当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0151604

漏洞标题：feeyo某服务器配置不当造成大量敏感信息泄露（可进入CEO邮箱）

相关厂商：variflight.com

漏洞作者： 0hey_boy0

提交时间：2015-11-04 17:43

修复时间：2015-12-20 14:30

公开时间：2015-12-20 14:30

漏洞类型：未授权访问/权限绕过

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-04： 细节已通知厂商并且等待厂商处理中
2015-11-05： 厂商已经确认，细节仅向厂商公开
2015-11-15： 细节向核心白帽子及相关领域专家公开
2015-11-25： 细节向普通白帽子公开
2015-12-05： 细节向实习白帽子公开
2015-12-20： 细节向公众公开

简要描述：

若我也能成为CEO~那么~

详细说明：

redis数据库未授权访问
IP:42.159.192.145

42.159.192.145:0>info
# Server
redis_version:2.8.4
redis_git_sha1:00000000
redis_git_dirty:0
redis_build_id:a44a05d76f06a5d9
redis_mode:standalone
os:Linux 3.16.0-29-generic x86_64
arch_bits:64
multiplexing_api:epoll
gcc_version:4.8.2
process_id:1702
run_id:c75429374d58616ca6ffdf64e3db6b67d8217381
tcp_port:6379
uptime_in_seconds:3906678
uptime_in_days:45
hz:10
lru_clock:2049429
config_file:/etc/redis/redis.conf
# Clients
connected_clients:11
client_longest_output_list:0
client_biggest_input_buf:0
blocked_clients:0
# Memory
used_memory:9020896
used_memory_human:8.60M
used_memory_rss:19374080
used_memory_peak:9897136
used_memory_peak_human:9.44M
used_memory_lua:33792
mem_fragmentation_ratio:2.15
mem_allocator:jemalloc-3.4.1
# Persistence
loading:0
rdb_changes_since_last_save:0
rdb_bgsave_in_progress:0
rdb_last_save_time:1446557612
rdb_last_bgsave_status:ok
rdb_last_bgsave_time_sec:1
rdb_current_bgsave_time_sec:-1
aof_enabled:0
aof_rewrite_in_progress:0
aof_rewrite_scheduled:0
aof_last_rewrite_time_sec:-1
aof_current_rewrite_time_sec:-1
aof_last_bgrewrite_status:ok
# Stats
total_connections_received:365626
total_commands_processed:746359
instantaneous_ops_per_sec:0
rejected_connections:0
sync_full:0
sync_partial_ok:0
sync_partial_err:0
expired_keys:96
evicted_keys:0
keyspace_hits:390548
keyspace_misses:167495
pubsub_channels:0
pubsub_patterns:0
latest_fork_usec:1877
# Replication
role:master
connected_slaves:0
master_repl_offset:0
repl_backlog_active:0
repl_backlog_size:1048576
repl_backlog_first_byte_offset:0
repl_backlog_histlen:0
# CPU
used_cpu_sys:1134.95
used_cpu_user:1070.59
used_cpu_sys_children:152.21
used_cpu_user_children:560.07
# Keyspace
db0:keys=10269,expires=32,avg_ttl=442061302


大量信息泄露

1.png


4.png


2.png


3.png


这里为什么会有12306和途牛我也是不懂哇
看这里，账号密码泄露（看看我们的CEO和网管）

mail.png


ceo.png


webmaster.png


duang~

漏洞证明：

42.159.192.145:0>info
# Server
redis_version:2.8.4
redis_git_sha1:00000000
redis_git_dirty:0
redis_build_id:a44a05d76f06a5d9
redis_mode:standalone
os:Linux 3.16.0-29-generic x86_64
arch_bits:64
multiplexing_api:epoll
gcc_version:4.8.2
process_id:1702
run_id:c75429374d58616ca6ffdf64e3db6b67d8217381
tcp_port:6379
uptime_in_seconds:3906678
uptime_in_days:45
hz:10
lru_clock:2049429
config_file:/etc/redis/redis.conf
# Clients
connected_clients:11
client_longest_output_list:0
client_biggest_input_buf:0
blocked_clients:0
# Memory
used_memory:9020896
used_memory_human:8.60M
used_memory_rss:19374080
used_memory_peak:9897136
used_memory_peak_human:9.44M
used_memory_lua:33792
mem_fragmentation_ratio:2.15
mem_allocator:jemalloc-3.4.1
# Persistence
loading:0
rdb_changes_since_last_save:0
rdb_bgsave_in_progress:0
rdb_last_save_time:1446557612
rdb_last_bgsave_status:ok
rdb_last_bgsave_time_sec:1
rdb_current_bgsave_time_sec:-1
aof_enabled:0
aof_rewrite_in_progress:0
aof_rewrite_scheduled:0
aof_last_rewrite_time_sec:-1
aof_current_rewrite_time_sec:-1
aof_last_bgrewrite_status:ok
# Stats
total_connections_received:365626
total_commands_processed:746359
instantaneous_ops_per_sec:0
rejected_connections:0
sync_full:0
sync_partial_ok:0
sync_partial_err:0
expired_keys:96
evicted_keys:0
keyspace_hits:390548
keyspace_misses:167495
pubsub_channels:0
pubsub_patterns:0
latest_fork_usec:1877
# Replication
role:master
connected_slaves:0
master_repl_offset:0
repl_backlog_active:0
repl_backlog_size:1048576
repl_backlog_first_byte_offset:0
repl_backlog_histlen:0
# CPU
used_cpu_sys:1134.95
used_cpu_user:1070.59
used_cpu_sys_children:152.21
used_cpu_user_children:560.07
# Keyspace
db0:keys=10269,expires=32,avg_ttl=442061302

修复方案：

验证

版权声明：转载请注明来源 0hey_boy0@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-11-05 14:28

厂商回复：

问题很严重，感谢提供信息，我们已经在着手修复。

最新状态：

暂无

漏洞评价：

评价

  1. 2015-11-07 10:51 | 0hey_boy0 ( 普通白帽子 | Rank:123 漏洞数:22 | balabala~)

    15个扣11个也太狠了吧@浩天

  2. 2015-12-13 14:59 | theone ( 实习白帽子 | Rank:40 漏洞数:6 | hodor，hodor)

    @0hey_boy0 按小厂商算的