当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0124707

漏洞标题:糗事百科某处泄露用户详细用户信息包括地理位置

相关厂商:糗事百科

漏洞作者: 路人甲

提交时间:2015-07-05 17:12

修复时间:2015-08-20 14:38

公开时间:2015-08-20 14:38

漏洞类型:系统/服务补丁不及时

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-07-05: 细节已通知厂商并且等待厂商处理中
2015-07-06: 厂商已经确认,细节仅向厂商公开
2015-07-16: 细节向核心白帽子及相关领域专家公开
2015-07-26: 细节向普通白帽子公开
2015-08-05: 细节向实习白帽子公开
2015-08-20: 细节向公众公开

简要描述:

enheng

详细说明:

203.195.192.112	
open.qiushibaike.com

漏洞证明:

多抓了几,发现了这么敏感的信息。。。。
Connecting 203.195.192.112:443...
Sending Client Hello...
Waiting for Server Hello...
... received message: type = 22, ver = 0302, length = 58
... received message: type = 22, ver = 0302, length = 5244
... received message: type = 22, ver = 0302, length = 4
Sending heartbeat request...
... received message: type = 24, ver = 0302, length = 16384
Received heartbeat response:
.@....SC[...r....+..H...9..w.3....f.....".!.9.8...5.....3.2.....E.D...../...A...I.....4.2...#.ve..Accept-Encoding: gzip..Content-Length: 45....access_token=fcb7c37ed1187b33ded9467163b4a86e2....T.....s.l.!.zI.bf.,.D....9.]K...B..wheff53cc8f2d654eb2&grant_type=code&redirect_uri=https%3A%2F%2Fopen.qiushibaike.com%2Fsdk%2Fdefault.html,!.%.....NRgMN.^<....i..2UR...P.Q.R.S.T.U.V.W.X.Y.Z.[.\.].^._.`.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.{.|.}.~.....I.....4.2...#.84, "signature": "", "login": "\u6211\u65b9\u5c0f\u5b66\u751f", "age": 21}, "err": 0}3}, "err": 0}4e0d\u6703\u592a\u5dee", "age": 19, "dis": 19531.626438821662}, {"uid": 27929072, "hometown": "\u5e7f\u4e1c \u00b7 \u63ed\u9633", "haunt": "\u6df1\u5733 \u00b7 \u9f99\u5c97", "qb_age": 38, "astrology": "\u91d1\u725b\u5ea7", "loc": [114.236515, 22.745875999999999], "mobile_brand": "Android", "smile_cnt": 0, "big_cover": "http://cover.qiushibaike.com/nopic.jpg?imageView2/2/w/500/q/80", "qs_cnt": 0, "version": "new", "last_visit_time": 1433235143.3404939, "relationship": "no_rel", "job": "\u642c\u7816\u6c57", "birthday": "1994-04-22", "icon": "nopic.jpg", "name": "\u67d4\u97e7\u731b\u72c2\u66b4", "gender": "F", "created_at": 1429942728, "signature": "", "age": 21, "dis": 19789.235951259885}, {"uid": 20564859, "hometown": "\u56db\u5ddd \u00b7 \u5e7f\u5b89", "haunt": "\u6df1\u5733 \u00b7 \u9f99\u5c97", "qb_age": 264, "astrology": "\u5de8\u87f9\u5ea7", "loc": [114.1537892701046, 22.62590038517402], "mobile_brand": "iPhone 5s", "smile_cnt": 0, "big_cover": "http://cover.qiushibaike.com/Fs4QFKCtsQmtUtlTszyj6itVpxTb?imageView2/2/w/500/q/80", "qs_cnt": 0, "version": "new", "last_visit_time": 1433228114.241914, "relationship": "no_rel", "job": "\u5bb6\u91cc\u8e72", "birthday": "1991-06-22", "icon": "20150516235729.jpg", "name": "\u5e78\u798f\u6709\u4f60\u5c31\u597d", "gender": "F", "created_at": 1410419771, "signature": "", "age": 23, "dis": 20247.842552024729}, {"uid": 17816579, "hometown": "\u6cb3\u5317 \u00b7 \u5f20\u5bb6\u53e3", "haunt": "\u6df1\u5733 \u00b7 \u9f99\u5c97", "qb_age": 326, "astrology": "\u5904\u5973\u5ea7", "loc": [114.246362, 22.747191999999998], "mobile_brand": "Android", "smile_cnt": 283, "big_cover": "http://cover.qiushibaike.com/FrQFh0PuUjlUbMwclmFnx2MqSGVE?imageView2/2/w/500/q/80", "qs_cnt": 2, "version": "new", "last_visit_time": 