当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-086861

漏洞标题：土豆网线下某网站核心配置文件可读取

相关厂商：土豆网

漏洞作者： 路人甲

提交时间：2014-12-11 23:44

修复时间：2015-01-25 23:46

公开时间：2015-01-25 23:46

漏洞类型：敏感信息泄露

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-12-11： 细节已通知厂商并且等待厂商处理中
2014-12-12： 厂商已经确认，细节仅向厂商公开
2014-12-22： 细节向核心白帽子及相关领域专家公开
2015-01-01： 细节向普通白帽子公开
2015-01-11： 细节向实习白帽子公开
2015-01-25： 细节向公众公开

简要描述：

土豆网线下某网站核心配置文件可读取，看上去用的是ST2框架

详细说明：

带有各种后台、上传接口，未深入挖掘
http://114.80.122.41/WEB-INF/web.xml
http://114.80.122.41/WEB-INF/classes/applicationContext.xml
http://114.80.122.41/WEB-INF/struts_config/struts-config-manager.xml

<bean class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
<property name="locations">
<list>
<value>classpath:*.properties</value>
</list>
</property>
</bean>
<!--  数据源,使用了c3p0数据库连接池  -->
<bean id="dataSource" class="com.mchange.v2.c3p0.ComboPooledDataSource">
<property name="user" value="${jdbc.userName}"/>
<property name="password" value="${jdbc.password}"/>
<property name="driverClass" value="${jdbc.driverClassName}"/>
<property name="jdbcUrl" value="${jdbc.url}"/>
</bean>
<!--  hibernate的session工厂  -->
<bean id="sessionFactory" class="org.springframework.orm.hibernate3.LocalSessionFactoryBean">
<property name="dataSource" ref="dataSource"/>
<property name="hibernateProperties">
<props>
<prop key="hibernate.connection.pool_size">${jdbc.c3p0.pool_size}</prop>
<prop key="hibernate.c3p0.max_size">${jdbc.c3p0.max_size}</prop>
<prop key="hibernate.c3p0.min_size">${jdbc.c3p0.min_size}</prop>
<prop key="hibernate.c3p0.max_statements">${jdbc.c3p0.max_statements}</prop>
<prop key="hibernate.c3p0.idle_test_period">${jdbc.c3p0.idle_test_period}</prop>
<prop key="hibernate.c3p0.timeout">${jdbc.c3p0.timeout}</prop>
<prop key="dialect">${jdbc.hibernate.dialect}</prop>
<prop key="hibernate.show_sql">false</prop>
<prop key="hibernate.format_sql">true</prop>
<prop key="hibernate.hbm2ddl.auto">update</prop>

