当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0151604

漏洞标题:feeyo某服务器配置不当造成大量敏感信息泄露(可进入CEO邮箱)

相关厂商:variflight.com

漏洞作者: 0hey_boy0

提交时间:2015-11-04 17:43

修复时间:2015-12-20 14:30

公开时间:2015-12-20 14:30

漏洞类型:未授权访问/权限绕过

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-11-04: 细节已通知厂商并且等待厂商处理中
2015-11-05: 厂商已经确认,细节仅向厂商公开
2015-11-15: 细节向核心白帽子及相关领域专家公开
2015-11-25: 细节向普通白帽子公开
2015-12-05: 细节向实习白帽子公开
2015-12-20: 细节向公众公开

简要描述:

若我也能成为CEO~那么~

详细说明:

redis数据库未授权访问
IP:42.159.192.145

42.159.192.145:0>info
# Server
redis_version:2.8.4
redis_git_sha1:00000000
redis_git_dirty:0
redis_build_id:a44a05d76f06a5d9
redis_mode:standalone
os:Linux 3.16.0-29-generic x86_64
arch_bits:64
multiplexing_api:epoll
gcc_version:4.8.2
process_id:1702
run_id:c75429374d58616ca6ffdf64e3db6b67d8217381
tcp_port:6379
uptime_in_seconds:3906678
uptime_in_days:45
hz:10
lru_clock:2049429
config_file:/etc/redis/redis.conf
# Clients
connected_clients:11
client_longest_output_list:0
client_biggest_input_buf:0
blocked_clients:0
# Memory
used_memory:9020896
used_memory_human:8.60M
used_memory_rss:19374080
used_memory_peak:9897136
used_memory_peak_human:9.44M
used_memory_lua:33792
mem_fragmentation_ratio:2.15
mem_allocator:jemalloc-3.4.1
# Persistence
loading:0
rdb_changes_since_last_save:0
rdb_bgsave_in_progress:0
rdb_last_save_time:1446557612
rdb_last_bgsave_status:ok
rdb_last_bgsave_time_sec:1
rdb_current_bgsave_time_sec:-1
aof_enabled:0
aof_rewrite_in_progress:0
aof_rewrite_scheduled:0
aof_last_rewrite_time_sec:-1
aof_current_rewrite_time_sec:-1
aof_last_bgrewrite_status:ok
# Stats
total_connections_received:365626
total_commands_processed:746359
instantaneous_ops_per_sec:0
rejected_connections:0
sync_full:0
sync_partial_ok:0
sync_partial_err:0
expired_keys:96
evicted_keys:0
keyspace_hits:390548
keyspace_misses:167495
pubsub_channels:0
pubsub_patterns:0
latest_fork_usec:1877
# Replication
role:master
connected_slaves:0
master_repl_offset:0
repl_backlog_active:0
repl_backlog_size:1048576
repl_backlog_first_byte_offset:0
repl_backlog_histlen:0
# CPU
used_cpu_sys:1134.95
used_cpu_user:1070.59
used_cpu_sys_children:152.21
used_cpu_user_children:560.07
# Keyspace
db0:keys=10269,expires=32,avg_ttl=442061302


大量信息泄露

1.png


4.png


2.png


3.png


这里为什么会有12306和途牛我也是不懂哇
看这里,账号密码泄露(看看我们的CEO和网管)

mail.png


ceo.png


webmaster.png


duang~

漏洞证明:

42.159.192.145:0>info
# Server
redis_version:2.8.4
redis_git_sha1:00000000
redis_git_dirty:0
redis_build_id:a44a05d76f06a5d9
redis_mode:standalone
os:Linux 3.16.0-29-generic x86_64
arch_bits:64
multiplexing_api:epoll
gcc_version:4.8.2
process_id:1702
run_id:c75429374d58616ca6ffdf64e3db6b67d8217381
tcp_port:6379
uptime_in_seconds:3906678
uptime_in_days:45
hz:10
lru_clock:2049429
config_file:/etc/redis/redis.conf
# Clients
connected_clients:11
client_longest_output_list:0
client_biggest_input_buf:0
blocked_clients:0
# Memory
used_memory:9020896
used_memory_human:8.60M
used_memory_rss:19374080
used_memory_peak:9897136
used_memory_peak_human:9.44M
used_memory_lua:33792
mem_fragmentation_ratio:2.15
mem_allocator:jemalloc-3.4.1
# Persistence
loading:0
rdb_changes_since_last_save:0
rdb_bgsave_in_progress:0
rdb_last_save_time:1446557612
rdb_last_bgsave_status:ok
rdb_last_bgsave_time_sec:1
rdb_current_bgsave_time_sec:-1
aof_enabled:0
aof_rewrite_in_progress:0
aof_rewrite_scheduled:0
aof_last_rewrite_time_sec:-1
aof_current_rewrite_time_sec:-1
aof_last_bgrewrite_status:ok
# Stats
total_connections_received:365626
total_commands_processed:746359
instantaneous_ops_per_sec:0
rejected_connections:0
sync_full:0
sync_partial_ok:0
sync_partial_err:0
expired_keys:96
evicted_keys:0
keyspace_hits:390548
keyspace_misses:167495
pubsub_channels:0
pubsub_patterns:0
latest_fork_usec:1877
# Replication
role:master
connected_slaves:0
master_repl_offset:0
repl_backlog_active:0
repl_backlog_size:1048576
repl_backlog_first_byte_offset:0
repl_backlog_histlen:0
# CPU
used_cpu_sys:1134.95
used_cpu_user:1070.59
used_cpu_sys_children:152.21
used_cpu_user_children:560.07
# Keyspace
db0:keys=10269,expires=32,avg_ttl=442061302

修复方案:

验证

版权声明:转载请注明来源 0hey_boy0@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2015-11-05 14:28

厂商回复:

问题很严重,感谢提供信息,我们已经在着手修复。

最新状态:

暂无


漏洞评价:

评价

  1. 2015-11-07 10:51 | 0hey_boy0 ( 普通白帽子 | Rank:123 漏洞数:22 | balabala~)

    15个扣11个也太狠了吧@浩天

  2. 2015-12-13 14:59 | theone ( 实习白帽子 | Rank:40 漏洞数:6 | hodor,hodor)

    @0hey_boy0 按小厂商算的