当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2016-0187223

漏洞标题:奥凯航空某系统重置任意用户密码重置

相关厂商:奥凯航空

漏洞作者: 黑骑士

提交时间:2016-03-21 15:31

修复时间:2016-04-27 14:11

公开时间:2016-04-27 14:11

漏洞类型:设计缺陷/逻辑错误

危害等级:高

自评Rank:18

漏洞状态:厂商已经修复

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2016-03-21: 细节已通知厂商并且等待厂商处理中
2016-03-23: 厂商已经确认,细节仅向厂商公开
2016-04-02: 细节向核心白帽子及相关领域专家公开
2016-04-12: 细节向普通白帽子公开
2016-04-22: 细节向实习白帽子公开
2016-04-27: 厂商已经修复漏洞并主动公开,细节向公众公开

简要描述:

奥凯航空某系统任意用户密码重置

详细说明:

http://ffp.okair.net/welcome.action
奥凯航空祥云俱乐部
经测试之前牛哥提交的漏洞已经修复,但是还是存在重大隐患。在输入正确手机验证码后返回包里的输入新密码页面里有一段代码
<input name="ID" value="140720" type="hidden">
只要更改value值即可重置其他用户的密码,试想如果遍历这个值,恐怕全部用户的密码都会被快速重置
该返回包如下

