当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0122172

漏洞标题：搜狐畅游配置文件泄露7个数据库账号

相关厂商：搜狐畅游

漏洞作者： lijiejie

提交时间：2015-06-22 22:17

修复时间：2015-08-07 06:56

公开时间：2015-08-07 06:56

漏洞类型：敏感信息泄露

危害等级：中

自评Rank：8

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-06-22： 细节已通知厂商并且等待厂商处理中
2015-06-23： 厂商已经确认，细节仅向厂商公开
2015-07-03： 细节向核心白帽子及相关领域专家公开
2015-07-13： 细节向普通白帽子公开
2015-07-23： 细节向实习白帽子公开
2015-08-07： 细节向公众公开

简要描述：

搜狐畅游一处配置文件泄露7个数据库账号

详细说明：

http://74.201.81.139/WEB-INF/proxool.xml
http://74.201.81.139/WEB-INF/web.xml


对应域名是：

http://cas.us.changyou.com/


但只有通过IP访问可以直接下载配置文件。

漏洞证明：

<servlet>
<description>Changyou account center initialize servlet</description>
<display-name>InitChangyou</display-name>
<servlet-name>InitChangyou</servlet-name>
<servlet-class>com.changyou.servlet.InitChangyou</servlet-class>
<load-on-startup>2</load-on-startup>
</servlet>


<servlet-name>CAS Client Init</servlet-name>
<servlet-class>edu.yale.its.tp.cas.client.servlet.CASClientInit</servlet-class>
<init-param>
<param-name>edu.yale.its.tp.cas.server.casServerLoginUrl</param-name>
<param-value>http://cas.us.changyou.com/login</param-value>
</init-param>
<init-param>
<param-name>edu.yale.its.tp.cas.server.casServerValidateUrl</param-name>
<param-value>http://cas.us.changyou.com/serviceValidate</param-value>
</init-param>
<init-param>
<param-name>edu.yale.its.tp.cas.server.casServerLogoutUrl</param-name>
<param-value>http://account.us.changyou.com/logout</param-value>
</init-param>
<init-param>
<param-name>edu.yale.its.tp.cas.client.casClientServerName</param-name>
<param-value>account.us.changyou.com</param-value>
</init-param>
<init-param>
<param-name>edu.yale.its.tp.cas.client.casClientServerEncode</param-name>
<param-value>UTF-8</param-value>
</init-param>
<init-param>
<param-name>
edu.yale.its.tp.cas.client.casClientGenerateSession
</param-name>
<param-value>
http://account.us.changyou.com/LoginGenerateSession
</param-value>
</init-param>


泄露7个数据库账号：

<alias>app_user_center</alias>
<driver-url>
jdbc:mysql://192.168.124.214:3306/gameuser?noAccessToProcedureBodies=true&useUnicode=true&characterEncoding=utf-8
</driver-url>
<driver-class>com.mysql.jdbc.Driver</driver-class>
<driver-properties>
<property name="user" value="north_sde"/>
<property name="password" value="t2oSHiUDOvpuBHYRqzs84ir9HN0x/bIruxVkupcLAZg="/>
</driver-properties>
<alias>app_active</alias>
<driver-url>
jdbc:mysql://192.168.124.214:3308/tlbb?noAccessToProcedureBodies=true&useUnicode=true&characterEncoding=utf-8
</driver-url>
<driver-class>com.mysql.jdbc.Driver</driver-class>
<driver-properties>
<property name="user" value="active_user"/>
<property name="password" value="qww8jCs+fgJbpJ2+tellpSQo0ngTQAEEqt5687XBjtg="/>
</driver-properties>
<alias>recharge</alias>
<driver-url>
jdbc:mysql://192.168.124.210:3307/xunxian_ims_en?noAccessToProcedureBodies=true&useUnicode=true&characterEncoding=utf-8
</driver-url>
<driver-class>com.mysql.jdbc.Driver</driver-class>
<driver-properties>
<property name="user" value="xx_glbpoint_885"/>
<property name="password" value="zjYv0Da8fbtCe6LINlMj/er7Z762zMzHvyyiiQqs2Po="/>
</driver-properties>
<alias>web_service</alias>
<driver-url>
jdbc:mysql://192.168.124.215:3306/csdb?noAccessToProcedureBodies=true&useUnicode=true&characterEncoding=utf-8
</driver-url>
<driver-class>com.mysql.jdbc.Driver</driver-class>
<driver-properties>
<property name="user" value="csfw"/>
<property name="password" value="HKFQDtMKgzhDSEm1CW7sixoM/zxquY0woI93eV6Ju3g="/>
</driver-properties>
<alias>app_dj_active</alias>
<driver-url>
jdbc:mysql://192.168.124.217:3308/sword2_inner?noAccessToProcedureBodies=true&useUnicode=true&characterEncoding=utf-8
</driver-url>
<driver-class>com.mysql.jdbc.Driver</driver-class>
<driver-properties>
<property name="user" value="sw2in_acusr342"/>
<property name="password" value="Uhe8DZAx9fC1nC7C/oqsrHS+SPPnY5KF"/>
</driver-properties>
<alias>app_xx_active</alias>
<driver-url>
jdbc:mysql://192.168.124.214:3308/xunxian?noAccessToProcedureBodies=true&useUnicode=true&characterEncoding=utf-8
</driver-url>
<driver-class>com.mysql.jdbc.Driver</driver-class>
<driver-properties>
<property name="user" value="xx_actUser281"/>
<property name="password" value="exxRC3HrPAcX0hDzQxe2ZYjlA2XzujH2"/>
</driver-properties>
<alias>app_8bitFighter_active</alias>
<driver-url>
jdbc:mysql://192.168.124.214:3308/tianguan?noAccessToProcedureBodies=true&useUnicode=true&characterEncoding=utf-8
</driver-url>
<driver-class>com.mysql.jdbc.Driver</driver-class>
<driver-properties>
<property name="user" value="tg_actUser391"/>
<property name="password" value="tdMmeJlwpd4+llOay0E5awMwMJ2f2IPO"/>
</driver-properties>

修复方案：

禁止http访问

版权声明：转载请注明来源 lijiejie@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：5

确认时间：2015-06-23 06:55

厂商回复：

已确认，正安排修复，非常感谢！

最新状态：

暂无

漏洞评价：

评论