1433249271.5584869, "relationship": "no_rel", "job": "\u5b66\u751f\u6c6a", "birthday": "1998-08-25", "icon": "20150322235321.jpg", "name": "\u65e0\u5fc3\u75c5\u4eba\u00b0", "gender": "F", "created_at": 1405125173, "signature": "", "age": 16, "dis": 20756.620251702527}, {"uid": 28766060, "hometown": "\u6e56\u5317 \u00b7 \u54b8\u5b81", "haunt": "\u4e1c\u839e \u00b7 \u4e1c\u839e", "qb_age": 1, "astrology": "\u5929\u79e4\u5ea7", "loc": [114.03215, 22.969823000000002], "mobile_brand": "\u534e\u4e3a G620", "smile_cnt": 0, "big_cover": "", "qs_cnt": 0, "version": "new", "last_visit_time": 1433248141.61185, "relationship": "no_rel", "job": "\u5bb6\u91cc\u8e72", "birthday": "1980-10-13", "icon": "20150602195713.jpg", "name": "\u5927\u5a76:-X", "gender": "F", "created_at": 1433217433, "signature": "", "age": 34, "dis": 21275.19654056244}, {"uid": 22505975, "hometown": "\u56db\u5ddd \u00b7 \u6210\u90fd", "haunt": "\u4e1c\u839e", "qb_age": 207, "astrology": "\u6c34\u74f6\u5ea7", "loc": [113.923, 22.93479], "mobile_brand": "iPhone 4S", "smile_cnt": 0, "big_cover": "http://cover.qiushibaike.com/FgNVdFS6rfqgNfGX4v7pTKeHNKZK?imageView2/2/w/500/q/80", "qs_cnt": 0, "version": "new", "last_visit_time": 1433293331.554584, "relationship": "no_rel", "job": "\u5b66\u751f\u6c6a", "birthday": "1993-02-11", "icon": "20150313111724.jpg", "name": "\u6c34\u5ae9\u82cf\u82cf", "gender": "F", "created_at": 1415438255, "signature": "", "age": 22, "dis": 21478.240736466018}, {"uid": 12415275, "hometown": "\u5e7f\u897f \u00b7 \u6765\u5bbe", "haunt": "\u6df1\u5733 \u00b7 \u5b9d\u5b89", "qb_age": 571, "astrology": "\u91d1\u725b\u5ea7", "loc": [113.827917, 22.764149], "mobile_brand": "\u534e\u4e3a \u8363\u8000\u7545\u73a94X", "smile_cnt": 962, "big_cover": "http://cover.qiushibaike.com/FvkjwqnMzFR8af8MxtaT15lDxKaM?imageView2/2/w/500/q/80", "qs_cnt": 1, "version": "new", "last_visit_time": 1433273168.6987381, "relationship": "no_rel", "job": "\u642c\u7816\u6c57", "birthday": "1986-05-20", "icon": "20140731233527.jpg", "name": "\u5317\u6781\u661fygj", "gender": "F", "created_at": 1383922315, "signature": "\u6ca1\u4e2a\u6027", "age": 29, "dis": 22510.386693285229}, {"uid": 28166108, "hometown": "\u56fd\u5916 \u00b7 \u5357\u975e", "haunt": "\u6df1\u5733 \u00b7 \u5357\u5c71", "qb_age": 30, "astrology": "\u5de8\u87f9\u5ea7", "loc": [113.9557144439531, 22.582264485136569], "mobile_brand": "iPhone 6", "smile_cnt": 0, "big_cover": "http://cover.qiushibaike.com/FqugYvoX4ZgniFqfYAk9onnTUH0Z?imageView2/2/w/500/q/80", "qs_cnt": 0, "version": "new", "last_visit_time": 1433268188.047899, "relationship": "no_rel", "job": "\u5185\u52a1\u6c6a", "birthday": "1992-07-14", "icon": "20150529170459.jpg", "name": "\u4e70\u4e2a\u9753\u53f7\u5417\uff1f", "gender": "F", "created_at": 1430725066, "signature": "", "age": 22, "dis": 23788.887042217008}, {"uid": 5831686, "hometown": "\u6e56\u5317 \u00b7 \u4ed9\u6843", "haunt": "\u6df1\u5733 \u00b7 \u7f57\u6e56", "qb_age": 871, "astrology": "\u72ee\u5b50\u5ea7", "loc": [114.17648882148519, 22.601540470379369], "mobile_brand": "iPhone 6+", "smile_cnt": 712, "big_cover": "http://cover.qiushibaike.com/FoGcPeArOJvM1q13Q26E7cYAwkUM?imageView2/2/w/500/q/80", "qs_cnt": 