漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-0103494
漏洞标题：虎嗅网某服务多处未授权访问
相关厂商：huxiu.com
漏洞作者： 路人甲
提交时间：2015-03-24 18:22
修复时间：2015-03-25 10:55
公开时间：2015-03-25 10:55
漏洞类型：未授权访问/权限绕过
危害等级：中
自评Rank：7
漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-03-24： 细节已通知厂商并且等待厂商处理中
2015-03-25： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
虎嗅网某服务多处未授权访问
详细说明：
虎嗅网某服务多处未授权访问
test.huxiu.com 11211
dev.huxiu.com 11211
漏洞证明：
root@kali:~# nc dev.huxiu.com 11211
stats items
STAT items:3:number 1614
STAT items:3:age 23295275
STAT items:3:evicted 0
STAT items:3:evicted_nonzero 0
STAT items:3:evicted_time 0
STAT items:3:outofmemory 0
STAT items:3:tailrepairs 0
STAT items:4:number 970
STAT items:4:age 23846084
STAT items:4:evicted 0
STAT items:4:evicted_nonzero 0
STAT items:4:evicted_time 0
STAT items:4:outofmemory 0
STAT items:4:tailrepairs 0
STAT items:5:number 57
STAT items:5:age 23856639
STAT items:5:evicted 0
STAT items:5:evicted_nonzero 0
STAT items:5:evicted_time 0
STAT items:5:outofmemory 0
STAT items:5:tailrepairs 0
STAT items:6:number 459
STAT items:6:age 23845288
STAT items:6:evicted 0
STAT items:6:evicted_nonzero 0
STAT items:6:evicted_time 0
STAT items:6:outofmemory 0
STAT items:6:tailrepairs 0
STAT items:7:number 987
STAT items:7:age 23845143
STAT items:7:evicted 0
STAT items:7:evicted_nonzero 0
STAT items:7:evicted_time 0
STAT items:7:outofmemory 0
STAT items:7:tailrepairs 0
STAT items:8:number 49
STAT items:8:age 23851804
STAT items:8:evicted 0
STAT items:8:evicted_nonzero 0
STAT items:8:evicted_time 0
STAT items:8:outofmemory 0
STAT items:8:tailrepairs 0
STAT items:9:number 64
STAT items:9:age 23873601
STAT items:9:evicted 0
STAT items:9:evicted_nonzero 0
STAT items:9:evicted_time 0
STAT items:9:outofmemory 0
STAT items:9:tailrepairs 0
STAT items:10:number 82
STAT items:10:age 23845938
STAT items:10:evicted 0
STAT items:10:evicted_nonzero 0
STAT items:10:evicted_time 0
STAT items:10:outofmemory 0
STAT items:10:tailrepairs 0
STAT items:11:number 1670
STAT items:11:age 23849884
STAT items:11:evicted 0
STAT items:11:evicted_nonzero 0
STAT items:11:evicted_time 0
STAT items:11:outofmemory 0
STAT items:11:tailrepairs 0
STAT items:12:number 470
STAT items:12:age 23925521
STAT items:12:evicted 0
STAT items:12:evicted_nonzero 0
STAT items:12:evicted_time 0
STAT items:12:outofmemory 0
STAT items:12:tailrepairs 0
STAT items:13:number 1012
STAT items:13:age 23924990
STAT items:13:evicted 0
STAT items:13:evicted_nonzero 0
STAT items:13:evicted_time 0
STAT items:13:outofmemory 0
STAT items:13:tailrepairs 0
STAT items:14:number 604
STAT items:14:age 23922713
STAT items:14:evicted 0
STAT items:14:evicted_nonzero 0
STAT items:14:evicted_time 0
STAT items:14:outofmemory 0
STAT items:14:tailrepairs 0
STAT items:15:number 105
STAT items:15:age 23927966
STAT items:15:evicted 0
STAT items:15:evicted_nonzero 0
STAT items:15:evicted_time 0
STAT items:15:outofmemory 0
STAT items:15:tailrepairs 0
STAT items:16:number 34
STAT items:16:age 23929146
STAT items:16:evicted 0
STAT items:16:evicted_nonzero 0
STAT items:16:evicted_time 0
STAT items:16:outofmemory 0
STAT items:16:tailrepairs 0
STAT items:17:number 9
STAT items:17:age 23931106
STAT items:17:evicted 0
STAT items:17:evicted_nonzero 0
STAT items:17:evicted_time 0
STAT items:17:outofmemory 0
STAT items:17:tailrepairs 0
STAT items:18:number 7
STAT items:18:age 23295276
STAT items:18:evicted 0
STAT items:18:evicted_nonzero 0
STAT items:18:evicted_time 0
STAT items:18:outofmemory 0
STAT items:18:tailrepairs 0
STAT items:19:number 6
STAT items:19:age 23928894
STAT items:19:evicted 0
STAT items:19:evicted_nonzero 0
STAT items:19:evicted_time 0
STAT items:19:outofmemory 0
STAT items:19:tailrepairs 0