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=utf-8
Date: Mon, 21 Mar 2016 01:48:47 GMT
Content-Length: 13925
<!doctype html>
<html>
<head>
<meta charset="utf-8">
<title>奥凯航空</title>
<!--[if lt IE 9]>
<script src="/content/js/html5shiv.js" ></script>
<script src="/content/js/respond.min.js" ></script>
<![endif]-->
<link href="/content/css/bootstrap.css" rel="stylesheet">
<link href="/content/css/common.css" rel="stylesheet">
<!--[if IE 8]>
<link href="/content/css/forie.css" rel="stylesheet">
<script src="/content/js/html5shiv.js" ></script>
<![endif]-->
<!--[if IE 7]>
<script>
alert("浏览器版本过低,有可能会影响您的浏览。请使用高版本浏览器!~")
</scrtipt>
<![endif]-->
<script src="/content/js/jquery.min.1.10.1.js"></script>
<script>
var webPath = "";
</script>
</head>
<body>
<div style="width: 100%; background: #fff;">
<div class="container header overflow-h">
<a href="welcome.action" class="left"> <img
src="/content/images/top_03.jpg"
style="display: block; margin-top: 30px"></a> <a
href="javascript:void(0);" class="left"></a>
<div class="right mt30 ml30 no-login-infor"
style="display: block; margin-top: 10px">
<span style="color:#FF5809">日访问量91次,总访问量162979次</span><br/><br/> <a href="ffplogin.action">登录</a> | <a href="ffpreg.action">注册</a>
</div>
<span class="language hidden-sm hidden-xs"> <img
src="/content/images/top_06.jpg"
style="display: block; margin-top: 20px"></span>
</div>
</div>
<div class="navbar-wrapper">
<div
style="width: 100%; height: 5px; overflow: hidden; margin: 0; padding: 0; background: #d55912;"></div>
<div class="container hidden-xs">
<ul class="nav-tab">
<li><a class="menu_a" href="welcome.action"><span>首页</span></a></li>
<li><a class="menu_a"><span>我的账户</span></a>
<div class="sec_menu shadow">
<div class="col-lg-3 col-md-3 col-sm-4">
<div class="overflow-hid" style="margin: 0 auto">
<hgroup class="mt20 text-align-l">
<p style="text-align: center">
<img src="/content/images/tx_06.jpg">
</p>
<p class="overflow-hid"
style="text-align: center; width: 150px; margin: 0 auto">
<a class="primary-btn-md left" href="ffplogin.action">会员登录</a>
<a class="inq-btn-md left ml10" href="ffpreg.action">注册</a>
</p>
<p class="clear"></p>
<p class="overflow-hid" style="text-align: center">加入会员俱乐部乐享更多服务!</p>
</hgroup>
</div>
</div>
<div class="col-lg-9 col-md-9 col-sm-8">
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="accountinfo.action">账户汇总</a>
</h4>
<p>账户信息总汇、里程变动及卡级别权益</p>
</hgroup>
</div>
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="memberaccount.action">账户明细</a>
</h4>
<p>查看您的账户里程及航空活动</p>
</hgroup>
</div>
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="personalinfo.action">个人信息管理</a>
</h4>
<p>管理您的账户</p>
</hgroup>
</div>
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="beneficialinfo.action">受让人管理</a>
</h4>
<p>管理您的受让人信息</p>
</hgroup>
</div>
</div>
</div></li>
<li><a class="menu_a"><span>里程累积</span></a>
<div class="sec_menu shadow">
<div class="col-lg-3 col-md-3 col-sm-4">
<div class="overflow-hid" style="margin: 0 auto">
<hgroup class="mt20 text-align-l">
<p style="text-align: center">
<img src="/content/images/lc_06.jpg">
</p>
<p class="clear"></p>
<p class="overflow-hid" style="text-align: center">积累更多畅享优惠!</p>
</hgroup>
</div>
</div>
<div class="col-lg-9 col-md-9 col-sm-8">
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="rule!show.action?ruletype=4">飞行里程</a>
</h4>
<p>奥凯航空里程累积规则标准</p>
</hgroup>
</div>
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="javascript:void(0);">其他合作伙伴里程</a>
</h4>
<p>建设中,敬请期待</p>
</hgroup>
</div>
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="mileageretroinfo.action">里程补登</a>
</h4>
<p>里程补登信息提交及补登须知</p>
</hgroup>
</div>
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="standard.action">兑奖标准查询</a>
</h4>
<p>兑奖标准查询</p>
</hgroup>
</div>
</div>
</div></li>
<li><a class="menu_a"><span>里程兑换</span></a>
<div class="sec_menu shadow">
<div class="col-lg-3 col-md-3 col-sm-4">
<div class="overflow-hid" style="margin: 0 auto">
<hgroup class="mt20 text-align-l">
<p style="text-align: center">
<img src="/content/images/dh_07.jpg">
</p>
<p class="clear"></p>
<p class="overflow-hid" style="text-align: center">里程越多,兑换越多!</p>
</hgroup>
</div>
</div>
<div class="col-lg-9 col-md-9 col-sm-8">
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="shopping!av.action">奖励机票数量查询</a>
</h4>
<p>查询兑换奖励机票数量</p>
</hgroup>
</div>
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="javascript:void(0);">兑换升舱</a>
</h4>
<p>建设中,敬请期待</p>
</hgroup>
</div>
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="mall.action">里程商城</a>
</h4>
<p>通过里程兑换最新最热商品</p>
</hgroup>
</div>
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="rule!show.action?ruletype=1">如何兑奖</a>
</h4>
<p>兑奖规则介绍</p>
</hgroup>
</div>
</div>
</div></li>
<li><a class="menu_a"><span>活动专区</span></a>
<div class="sec_menu shadow">
<div class="col-lg-3 col-md-3 col-sm-4">
<div class="overflow-hid" style="margin: 0 auto">
<hgroup class="mt20 text-align-l">
<p style="text-align: center">
<img src="/content/images/hd_07.jpg">
</p>
<p class="clear"></p>
<p class="overflow-hid" style="text-align: center">精彩活动我参与!</p>
</hgroup>
</div>
</div>
<div class="col-lg-9 col-md-9 col-sm-8">
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="ffppro!listPro.action?protype=1">航空促销活动</a>
</h4>
<p>航空产品优惠资讯</p>
</hgroup>
</div>
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="ffppro!listPro.action?protype=2">俱乐部活动</a>
</h4>
<p>俱乐部活动早知道</p>
</hgroup>
</div>
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="javascript:void(0);">合作伙伴活动</a>
</h4>
<p>建设中,敬请期待</p>
</hgroup>
</div>
</div>
</div></li>
<li><a class="menu_a"><span>合作伙伴</span></a>
<div class="sec_menu shadow">
<div class="col-lg-3 col-md-3 col-sm-4">
<div class="overflow-hid" style="margin: 0 auto">
<hgroup class="mt20 text-align-l">
<p style="text-align: center">
<img src="/content/images/hb1_07.jpg">
</p>
<p class="clear"></p>
<p class="overflow-hid" style="text-align: center">精彩活动我参与!</p>
</hgroup>
</div>
</div>
<div class="col-lg-9 col-md-9 col-sm-8">
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="javascript:void(0);">航空类</a>
</h4>
<p>敬请期待</p>
</hgroup>
</div>
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="javascript:void(0);">酒店类</a>
</h4>
<p>敬请期待</p>
</hgroup>
</div>
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="javascript:void(0);">银行类</a>
</h4>
<p>敬请期待</p>
</hgroup>
</div>
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="javascript:void(0);">租车类</a>
</h4>
<p>敬请期待</p>
</hgroup>
</div>
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="javascript:void(0);">特约客户</a>
</h4>
<p>敬请期待</p>
</hgroup>
</div>
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="javascript:void(0);">保险类</a>
</h4>
<p>敬请期待</p>
</hgroup>
</div>
</div>
</div></li>
<li><a class="menu_a"><span>关于俱乐部</span></a>
<div class="sec_menu shadow">
<div class="col-lg-3 col-md-3 col-sm-4">
<div class="overflow-hid" style="margin: 0 auto">
<hgroup class="mt20 text-align-l">
<p style="text-align: center">
<img src="/content/images/jlb_07.jpg">
</p>
<p class="clear"></p>
<p class="overflow-hid" style="text-align: center">自豪的尊贵的祥云俱乐部!</p>
</hgroup>
</div>
</div>
<div class="col-lg-9 col-md-9 col-sm-8">
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="instruction!show.action?instype=JLBJS">俱乐部介绍</a>
</h4>
<p>关于奥凯俱乐部介绍</p>
</hgroup>
</div>
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="instruction!show.action?instype=HYSC">会员手册</a>
</h4>
<p>俱乐部会员手册须知</p>
</hgroup>
</div>
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="instruction!show.action?instype=HYKJS">会员卡介绍</a>
</h4>
<p>奥凯会员卡介绍</p>
</hgroup>
</div>
<div class="col-lg-6 col-md-6 col-sm-6">
<hgroup class="sec_menu_line">
<h4>
<a href="instruction!show.action?instype=HYQY">高端会员权益</a>
</h4>
<p>高级会员权益介绍</p>
</hgroup>
</div>
</div>
</div></li>
</div>
</div>
<!--以上是导航-->
<div class="container mt25" style="background: #fff; height: 400px">
<h3 style="color: #39c2ff;" class="left">找回密码</h3>
<div class="shopping-trolley">
<a href="javascript:void(0);">提交申请</a> -<a href="javascript:void(0);">验证身份</a>
-<a href="javascript:void(0);" class="pitch-on">设置新密码</a> -<a
href="javascript:void(0);">找回成功</a>
</div>
<div class="col-md-12 col-lg-12 col-sm-12 mb25"
style="border-top: solid 2px #0076a0"></div>

