当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0123432

漏洞标题：帮室友找对象App可致用户敏感信息泄露

相关厂商：心悦君兮

漏洞作者： orange

提交时间：2015-07-03 12:38

修复时间：2015-08-17 12:40

公开时间：2015-08-17 12:40

漏洞类型：敏感信息泄露

危害等级：高

自评Rank：15

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-07-03： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-08-17： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

To单身的你
我们产品的初衷是让大家能在学校找到对象。
也许你的专业异性很少，也许你不擅长搭讪，也许了解女生的唯一渠道就是各类以YP出名的软件，没关系，至少还有我们与你并肩。
如果室友是单身或者你自己也单身，无数的小伙伴都把信息发上来，说不定，在弹指间就对上眼了呢。
————— 默默无闻的开发者致上

详细说明：

## 官网链接

http://www.xinyuejunxi.com/


## 测试环境

系统版本：Android 5.1.1
软件版本：官网最新版
抓包工具：Burp Suite Pro v1.6.12


## 测试流程
登录后查看 首页 最新动态处

Screenshot_2015-06-29-10-31-56.png


Burp Suite端设置Intercept is on，开始抓包
点击某个用户头像，进入个人资料
Burp Suite端拦截了此次请求，我们右键把请求内容decode一下

Screenshot from 2015-06-29 11:19:50.png


GET /1.1/users?include=pictures,avatar&where={"objectId":"5582c1b2e4b04ccce3c7b248"} HTTP/1.0
Host: api.leancloud.cn
Connection: Keep-Alive
User-Agent: AVOS Cloud android-v3.0.3 SDK
Accept-Encoding: gzip
X-Uluru-Application-Production: 1
Content-Type: application/json
Accept: application/json
X-avoscloud-Application-Id: mp4nefs1bqjgtfgtc1skmhv1w6tjj93sswk32pnph0otfm8g
X-avoscloud-Session-Token: 9jnvjx7xib94xpamzzkp2oae5
x-avoscloud-request-sign: 718efabd8874590a633bc7458163807c,1435547686137


分析请求URL ，可以推测 objectId 为每个用户的唯一标识，include为请求内容

https://api.leancloud.cn/1.1/users?include=pictures,avatar&where={"objectId":"5582c1b2e4b04ccce3c7b248"}


