当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0144942

漏洞标题：大智慧redis未授权访问造成信息泄露

相关厂商：上海大智慧

漏洞作者： Mr.lin

提交时间：2015-10-06 09:33

修复时间：2015-11-26 11:18

公开时间：2015-11-26 11:18

漏洞类型：未授权访问/权限绕过

危害等级：中

自评Rank：7

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-06： 细节已通知厂商并且等待厂商处理中
2015-10-12： 厂商已经确认，细节仅向厂商公开
2015-10-22： 细节向核心白帽子及相关领域专家公开
2015-11-01： 细节向普通白帽子公开
2015-11-11： 细节向实习白帽子公开
2015-11-26： 细节向公众公开

简要描述：

信息泄露

详细说明：

脆弱点

114.80.136.171:6379


可能涉及到大智慧移动客户端提交的数据查询。其中记录着sqltrackingquery状态查询类的数据，里面涉及到请求方式，参数，环境变量等信息，也可能涉及到用户信息。。。
例如：

"requests": [
        {
            "action_name": "路演-结束",
            "idsite": "130",
            "rec": "1",
            "r": "608404",
            "h": "21",
            "m": "27",
            "s": "41",
            "url": "http://htg.yundzh.com/htg.yundzh.com/ttch?version=8.20",
            "_id": "16b89d6805e63ea0",
            "_idts": "1438307446",
            "_idvc": "162",
            "_idn": "0",
            "_refts": "0",
            "_viewts": "1444051254",
            "send_image": "0",
            "java": "1",
            "cookie": "1",
            "res": "1440x2560",
            "gt_ms": "90"
        }
    ],
    "env": {
        "server": {
            "USER": "webuser",
            "HOME": "/home/webuser",
            "FCGI_ROLE": "RESPONDER",
            "SCRIPT_FILENAME": "/opt/nginx/html/analysis/piwik.php",
            "QUERY_STRING": "action_name=%E8%B7%AF%E6%BC%94-%E7%BB%93%E6%9D%9F&idsite=130&rec=1&r=608404&h=21&m=27&s=41&url=http%3A%2F%2Fhtg.yundzh.com%2Fhtg.yundzh.com%2Fttch%3Fversion%3D8.20&_id=16b89d6805e63ea0&_idts=1438307446&_idvc=162&_idn=0&_refts=0&_viewts=1444051254&send_image=0&java=1&cookie=1&res=1440x2560&gt_ms=90",
            "REQUEST_METHOD": "GET",
            "CONTENT_TYPE": "",
            "CONTENT_LENGTH": "",
            "SCRIPT_NAME": "/piwik.php",
            "REQUEST_URI": "/piwik.php?action_name=%E8%B7%AF%E6%BC%94-%E7%BB%93%E6%9D%9F&idsite=130&rec=1&r=608404&h=21&m=27&s=41&url=http%3A%2F%2Fhtg.yundzh.com%2Fhtg.yundzh.com%2Fttch%3Fversion%3D8.20&_id=16b89d6805e63ea0&_idts=1438307446&_idvc=162&_idn=0&_refts=0&_viewts=1444051254&send_image=0&java=1&cookie=1&res=1440x2560&gt_ms=90",
            "DOCUMENT_URI": "/piwik.php",
            "DOCUMENT_ROOT": "/opt/nginx/html/analysis",
            "SERVER_PROTOCOL": "HTTP/1.0",
            "GATEWAY_INTERFACE": "CGI/1.1",
            "SERVER_SOFTWARE": "nginx/1.6.2",
            "REMOTE_ADDR": "36.63.182.139",
            "REMOTE_PORT": "",
            "SERVER_ADDR": "unix:/opt/nginx/temp/proxy_temp/nginx.sock",
            "SERVER_PORT": "",
            "SERVER_NAME": "log.gw.com.cn",
            "GEOIP_ADDR": "36.63.182.139",
            "GEOIP_COUNTRY_CODE": "",
            "GEOIP_COUNTRY_NAME": "",
            "GEOIP_REGION": "",
            "GEOIP_REGION_NAME": "",
            "GEOIP_CITY": "",
            "GEOIP_AREA_CODE": "",
            "GEOIP_LATITUDE": "",
            "GEOIP_LONGITUDE": "",
            "GEOIP_POSTAL_CODE": "",
            "GEOIP_ORGANIZATION": "",
            "REDIRECT_STATUS": "200",
            "HTTP_HOST": "log.gw.com.cn",
            "HTTP_X_REAL_IP": "36.63.182.139",
            "HTTP_X_FORWARDED_FOR": "36.63.182.139",
            "HTTP_CONNECTION": "close",
            "HTTP_PRAGMA": "no-cache",
            "HTTP_CACHE_CONTROL": "no-cache",
            "HTTP_ACCEPT": "image/webp,*/*;q=0.8",
            "HTTP_X_WAP_PROFILE": "http://wap1.huawei.com/uaprof/HW_HUAWEI_Che1-CL10_1_20140801.xml",
            "HTTP_USER_AGENT": "Mozilla/5.0 (Linux; Android 4.4.4; Che1-CL10 Build/Che1-CL10) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36",
            "HTTP_REFERER": "http://htg.yundzh.com/ttch?DZHSPECIAL=40&version=8.20&token=7yYwE*8bpivoRxiwfZJ-p4W*t6Q0zL42UZI4OuWJSZI.1444117522",
            "HTTP_ACCEPT_ENCODING": "gzip,deflate",
            "HTTP_ACCEPT_LANGUAGE": "zh-CN,en-US;q=0.8",
            "HTTP_COOKIE": "_ga=GA1.3.1334341815.1438143713",
            "HTTP_X_REQUESTED_WITH": "com.android.dazhihui",
            "PHP_SELF": "/piwik.php",
            "REQUEST_TIME": 1444051659
        }
    },


漏洞证明：

1111.PNG

修复方案：

版权声明：转载请注明来源 Mr.lin@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：8

确认时间：2015-10-12 11:17

厂商回复：

已通知运维及研发技术正在处理中

最新状态：

暂无