<form action="resetpwd!resetThird.action" id="passwordform"
method="post">
<div class="col-md-12 col-lg-12 col-sm-12" style="background: #fff;">
<input name="ID" value="140720" type="hidden">
<input name="verifymode" value="sms"
type="hidden"> <input name="verifytype"
value="MMCZYZ" type="hidden">
<div class="col-md-2 col-lg-2 col-sm-2 text-center li-line2">
新密码:</div>
<div class="col-md-1 col-lg-1 col-sm-1 text-center li-line2">
<input type="password" style="height: 25px; line-height: 25px; padding-left: 2%;" name="newb2cpassword" id="newb2cpassword" />
</div>
</div>
<div class="col-md-12 col-lg-12 col-sm-12" style="background: #fff;">
<div class="col-md-2 col-lg-2 col-sm-2 text-center li-line2">
确认密码:</div>
<div class="col-md-1 col-lg-1 col-sm-1 text-center li-line2">
<input type="password" style="height: 25px; line-height: 25px; padding-left: 2%;" name="repassword" id="repassword" />
</div>
</div>
</form>


<div class="col-md-12 col-lg-12 col-sm-12 text-align-r li-line2 mb30">

<a href="javascript:void(0);" id="btnCommit"
style="background: #ff7f1e; padding: 10px 30px; color: #fff;">确认</a>

</div>
</div>
</div>
<!--表格结束-->
</div>
</div>
<div class="footer mt25">
<div class="container">
<div class="col-md-12 col-lg-12 col-sm-12">
<span class="left">©2005 奥凯航空有限公司版权所有 保留所有权利 京ICP备05046014号</span> <label><img
src="/content/images/footer_42.jpg"></label>
</div>
</div>
</div>
</body>
<script type="text/javascript">
$(document).ready(function() {
InitCommit(); //初始化登录功能
});
//初始化登录功能
function InitCommit() {
$("#btnCommit").click(function() {
var varOption = {};
var arrData = {};

if($.trim($("#newb2cpassword").val())!=$.trim($("#repassword").val())){
alert("两次密码不一置!");
return;
}
arrData.newb2cpassword = $.trim($("#newb2cpassword").val());
if (!arrData.newb2cpassword || arrData.newb2cpassword.length == 0) {
alert("新密码不能为空!");
return;
}
$("#passwordform").submit();
});
}
</script>
</html>


漏洞证明:

http://ffp.okair.net/ffplogin.action
奥凯祥云登陆界面,测试账号为@牛 小 帅之前提供的证件号码123456

奥凯祥云1.png


点击下一步,后台自动给手机发了一条验证码并跳转至下面页面

奥凯祥云2.png


输入任意验证码000000点击下一步抓包,注意数据包里的ID值119066,记录下来

奥凯祥云02.png


上面的包提交后返回了一个页面如下,是跳转到报错页面的,这里直接把之前获取的转到输入新密码页面的数据包整个替换上去,也就是详细说明中那一大段代码

奥凯祥云3.png


奥凯祥云4.png


然后搜索140720,把他改成牛哥的id 119066提交

奥凯祥云03.png


跳转至输入新密码页面输入新密码TEST000000

奥凯祥云5.png


提示更改成功

奥凯祥云6.png


尝试登陆成功

奥凯祥云7.png


奥凯祥云8.png

修复方案:

版权声明:转载请注明来源 黑骑士@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:10

确认时间:2016-03-23 18:29

厂商回复:

非常感谢您帮助我们改进,确实存在此漏洞,目前正在修复中。

最新状态:

2016-04-27:漏洞已修复,非常感谢对我公司的支持。


漏洞评价:

评价

  1. 2016-03-21 15:41 | 牛 小 帅 ( 普通白帽子 | Rank:1466 漏洞数:351 | 1.乌云最帅的男人 ...)

    关注一下啥姿势

  2. 2016-03-22 09:33 | 黑骑士 ( 实习白帽子 | Rank:83 漏洞数:13 | 黑色的骑士守护者光明)

    @牛 小 帅 借用下牛哥的测试账号哈