继续右键把请求内容发送到 Repeater

screenshot from 2015-06-29 11:29:42.png


响应内容

{
    "results": [
        {
            "heightRange": 4,
            "blockUsers": {
                "__type": "Relation",
                "className": "_User"
            },
            "updatedAt": "2015-06-23T11:19:32.033Z",
            "age": 19,
            "constellation": 0,
            "school": "扬州大学",
            "objectId": "5582c1b2e4b04ccce3c7b248",
            "signature": "",
            "nickname": "staying out",
            "city": "扬州",
            "username": "13291381370",
            "createdAt": "2015-06-18T13:03:46.396Z",
            "likeFeeds": {
                "__type": "Relation",
                "className": "RMFeed"
            },
            "favoritedFeeds": {
                "__type": "Relation",
                "className": "RMFeed"
            },
            "emailVerified": false,
            "involvedFeeds": {
                "__type": "Relation",
                "className": "RMFeed"
            },
            "filter": {
                "__type": "Pointer",
                "className": "RMFeedFilter",
                "objectId": "55837b68e4b04ccce3d812e9"
            },
            "friends": {
                "__type": "Relation",
                "className": "_User"
            },
            "focusUsers": {
                "__type": "Relation",
                "className": "_User"
            },
            "mobilePhoneNumber": "13291我是马赛克370",
            "pictures": [
                {
                    "mime_type": "image/jpeg",
                    "updatedAt": "2015-06-18T13:04:13.566Z",
                    "key": "sq3VNKTpvAVDwAfWSAiVMRA.jpg",
                    "name": "8B70C99C-9BDE-4D4A-8528-9D42399D6BEE.jpg",
                    "objectId": "5582c1cde4b04ccce3c7b728",
                    "createdAt": "2015-06-18T13:04:13.566Z",
                    "__type": "File",
                    "url": "http://ac-mp4nefs1.clouddn.com/sq3VNKTpvAVDwAfWSAiVMRA.jpg",
                    "metaData": {
                        "size": 56238,
                        "_checksum": "df7374641140815e3d2505bf3a1b59b2",
                        "owner": "5582c1b2e4b04ccce3c7b248"
                    },
                    "bucket": "mp4nefs1"
                },
                {
                    "mime_type": "image/jpeg",
                    "updatedAt": "2015-06-18T13:04:45.844Z",
                    "key": "lGEmCHAZ7xDzTJ61cemVDtC.jpg",
                    "name": "8F0E0ED5-7B3C-4396-99B7-B0EB962CD9C6.jpg",
                    "objectId": "5582c1ede4b04ccce3c7bb03",
                    "createdAt": "2015-06-18T13:04:45.844Z",
                    "__type": "File",
                    "url": "http://ac-mp4nefs1.clouddn.com/lGEmCHAZ7xDzTJ61cemVDtC.jpg",
                    "metaData": {
                        "size": 127842,
                        "_checksum": "5f308e498a4b5c566bb3b00be3b36872",
                        "owner": "5582c1b2e4b04ccce3c7b248"
                    },
                    "bucket": "mp4nefs1"
                },
                {
                    "mime_type": "image/jpeg",
                    "updatedAt": "2015-06-18T13:05:01.847Z",
                    "key": "rnEPceAPapY5hS2PQSsjRrD.jpg",
                    "name": "FB0C5730-64C9-4567-8E75-08EC29131DB9.jpg",
                    "objectId": "5582c1fde4b04ccce3c7bd74",
                    "createdAt": "2015-06-18T13:05:01.847Z",
                    "__type": "File",
                    "url": "http://ac-mp4nefs1.clouddn.com/rnEPceAPapY5hS2PQSsjRrD.jpg",
                    "metaData": {
                        "size": 89776,
                        "_checksum": "5ef989976bc1504b88ba803ff93f55f7",
                        "owner": "5582c1b2e4b04ccce3c7b248"
                    },
                    "bucket": "mp4nefs1"
                },
                {
                    "mime_type": "image/jpeg",
                    "updatedAt": "2015-06-18T13:05:31.428Z",
                    "key": "Wr543ISR2EIdILMgTSsRHtD.jpg",
                    "name": "2F79E5D9-FFDE-441E-A71B-73CCFDB7B722.jpg",
                    "objectId": "5582c21be4b04ccce3c7c1d2",
                    "createdAt": "2015-06-18T13:05:31.428Z",
                    "__type": "File",
                    "url": "http://ac-mp4nefs1.clouddn.com/Wr543ISR2EIdILMgTSsRHtD.jpg",
                    "metaData": {
                        "size": 102832,
                        "_checksum": "decbb776df18794594d6344cf5dacced",
                        "owner": "5582c1b2e4b04ccce3c7b248"
                    },
                    "bucket": "mp4nefs1"
                }
            ],
            "avatar": {
                "mime_type": "image/jpeg",
                "updatedAt": "2015-06-18T13:04:13.566Z",
                "key": "sq3VNKTpvAVDwAfWSAiVMRA.jpg",
                "name": "8B70C99C-9BDE-4D4A-8528-9D42399D6BEE.jpg",
                "objectId": "5582c1cde4b04ccce3c7b728",
                "createdAt": "2015-06-18T13:04:13.566Z",
                "__type": "File",
                "url": "http://ac-mp4nefs1.clouddn.com/sq3VNKTpvAVDwAfWSAiVMRA.jpg",
                "metaData": {
                    "size": 56238,
                    "_checksum": "df7374641140815e3d2505bf3a1b59b2",
                    "owner": "5582c1b2e4b04ccce3c7b248"
                },
                "bucket": "mp4nefs1"
            },
            "gender": 2,
            "province": "江苏",
            "likedFeeds": {
                "__type": "Relation",
                "className": "RMFeed"
            },
            "authData": null,
            "mobilePhoneVerified": true
        }
    ]
}


## 测试结果
App请求响应 包含用户敏感信息

"mobilePhoneNumber":"马赛克"

漏洞证明：

如上

修复方案：

删除无关响应内容，保护好用户隐私

版权声明：转载请注明来源 orange@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝

漏洞Rank：15 (WooYun评价)

漏洞评价：

评论

  1. 2015-08-17 13:19 | 路人毛 ( 路人 | Rank:23 漏洞数:10 | 昨晚做梦，挖到了电信都漏洞，被电信起诉了...)

    可是，你代码里没打马赛克。还是让我看到了，我现在就打电话给她，这么漂亮的妹子，不糟蹋可惜了

  2. 2015-08-17 13:22 | 路人毛 ( 路人 | Rank:23 漏洞数:10 | 昨晚做梦，挖到了电信都漏洞，被电信起诉了...)

    大家快来看33行。

  3. 2015-08-17 14:23 | 旧时人 ° ( 路人 | Rank:20 漏洞数:8 | 我将扼住命运的咽喉，它绝不能使我屈服！Bl...)

    @路人毛 放开她禽兽，让我来

  4. 2015-08-17 15:14 | 圣路西法 ( 路人 | Rank:4 漏洞数:3 | 围观大神ส็็็็็็ ̷̸̨̀͒̏̃ͦ...)

    username并没有屏蔽，难道这个不是电话么？嘿嘿