STAT items:20:number 4
STAT items:20:age 23927641
STAT items:20:evicted 0
STAT items:20:evicted_nonzero 0
STAT items:20:evicted_time 0
STAT items:20:outofmemory 0
STAT items:20:tailrepairs 0
STAT items:21:number 4
STAT items:21:age 23926273
STAT items:21:evicted 0
STAT items:21:evicted_nonzero 0
STAT items:21:evicted_time 0
STAT items:21:outofmemory 0
STAT items:21:tailrepairs 0
STAT items:22:number 1
STAT items:22:age 23931106
STAT items:22:evicted 0
STAT items:22:evicted_nonzero 0
STAT items:22:evicted_time 0
STAT items:22:outofmemory 0
STAT items:22:tailrepairs 0
STAT items:23:number 2
STAT items:23:age 23929068
STAT items:23:evicted 0
STAT items:23:evicted_nonzero 0
STAT items:23:evicted_time 0
STAT items:23:outofmemory 0
STAT items:23:tailrepairs 0
STAT items:24:number 1
STAT items:24:age 23926206
STAT items:24:evicted 0
STAT items:24:evicted_nonzero 0
STAT items:24:evicted_time 0
STAT items:24:outofmemory 0
STAT items:24:tailrepairs 0
STAT items:25:number 2
STAT items:25:age 23923268
STAT items:25:evicted 0
STAT items:25:evicted_nonzero 0
STAT items:25:evicted_time 0
STAT items:25:outofmemory 0
STAT items:25:tailrepairs 0
STAT items:26:number 1
STAT items:26:age 23915385
STAT items:26:evicted 0
STAT items:26:evicted_nonzero 0
STAT items:26:evicted_time 0
STAT items:26:outofmemory 0
STAT items:26:tailrepairs 0
STAT items:27:number 3
STAT items:27:age 23910768
STAT items:27:evicted 0
STAT items:27:evicted_nonzero 0
STAT items:27:evicted_time 0
STAT items:27:outofmemory 0
STAT items:27:tailrepairs 0
STAT items:28:number 1
STAT items:28:age 23922979
STAT items:28:evicted 0
STAT items:28:evicted_nonzero 0
STAT items:28:evicted_time 0
STAT items:28:outofmemory 0
STAT items:28:tailrepairs 0
STAT items:29:number 2
STAT items:29:age 23926448
STAT items:29:evicted 0
STAT items:29:evicted_nonzero 0
STAT items:29:evicted_time 0
STAT items:29:outofmemory 0
STAT items:29:tailrepairs 0
STAT items:30:number 1
STAT items:30:age 23617195
STAT items:30:evicted 0
STAT items:30:evicted_nonzero 0
STAT items:30:evicted_time 0
STAT items:30:outofmemory 0
STAT items:30:tailrepairs 0
STAT items:31:number 1
STAT items:31:age 23797525
STAT items:31:evicted 0
STAT items:31:evicted_nonzero 0
STAT items:31:evicted_time 0
STAT items:31:outofmemory 0
STAT items:31:tailrepairs 0
STAT items:33:number 1
STAT items:33:age 20692626
STAT items:33:evicted 0
STAT items:33:evicted_nonzero 0
STAT items:33:evicted_time 0
STAT items:33:outofmemory 0
STAT items:33:tailrepairs 0
STAT items:34:number 1
STAT items:34:age 20616954
STAT items:34:evicted 0
STAT items:34:evicted_nonzero 0
STAT items:34:evicted_time 0
STAT items:34:outofmemory 0
STAT items:34:tailrepairs 0
STAT items:36:number 1
STAT items:36:age 18658972
STAT items:36:evicted 0
STAT items:36:evicted_nonzero 0
STAT items:36:evicted_time 0
STAT items:36:outofmemory 0
STAT items:36:tailrepairs 0
STAT items:38:number 1
STAT items:38:age 19313300
STAT items:38:evicted 0
STAT items:38:evicted_nonzero 0
STAT items:38:evicted_time 0
STAT items:38:outofmemory 0
STAT items:38:tailrepairs 0
END
stats cachedump 18 0
ITEM HXOarticleContentCache_692_ [3652 b; 1427189418 s]
ITEM HXOarticleContentCache_44121_ [3975 b; 1427188560 s]
ITEM HXOgetPostByTid_cacd321f34ebc4178be2123f19d660d0 [3997 b; 1427188269 s]
ITEM HXOgetPostByTid_4baead1fb6859e528604b38bb9aab70d [4264 b; 1427188150 s]
ITEM HXOgetPostByTid_5dab1fd3d84cf3f44cc16c6e3c11669c [3578 b; 1427188144 s]
ITEM HXOgetPostByTid_c8a999e78434a823fc9f989b6636763d [4027 b; 1427188062 s]
ITEM HXOgetHotAuthor_0_1_60 [3940 b; 1427417534 s]
END
修复方案：
做访问控制
版权声明：转载请注明来源 路人甲@乌云
漏洞回应
厂商回应：
危害等级：无影响厂商忽略
忽略时间：2015-03-25 10:55
厂商回复：
在测试机上测试程序健壮性的临时服务，只是临时开启，现已关闭。感谢白帽子的关注。
最新状态：
暂无