3, "version": "new", "last_visit_time": 1433245586.3338411, "relationship": "no_rel", "job": "\u5bb6\u91cc\u8e72", "birthday": "1989-08-07", "icon": "20141213154751.jpg", "name": "xiatianlei110", "gender": "F", "created_at": 1357976117, "signature": "", "age": 25, "dis": 23791.718325374906}, {"uid": 7107779, "hometown": "\u6e56\u5317 \u00b7 \u8346\u5dde", "haunt": "\u6df1\u5733 \u00b7 \u798f\u7530", "qb_age": 824, "astrology": "\u53cc\u5b50\u5ea7", "loc": [114.054384, 22.564906000000001], "mobile_brand": "\u91d1\u7acb GN9000", "smile_cnt": 537, "big_cover": "http://cover.qiushibaike.com/FkjjM3P457HQDq15xSjYtIUxXpmT?imageView2/2/w/500/q/80", "qs_cnt": 3, "version": "new", "last_visit_time": 1433258909.950422, "relationship": "no_rel", "job": "\u9500\u552e\u6c6a", "birthday": "1992-05-27", "icon": "20150526005931.jpg", "name": "\u7537\u795e\u5df2\u5a5a", "gender": "F", "created_at": 1362121952, "signature": "", "age": 23, "dis": 23815.563069692133}, {"uid": 15960881, "hometown": "\u4e91\u5357 \u00b7 \u6606\u660e", "haunt": "\u6df1\u5733 \u00b7 \u5b9d\u5b89", "qb_age": 398, "astrology": "\u53cc\u9c7c\u5ea7", "loc": [113.822981, 22.71631], "mobile_brand": "\u6735\u552f S2y", "smile_cnt": 222, "big_cover": "http://cover.qiushibaike.com/FtKzEWiz3EPiZym98gbj9rpgiDDO?imageView2/2/w/500/q/80", "qs_cnt": 2, "version": "new", "last_visit_time": 1433267620.7705181, "relationship": "no_rel", "job": "\u624b\u827a\u6c6a", "birthday": "1995-02-24", "icon": "nopic.jpg", "name": "\u505a\u4e2a\u6e29\u6696\u7684\u5973\u5b50\u3002", "gender": "F", "created_at": 1398875199, "signature": "\u6216\u591a\u6216\u5c11\u7684\u5fc3\u9178\u3002", "age": 20, "dis": 23994.036829377623}, {"uid": 17884363, "hometown": "\u6c5f\u897f \u00b7 \u5409\u5b89", "haunt": "\u6df1\u5733 \u00b7 \u5357\u5c71", "qb_age": 324, "astrology": "\u5929\u874e\u5ea7", "loc": [113.966566, 22.570198000000001], "mobile_brand": "Vivo X3l", "smile_cnt": 1510, "big_cover": "http://cover.qiushibaike.com/Fj7Oem642SURDn7iHFIYQzgTdGW4?imageView2/2/w/500/q/80", "qs_cnt": 4, "version": "new", "last_visit_time": 1433259364.317096, "relationship": "no_rel", "job": "\u5bb6\u91cc\u8e72", "birthday": "1991-11-16", "icon": "20150221182636.jpg", "name": "\u4f73\u917f", "gender": "F", "created_at": 1405313655, "signature": "", "age": 23, "dis": 24633.826475565405}, {"uid": 15099201, "hometown": "\u8d35\u5dde \u00b7 \u516d\u76d8\u6c34", "haunt": "\u6df1\u5733 \u00b7 \u5b9d\u5b89", "qb_age": 433, "astrology": "\u6469\u7faf\u5ea7", "loc": [113.803675, 22.765419999999999], "mobile_brand": "\u4e09\u661f S4", "smile_cnt": 108, "big_cover": "http://cover.qiushibaike.com/FqPyKiFXGe2ufcCk64kKOgLcYnsW?imageView2/2/w/500/q/80", "qs_cnt": 2, "version": "new", "last_visit_time": 1433290595.5463791, "relationship": "no_rel", "job": "\u5bb6\u91cc\u8e72", "birthday": "1990-01-19", "icon": "20141226201543.jpg", "name": "\u5495\u549a\u5b50\u9752", "gender": "F", "created_at": 1395877531, "signature": "", "age": 25, "dis": 24980.817523505601}, {"uid": 5147561, "hometown": "\u5e7f\u4e1c \u00b7 \u97f6\u5173", "haunt": "\u4e1c\u839e", "qb_age": 897, "astrology": "\u72ee\u5b50\u5ea7", "loc": [113.845512, 