的1.5G的文件


大图来了:

1.png


由于信息量过大,只能点到为止!因此分为四个部分一一列举出部分重点:
第一部分:

用户数十万详细信息信息包括:会员等级/新老会员/会员姓名/联系方式/家庭住址/消费途径……各种,看表头,以下四张表不同的,每张数据量过万!!*路径下所针对文件夹内月份销售以及赠送详细信息 #由于Excel文档用户数据过多,单个文件已经不能用用户量表示,直接用大小吧。月份allmember_info 28MB!


2015-09-16_171635.png


001.png


002.png


003.png


第二部分:

详细过万物流信息+部分账户cookie


00001.png


1.png


随便贴出一小部分:

2015/05/28 14:56:22  服务名:query_trace 返回内容:{"response":{"isSuccess":"T","traceList":[{"trace":[{"billCode":669046284454,"desc":"快件已签收,签收人是【图片】","optTime":"2015-04-07 16:23:52","optType":"签收"},{"billCode":669046284454,"operateSite":"朝阳十三部","nextSite":"朝阳十三部","desc":"[朝阳十三部]的【孙浩18401689711】正在派件, 电话:010-57232725","optTime":"2015-04-07 08:35:11","optType":"派件"},{"billCode":669046284454,"operateSite":"朝阳十三

漏洞证明:

第三部分:

用户登陆设备敏感信息,我们发现了大量的微信请求。包括微信账户信息,地址等敏感信息


1234.png


第四部分:

驴妈妈以及新浪的一些请求等


1.png


1.png


再赠一个:

大量的crocs_info/系统配置


1.png


随便贴出一个Crocs_info:

