漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-0136221
漏洞标题：e家洁存在严重安全漏洞可导致所有会员泄密
相关厂商：1jiajie.com
漏洞作者： Budi
提交时间：2015-09-09 19:27
修复时间：2015-10-25 20:34
公开时间：2015-10-25 20:34
漏洞类型：设计缺陷/逻辑错误
危害等级：高
自评Rank：15
漏洞状态：厂商已经确认
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-09-09： 细节已通知厂商并且等待厂商处理中
2015-09-10： 厂商已经确认，细节仅向厂商公开
2015-09-20： 细节向核心白帽子及相关领域专家公开
2015-09-30： 细节向普通白帽子公开
2015-10-10： 细节向实习白帽子公开
2015-10-25： 细节向公众公开
简要描述：
e家洁的Session设置存在严重安全漏洞，可导致所有会员泄密
详细说明：
1、首先我们先了解一下e家洁是干什么的呢，原来是一家线上家政服务公司，且盛大和腾讯投资的，看来有点来头
2、首先用自己的账号和错误的密码登录，下面是登录的请求报文和响应报文
从下面的响应报文可以发现，虽然登录失败，但报文里返回了两个奇怪自段old_user_id和new_user_id，这个两个字段有什么用处呢，稍后你就明白了
3、用自己的账号和正确的密码登录，并抓取其请求报文如下：
4、尝试查询自己的个人信息、历史订单、地址信息，由此可以推断出系统工具session_id区分客户的
漏洞证明：
根据以上session_id=dfc904a70bcc646e425617b695a7378d-47796448，可以发现Session的最后是一个数字串就是new_user_id字段，由此我们可以尝试以下攻击，
第一步：使用任意手机号尝试登录，虽然登录失败，但服务器返回了new_user_id字段，因此可以所有会员的new_user_id字段
第二步：伪造Session，获取其他会员的个人信息
1、使用任意手机号尝试登录，获取其他会员的new_user_id
（1）尝试手机号189××××8××4，获取new_user_id=48182262
（2）尝试土豪手机号18×××××××××，获取new_user_id=14512
4、伪造Session，获取其他会员的个人信息
（1）使用session_id=dfc904a70bcc646e425617b695a7378d-48182262获取会员的个人信息
（2）使用session_id=dfc904a70bcc646e425617b695a7378d-14152获取会员的个人信息
（3）使用session_id=dfc904a70bcc646e425617b695a7378d-48182262获取会员的地址信息
Unicode转中文为：
{"code":"ok","msg":{"address":[{"city":"北京","latitude":"39.884578","longitude":"116.624272","street":"北京东旭花园","place_detail":"×单元×01","address":"北京东旭花园×单元×01","address_id":"1629979"}],"alertMsg":""}}
（4）使用session_id=dfc904a70bcc646e425617b695a7378d-14152获取会员的地址信息
（5）使用session_id=dfc904a70bcc646e425617b695a7378d-48182262获取会员的订单信息
（6）使用session_id=dfc904a70bcc646e425617b695a7378d-14152获取会员的个人订单信息
Unicode转中文为：
{"code":"ok","msg":{"orderList":[{"extend_info":"没有特殊需求","id":"221674","service_type":"4","place_detail":"北京中南海","reserve_time":"2014-04-19 08:00","status":"-1","worker_list":"","create_time":"2014-04-13 15:39:35","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"网站预约","order_id":"221674","service_main":"专业保洁","service_second":"卫生间保洁","create_way":"","sub_order":[],"order_status":["2014-04-13 15:39 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"没有特殊需求","id":"90078","service_type":"1","place_detail":"朝阳湖","reserve_time":"2013-11-21 07:00","status":"-1","worker_list":"","create_time":"2013-11-16 08:22:02","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"90078","service_main":"专业保洁","service_second":"家庭保洁","create_way":"","sub_order":[],"order_status":["2013-11-16 08:22 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"没有特殊需求","id":"90077","service_type":"1","place_detail":"朝阳湖","reserve_time":"2013-11-18 07:00","status":"-1","worker_list":"","create_time":"2013-11-16 08:21:38","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"90077","service_main":"专业保洁","service_second":"家庭保洁","create_way":"","sub_order":[],"order_status":["2013-11-16 08:21 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"没有特殊需求","id":"90076","service_type":"1","place_detail":"朝阳湖","reserve_time":"2013-11-18 07:00","status":"-1","worker_list":"","create_time":"2013-11-16 08:20:51","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"90076","service_main":"专业保洁","service_second":"家庭保洁","create_way":"","sub_order":[],"order_status":["2013-11-16 08:20 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"没有特殊需求","id":"90074","service_type":"1","place_detail":"朝阳湖","reserve_time":"2013-11-16 10:30","status":"-1","worker_list":"","create_time":"2013-11-16 08:19:02","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"90074","service_main":"专业保洁","service_second":"家庭保洁","create_way":"","sub_order":[],"order_status":["2013-11-16 08:19 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"没有特殊需求","id":"90071","service_type":"1","place_detail":"朝阳湖","reserve_time":"2013-11-16 10:30","status":"-1","worker_list":"","create_time":"2013-11-16 08:16:12","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"90071","service_main":"专业保洁","service_second":"家庭保洁","create_way":"","sub_order":[],"order_status":["2013-11-16 08:16 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"没有特殊需求","id":"90069","service_type":"1","place_detail":"朝阳湖","reserve_time":"2013-11-21 07:00","status":"-1","worker_list":"","create_time":"2013-11-16 08:14:49","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"90069","service_main":"专业保洁","service_second":"家庭保洁","create_way":"","sub_order":[],"order_status":["2013-11-16 08:14 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"客户号码空号","id":"63452","service_type":"1","place_detail":"朝阳湖","reserve_time":"2013-11-17 07:00","status":"-1","worker_list":"","create_time":"2013-11-15 10:03:28","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"63452","service_main":"专业保洁","service_second":"家庭保洁","create_way":"","sub_order":[],"order_status":["2013-11-15 10:03 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""},{"extend_info":"已发短信，超出服务区","id":"16031","service_type":"2","place_detail":"朝阳湖","reserve_time":"2013-10-17 13:00","status":"-1","worker_list":"","create_time":"2013-10-16 05:02:50","user_id":"14512","is_paid":"1","active_code_id":"0","charge_reward_id":"0","reserve_type_id":"0","pop_channel":"苹果app","order_id":"16031","service_main":"专业保洁","service_second":"新居开荒","create_way":"","sub_order":[],"order_status":["2013-10-16 05:02 订单已取消"],"complain_status":["2015-04-28 17:48:48 投诉成功"],"active_code":"","active_code_value":"0","suggest_worked_time":""}],"workerList":[],"alertMsg":"","pageNum":"1","totalPage":"1","totalNum":"9"}}
保洁还去中南海。。。。
修复方案：
其实系统还存在另外一个问题，那就是不管什么时候登录，Session都一样
1、不要使用可以推断出来的Session
2、系统不管该会员什么时候登录，均使用同一个Session
版权声明：转载请注明来源 Budi@乌云
漏洞回应
厂商回应：
危害等级：高
漏洞Rank：16
确认时间：2015-09-10 20:33
厂商回复：
多谢发现者
最新状态：
2015-09-14：能帮助测试一下吗,已经修改了