22.905842], "mobile_brand": "\u5c0f\u7c73 Note", "smile_cnt": 4354, "big_cover": "http://cover.qiushibaike.com/FuwnpppoMyJsnHwq0faOyv8VLz5Z?imageView2/2/w/500/q/80", "qs_cnt": 3, "version": "new", "last_visit_time": 1433253421.8705461, "relationship": "no_rel", "job": "\u516c\u52a1\u733f", "birthday": "1996-08-15", "icon": "20150517212147.jpg", "name": "\u5c0f\u9646\u9646\u9732\u9732\u565c\u565c", "gender": "F", "created_at": 1355725814, "signature": "[\u6076\u9b54][\u6076\u9b54]", "age": 18, "dis": 24996.544610921243}, {"uid": 17251255, "hometown": "\u5e7f\u4e1c \u00b7 \u4e1c\u839e", "haunt": "\u4e1c\u839e \u00b7 \u4e1c\u839e", "qb_age": 342, "astrology": "\u5929\u79e4\u5ea7", "loc": [113.80034499999999, 22.804532999999999], "mobile_brand": "Vivo X3t", "smile_cnt": 0, "big_cover": "", "qs_cnt": 0, "version": "new", "last_visit_time": 1433243294.245532, "relationship": "no_rel", "job": "\u624b\u827a\u6c6a", "birthday": "1986-09-26", "icon": "20150314143620.jpg", "name": "\u6ca1\u94b1\u4e86\uff0c\u8c01\u6551\u6211", "gender": "F", "created_at": 1403730763, "signature": "\u522b\u95ee\u6211\u51e0\u5c81\uff0c\u513f\u5b50\u90fd\u4f1a\u6253\u9171\u6cb9\u4e86\uff01\uff01", "age": 28, "dis": 25432.426684621183}, {"uid": 19887519, "hometown": "\u6e56\u5317 \u00b7 \u9ec4\u5188", "haunt": "\u4e1c\u839e", "qb_age": 282, "astrology": "\u72ee\u5b50\u5ea7", "loc": [114.029976, 23.007197000000001], "mobile_brand": "\u5c0f\u7c73 2S", "smile_cnt": 0, "big_cover": "http://cover.qiushibaike.com/Fiocvhgi2w1QAUmCBOLRKNLCYIfk?imageView2/2/w/500/q/80", "qs_cnt": 0, "version": "new", "last_visit_time": 1433289084.2467461, "relationship": "no_rel", "job": "\u642c\u7816\u6c57", "birthday": "1994-08-05", "icon": "20140906101324.jpg", "name": "\u82b1\u5f00\u3001\u82b1\u843d\u6211\u5728\u8fd9", "gender": "F", "created_at": 1408937627, "signature": "", "age": 20, "dis": 25436.413339844388}, {"uid": 17998625, "hometown": "\u5b89\u5fbd \u00b7 \u5b89\u5e86", "haunt": "\u6df1\u5733 \u00b7 \u5b9d\u5b89", "qb_age": 320, "astrology": "\u5c04\u624b\u5ea7", "loc": [113.8073045210068, 22.709425066349059], "mobile_brand": "iPhone 6+", "smile_cnt": 2661, "big_cover": "http://cover.qiushibaike.com/FlxiWV-OsRm3wdL8e5PACSue26Yf?imageView2/2/w/500/q/80", "qs_cnt": 2, "version": "new", "last_visit_time": 1433214464.4947081, "relationship": "no_rel", "job": "\u642c\u7816\u6c57", "birthday": "1987-11-23", "icon": "20150514090515.jpg", "name": "\u4f59\u5c0f\u5154\u5154", "gender": "F", "created_at": 1405611664, "signature": "\u7cd7\u767e\u53d8\u4e86", "age": 27, "dis": 25756.597951933451}, {"uid": 20160041, "hometown": "\u91cd\u5e86", "haunt": "\u6df1\u5733 \u00b7 \u7f57\u6e56", "qb_age": 274, "astrology": "\u6c34\u74f6\u5ea7", "loc": [114.11081433906681, 22.55424131373514], "mobile_brand": "iPhone 5s", "smile_cnt": 2118, "big_cover": "http://cover.qiushibaike.com/FtXZ6nqFCnYN_dRh2U8kkVEjA14-?imageView2/2/w/500/q/80", "qs_cnt": 2, "version": "new", "last_visit_time": 1433262468.8859179, "relationship": "no_rel", "job": "\u5546\u52a1\u6c6a", "birthday": "1993-01-24", "icon": "20150513225809.jpg", "name": "\u6768\u4e8c\u971e", "gender": "F", "created_at": 1409604323, "signature": "", "age": 22, "dis": 