漏洞证明：

This XML file does not appear to have any style information associated with it. The document tree is shown below.
<struts-config>
<form-beans>
<form-bean name="userManagerActionForm" type="com.iwt.bauhinia.web.struts.actionform.UserManagerActionForm"></form-bean>
<form-bean name="roleManagerActionForm" type="com.iwt.bauhinia.web.struts.actionform.RoleManagerActionForm"></form-bean>
<form-bean name="userCommonActionForm" type="com.iwt.bauhinia.web.struts.actionform.UserCommonActionForm"></form-bean>
<form-bean name="applyCompetePeopleActionForm" type="com.iwt.bauhinia.web.struts.actionform.ApplyCompetePeopleActionForm"></form-bean>
<form-bean name="videoManagerActionForm" type="com.iwt.bauhinia.web.struts.actionform.VideoManagerActionForm"></form-bean>
<form-bean name="pictureManagerActionForm" type="com.iwt.bauhinia.web.struts.actionform.PictureManagerActionForm"></form-bean>
<form-bean name="selectionUserActionForm" type="com.iwt.bauhinia.web.struts.actionform.SelectionUserActionForm"></form-bean>
<form-bean name="styListForm" type="com.iwt.bauhinia.web.struts.actionform.StyListForm"></form-bean>
</form-beans>
<action-mappings>
<action path="/admin/userManagerAction" name="userManagerActionForm" scope="request" parameter="method" type="org.springframework.web.struts.DelegatingActionProxy">
<forward name="indexView" path="/jsp/admin/user_manager/index.jsp"/>
<forward name="userInfo" path="/jsp/admin/user_manager/user_info.jsp"></forward>
<forward name="list" path="/jsp/admin/user_manager/user_list.jsp"></forward>
<forward name="houseList" path="/jsp/admin/user_manager/house_user_list.jsp"></forward>
<forward name="designList" path="/jsp/admin/user_manager/design_user_list.jsp"></forward>
<forward name="blogList" path="/jsp/admin/user_manager/blog_list.jsp"/>
</action>
<action path="/admin/roleManagerAction" name="roleManagerActionForm" scope="request" parameter="method" type="org.springframework.web.struts.DelegatingActionProxy">
<forward name="indexView" path="/jsp/admin/role_manager/index.jsp"/>
<forward name="list" path="/jsp/admin/role_manager/role_list.jsp"></forward>
</action>
<action path="/admin/videoManagerAction" name="videoManagerActionForm" scope="request" parameter="method" type="org.springframework.web.struts.DelegatingActionProxy">
<forward name="indexView" path="/jsp/admin/video_manager/index.jsp"/>
<forward name="noAuditingList" path="/jsp/admin/video_manager/video_no_auditing_list.jsp"></forward>
<forward name="yesAuditingList" path="/jsp/admin/video_manager/video_yes_auditing_list.jsp"></forward>
<forward name="auditIsNotPassedList" path="/jsp/admin/video_manager/video_audit_is_not_passed_list.jsp"></forward>
<forward name="updateVideo" path="/jsp/admin/video_manager/update_video.jsp"></forward>
</action>
<action path="/admin/pictureManagerAction" name="pictureManagerActionForm" scope="request" parameter="method" type="org.springframework.web.struts.DelegatingActionProxy">
<forward name="indexView" path="/jsp/admin/picture_manager/index.jsp"/>
<forward name="yesAuditingList" path="/jsp/admin/picture_manager/picture_yes_auditing_list.jsp"></forward>
<forward name="updatePicture" path="/jsp/admin/picture_manager/update_picture.jsp"></forward>
</action>
<action path="/member/userCommonAction" scope="request" name="userCommonActionForm" parameter="method" type="org.springframework.web.struts.DelegatingActionProxy">
<forward name="setInfoView" path="/jsp/member/my/setting/info.jsp"/>
<forward name="myVideo" path="/jsp/member/my/setting/uploadVideoManager.jsp"></forward>
<forward name="myPicture" path="/jsp/member/my/setting/uploadPictureManager.jsp"></forward>
</action>
<action path="/member/applyCompetePeopleAction" scope="session" name="applyCompetePeopleActionForm" parameter="method" type="org.springframework.web.struts.DelegatingActionProxy">
<forward name="houseIndexView" path="/jsp/member/my/setting/compete_people_house.jsp"/>
<forward name="designerIndexView" path="/jsp/member/my/setting/compete_people_designer.jsp"/>
<forward name="designer1" path="/jsp/member/my/setting/design_user_bereg_2.jsp"></forward>
</action>
<action path="/admin/selectionUserAction" name="selectionUserActionForm" scope="request" parameter="method" type="org.springframework.web.struts.DelegatingActionProxy">
<forward name="finalistDesign120" path="/jsp/admin/user_manager/design_user_120_list.jsp"></forward>
<forward name="finalistDesign18" path="/jsp/admin/user_manager/design_user_18_list.jsp"></forward>
<forward name="finalistDesign6" path="/jsp/admin/user_manager/design_user_6_list.jsp"></forward>
</action>
<action path="/admin/styUpFileManagerAction" name="styListForm" scope="request" parameter="method" type="org.springframework.web.struts.DelegatingActionProxy">
<forward name="indexView" path="/jsp/admin/styupfile_manager/index.jsp"/>
<forward name="findUserStyFile" path="/jsp/admin/styupfile_manager/styList.jsp"/>
<forward name="findStyUpFile" path="/jsp/admin/styupfile_manager/styUpFile.jsp"/>
</action>
</action-mappings>
</struts-config>

修复方案：

限制访问

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2014-12-12 17:22

厂商回复：

外包项目，多谢，已处理

最新状态：

暂无