2015/07/13 08:06:35  array (
'flag' => 0,
'data' => 'lack of openid',
'openId' => '',
'info' => '',
'func' => 'getrelation',
)
2015/07/13 08:06:35 array (
'flag' => 0,
'data' => 'lack of openid',
'openId' => '',
'info' => '',
'func' => 'getrelation',
)
2015/07/13 08:06:36 array (
'func' => 'oauth',
'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode',
'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3F1aXplLz9ybmQ9MTQxOTcxMTgzOSZzaWQ9MTIzMTUmZnJvbT10aW1lbGluZSZpc2FwcGluc3RhbGxlZD0w%26rid%3D651a22fd1533e12c8a68bd018dc27cbc&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect',
'rid' => '651a22fd1533e12c8a68bd018dc27cbc',
)
2015/07/13 08:06:36 array (
'func' => 'oauth',
'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode',
'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3F1aXplLz9ybmQ9MTQxOTcxMTgzOSZzaWQ9MTIzMTUmZnJvbT10aW1lbGluZSZpc2FwcGluc3RhbGxlZD0w%26rid%3D6e6edfe0385c8fa1a46bc58ca4e8ecd8&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect',
'rid' => '6e6edfe0385c8fa1a46bc58ca4e8ecd8',
)
2015/07/13 08:06:36 array (
'func' => 'oauth',
'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode',
'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3F1aXplLz9ybmQ9MTQxOTcxMTgzOSZzaWQ9MTIzMTUmZnJvbT10aW1lbGluZSZpc2FwcGluc3RhbGxlZD0w%26rid%3D6e6edfe0385c8fa1a46bc58ca4e8ecd8&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect',
'rid' => '6e6edfe0385c8fa1a46bc58ca4e8ecd8',
)
2015/07/13 08:20:01 array (
'flag' => 0,
'data' => 'lack of openid',
'openId' => '',
'info' => '',
'func' => 'getrelation',
)
2015/07/13 08:20:01 array (
'func' => 'oauth',
'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode',
'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3F1aXplLz9ybmQ9MTQxOTcxMTgzOSZzaWQ9MTIzMTUmZnJvbT10aW1lbGluZSZpc2FwcGluc3RhbGxlZD0w%26rid%3Df87f6083275c9288ac39ece509494be4&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect',
'rid' => 'f87f6083275c9288ac39ece509494be4',
)
2015/07/13 08:20:03 array (
'func' => 'getcode',
'url' => 'http://event.gemground.com/crocs.draw2014/index.php/callback/authorize/?redirect=http://event.gemground.com/crocs.draw2014/index.php/entrance/share/quize/?rnd=1419711839&sid=12315&from=timeline&isappinstalled=0&rid=6e6edfe0385c8fa1a46bc58ca4e8ecd8&openid=',
'cache_openid' => false,
'mark' => 2,
)
2015/07/13 09:20:11 array (
'flag' => 0,
'data' => 'lack of openid',
'openId' => '',
'info' => '',
'func' => 'getrelation',
)
2015/07/13 09:20:12 array (
'func' => 'oauth',
'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode',
'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3F1aXplLz9ybmQ9MTQxOTcxMTgzOSZzaWQ9MTIzMTUmZnJvbT10aW1lbGluZSZpc2FwcGluc3RhbGxlZD0w%26rid%3D7235561f7d037f46a330905b9c372a4c&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect',
'rid' => '7235561f7d037f46a330905b9c372a4c',
)
2015/07/13 22:43:54 array (
'func' => 'oauth',
'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode',
'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL3Nob2Vib3gvZmV0Y2hlZC8%2Fcm5kPTE0MjI0MTMxOTQmZnJvbT10aW1lbGluZSZpc2FwcGluc3RhbGxlZD0w%26rid%3D0748c8c59509f301803fb99abf37d01e&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect',
'rid' => '0748c8c59509f301803fb99abf37d01e',
)
2015/07/13 22:48:06 array (
'flag' => 0,
'data' => 'lack of openid',
'openId' => '',
'info' => '',
'func' => 'getrelation',
)
2015/07/13 22:48:06 array (
'func' => 'oauth',
'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode',
'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3JlY3J1aXQvP3NpZD0yMjU5JmZyb209dGltZWxpbmUmaXNhcHBpbnN0YWxsZWQ9MA%3D%3D%26rid%3Dd9fddcdabbb52da6a62d7b3d69cfabde&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect',
'rid' => 'd9fddcdabbb52da6a62d7b3d69cfabde',
)
2015/07/13 22:48:06 array (
'flag' => 0,
'data' => 'lack of openid',
'openId' => '',
'info' => '',
'func' => 'getrelation',
)
2015/07/13 22:48:07 array (
'func' => 'oauth',
'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode',
'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3JlY3J1aXQvP3NpZD0yMjU5JmZyb209dGltZWxpbmUmaXNhcHBpbnN0YWxsZWQ9MA%3D%3D%26rid%3D9e960b247e655eec58e95a5cd2231ec4&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect',
'rid' => '9e960b247e655eec58e95a5cd2231ec4',
)
2015/07/13 22:48:11 array (
'func' => 'getcode',
'result' => NULL,
'mark' => 1,
)
2015/07/13 22:48:11 array (
'func' => 'getcode',
'url' => 'http://event.gemground.com/crocs.draw2014/index.php/callback/authorize/?redirect=http://event.gemground.com/crocs.draw2014/index.php/entrance/share/recruit/?sid=2259&from=timeline&isappinstalled=0&rid=9e960b247e655eec58e95a5cd2231ec4&openid=',
'cache_openid' => false,
'mark' => 2,
)
2015/07/13 22:48:21 array (
'func' => 'getcode',
'result' => NULL,
'mark' => 1,
)
2015/07/13 22:48:21 array (
'func' => 'getcode',
'url' => 'http://event.gemground.com/crocs.draw2014/index.php/callback/authorize/?redirect=http://event.gemground.com/crocs.draw2014/index.php/entrance/share/recruit/?sid=2259&from=timeline&isappinstalled=0&rid=9e960b247e655eec58e95a5cd2231ec4&openid=',
'cache_openid' => false,
'mark' => 2,
)
2015/07/13 23:01:40 array (
'flag' => 0,
'data' => 'lack of openid',
'openId' => '',
'info' => '',
'func' => 'getrelation',
)
2015/07/13 23:01:40 array (
'func' => 'oauth',
'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode',
'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3JlY3J1aXQvP3NpZD0yMjU5JmZyb209dGltZWxpbmUmaXNhcHBpbnN0YWxsZWQ9MA%3D%3D%26rid%3D93d083dc0291eee8bdb3bc43ff11cda8&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect',
'rid' => '93d083dc0291eee8bdb3bc43ff11cda8',
)
2015/07/13 23:17:14 array (
'func' => 'oauth',
'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode',
'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL3Nob2Vib3gvZmV0Y2hlZC8%2Fcm5kPTE0MjI0MTMxOTQmZnJvbT10aW1lbGluZSZpc2FwcGluc3RhbGxlZD0w%26rid%3D7de0c2fc4b53533a98b70da791fdfcae&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect',
'rid' => '7de0c2fc4b53533a98b70da791fdfcae',
)


修复方案:

已经第二发了,我是来找礼物的!

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:低

漏洞Rank:1

确认时间:2015-09-17 13:05

厂商回复:

旧的数据备份

最新状态:

2015-09-17:已经关闭这个链接,并删除旧的数据备份。