25835.666894960272}, {"uid": 21903737, "hometown": "\u5e7f\u897f \u00b7 \u5317\u6d77", "haunt": "\u6df1\u5733 \u00b7 \u9f99\u5c97", "qb_age": 226, "astrology": "\u5929\u79e4\u5ea7", "loc": [114.2906, 22.71829], "mobile_brand": "iPhone 4S", "smile_cnt": 0, "big_cover": "http://cover.qiushibaike.com/Fn8gzWZrnNxLJKp29YH9ZH1lSvdm?imageView2/2/w/500/q/80", "qs_cnt": 0, "version": "new", "last_visit_time": 1433262376.399281, "relationship": "no_rel", "job": "\u9500\u552e\u6c6a", "birthday": "1987-10-21", "icon": "20150523161144.jpg", "name": "\u518d\u89c1\u4e2c", "gender": "F", "created_at": 1413787161, "signature": "", "age": 27, "dis": 25887.005926464644}, {"uid": 15307436, "hometown": "\u5e7f\u4e1c \u00b7 \u6df1\u5733", "haunt": "\u6df1\u5733 \u00b7 \u798f\u7530", "qb_age": 425, "astrology": "\u5904\u5973\u5ea7", "loc": [114.0637, 22.545249999999999], "mobile_brand": "iPhone 4S", "smile_cnt": 0, "big_cover": "http://cover.qiushibaike.com/FqkwlvfFM2VjgHJJ_C8pqbz1fSp9?imageView2/2/w/500/q/80", "qs_cnt": 0, "version": "new", "last_visit_time": 1433222481.6309559, "relationship": "no_rel", "job": "\u642c\u7816\u6c57", "birthday": "1990-09-04", "icon": "20150516231846.jpg", "name": "\u559c\u5927\u666e\u6cea", "gender": "F", "created_at": 1396558455, "signature": "", "age": 24, "dis": 26046.00164232769}]}..
还有些内网的东西:
"$http_user_agent" "$http_x_forwarded_for" "$host" "$request_time"..0... . rDyD.....pkD..... - ..rDyD.....pkD..... [.....yD.....pkD.....] "..rDyD.....pkD....." .....qD.....pkD..... qD.....pkD..... "...rDyD.....pkD....." ....pkD....."....rDyD.remote_addrremote_userrequest.....`.....0.D.....http_refererhttp_user_agentrDyD.....pkD..... - ..rDyD.....pkD..... [.....yD.....pkD.....] "..rDyD.....pkD....." .....qD.....pkD..... qD.....pkD..... "...rDyD.....pkD....." ....pkD....."....rDyD.....pkD....." "..rDyD.....pkD....." "..rDyD.....pkD....." "...@rD.....pkD.....".....0....7.i..!...0.P.0.....@..i..!.0.....@.....pB.i..0.0. . .....http_x_forwarded_forhostaccess_log.i/var/log/nginx/access.log..main...(.....P.`.`.p.sendfile..on..keepalive_timeout..65..proxy_ignore_client_abort..on..proxy_connect_timeout..600..proxy_read_timeout..600.@proxy_send_timeout..600..proxy_buffer_size..64k..proxy_buffers.Q16..32k..proxy_busy_buffers_size..128k.~proxy_temp_file_write_size..512k..client_header_buffer_size..32k.7client_max_body_size..20m..large_client_header_buffers..4..64k..limit_req_zone..$binary_remote_addr..zone=two.10m..rate=4r/s.....efdf....d...`....wF.D.D.D.D.D.0.....D..... .D.....D.H...P.DNGQG.D.D....~.h.iq.....@..i0.@...`....i....binary_remote_addrserver_tokens.`off..gzip..on..gzip_types.itext/plain..text/css..application/x-javascript..text/xml..application/xml..application/xml+rss..text/javascript..include../etc/nginx/conf.d/*.conf../etc/nginx/conf.d/ssl.conf./etc/nginx/conf.d/deny.conf.deny..101.226.64.175.|.....e.@.e.Y@e..je@....deny..101.226.89.64..deny..101.246.184.106..deny..101.64.177.196..deny..101.64.177.198..deny..10

修复方案:

~~~

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:10

确认时间:2015-07-06 14:37

厂商回复:

厂商已处理,非常感谢。

最新状态:

暂无


漏洞评价:

评论

  1. 2015-07-05 17:16 | 紫霞仙子 ( 普通白帽子 | Rank:2027 漏洞数:279 | 天天向上 !!!)

    没走大厂。。。。。