当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-087565

漏洞标题：扫扫看应用官网Mongodb未授权访问

相关厂商：扫扫看

漏洞作者： 苏泽

提交时间：2014-12-18 10:08

修复时间：2015-03-18 10:10

公开时间：2015-03-18 10:10

漏洞类型：非授权访问/认证绕过

危害等级：中

自评Rank：8

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-12-18： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-03-18： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

详细说明：

61.155.238.71

2.jpg

1.jpg


* 0 */
{
  "_id" : "jinglun.domain.003-1404112062383",
  "hostname" : "jinglun.domain.003",
  "startTime" : ISODate("2014-06-30T07:07:42Z"),
  "startTimeLocal" : "Mon Jun 30 15:07:42.383",
  "cmdLine" : {
    "net" : {
      "port" : 27017
    },
    "processManagement" : {
      "fork" : true
    },
    "replication" : {
      "oplogSizeMB" : 100,
      "replSet" : "shard1"
    },
    "sharding" : {
      "clusterRole" : "shardsvr"
    },
    "storage" : {
      "dbPath" : "/usr/local/data/mongoDB/data"
    },
    "systemLog" : {
      "destination" : "file",
      "logAppend" : true,
      "path" : "/usr/local/data/mongoDB/log/log1.log"
    }
  },
  "pid" : NumberLong(5030),
  "buildinfo" : {
    "version" : "2.6.3",
    "gitVersion" : "255f67a66f9603c59380b2a389e386910bbb52cb",
    "OpenSSLVersion" : "",
    "sysInfo" : "Linux build12.nj1.10gen.cc 2.6.32-431.3.1.el6.x86_64 #1 SMP Fri Jan 3 21:39:27 UTC 2014 x86_64 BOOST_LIB_VERSION=1_49",
    "loaderFlags" : "-fPIC -pthread -Wl,-z,now -rdynamic",
    "compilerFlags" : "-Wnon-virtual-dtor -Woverloaded-virtual -fPIC -fno-strict-aliasing -ggdb -pthread -Wall -Wsign-compare -Wno-unknown-pragmas -Winvalid-pch -pipe -Werror -O3 -Wno-unused-function -Wno-deprecated-declarations -fno-builtin-memcmp",
    "allocator" : "tcmalloc",
    "versionArray" : [2, 6, 3, 0],
    "javascriptEngine" : "V8",
    "bits" : 64,
    "debug" : false,
    "maxBsonObjectSize" : 16777216
  }
}
/* 1 */
{
  "_id" : "jinglun.domain.003-1404112280207",
  "hostname" : "jinglun.domain.003",
  "startTime" : ISODate("2014-06-30T07:11:20Z"),
  "startTimeLocal" : "Mon Jun 30 15:11:20.207",
  "cmdLine" : {
    "net" : {
      "port" : 27017
    },
    "processManagement" : {
      "fork" : true
    },
    "replication" : {
      "oplogSizeMB" : 100,
      "replSet" : "shard1"
    },
    "sharding" : {
      "clusterRole" : "shardsvr"
    },
    "storage" : {
      "dbPath" : "/usr/local/data/mongoDB/data"
    },
    "systemLog" : {
      "destination" : "file",
      "logAppend" : true,
      "path" : "/usr/local/data/mongoDB/log/log1.log"
    }
  },
  "pid" : NumberLong(5116),
  "buildinfo" : {
    "version" : "2.6.3",
    "gitVersion" : "255f67a66f9603c59380b2a389e386910bbb52cb",
    "OpenSSLVersion" : "",
    "sysInfo" : "Linux build12.nj1.10gen.cc 2.6.32-431.3.1.el6.x86_64 #1 SMP Fri Jan 3 21:39:27 UTC 2014 x86_64 BOOST_LIB_VERSION=1_49",
    "loaderFlags" : "-fPIC -pthread -Wl,-z,now -rdynamic",
    "compilerFlags" : "-Wnon-virtual-dtor -Woverloaded-virtual -fPIC -fno-strict-aliasing -ggdb -pthread -Wall -Wsign-compare -Wno-unknown-pragmas -Winvalid-pch -pipe -Werror -O3 -Wno-unused-function -Wno-deprecated-declarations -fno-builtin-memcmp",
    "allocator" : "tcmalloc",
    "versionArray" : [2, 6, 3, 0],
    "javascriptEngine" : "V8",
    "bits" : 64,
    "debug" : false,
    "maxBsonObjectSize" : 16777216
  }

漏洞证明：

2.jpg

1.jpg


* 0 */
{
  "_id" : "jinglun.domain.003-1404112062383",
  "hostname" : "jinglun.domain.003",
  "startTime" : ISODate("2014-06-30T07:07:42Z"),
  "startTimeLocal" : "Mon Jun 30 15:07:42.383",
  "cmdLine" : {
    "net" : {
      "port" : 27017
    },
    "processManagement" : {
      "fork" : true
    },
    "replication" : {
      "oplogSizeMB" : 100,
      "replSet" : "shard1"
    },
    "sharding" : {
      "clusterRole" : "shardsvr"
    },
    "storage" : {
      "dbPath" : "/usr/local/data/mongoDB/data"
    },
    "systemLog" : {
      "destination" : "file",
      "logAppend" : true,
      "path" : "/usr/local/data/mongoDB/log/log1.log"
    }
  },
  "pid" : NumberLong(5030),
  "buildinfo" : {
    "version" : "2.6.3",
    "gitVersion" : "255f67a66f9603c59380b2a389e386910bbb52cb",
    "OpenSSLVersion" : "",
    "sysInfo" : "Linux build12.nj1.10gen.cc 2.6.32-431.3.1.el6.x86_64 #1 SMP Fri Jan 3 21:39:27 UTC 2014 x86_64 BOOST_LIB_VERSION=1_49",
    "loaderFlags" : "-fPIC -pthread -Wl,-z,now -rdynamic",
    "compilerFlags" : "-Wnon-virtual-dtor -Woverloaded-virtual -fPIC -fno-strict-aliasing -ggdb -pthread -Wall -Wsign-compare -Wno-unknown-pragmas -Winvalid-pch -pipe -Werror -O3 -Wno-unused-function -Wno-deprecated-declarations -fno-builtin-memcmp",
    "allocator" : "tcmalloc",
    "versionArray" : [2, 6, 3, 0],
    "javascriptEngine" : "V8",
    "bits" : 64,
    "debug" : false,
    "maxBsonObjectSize" : 16777216
  }
}
/* 1 */
{
  "_id" : "jinglun.domain.003-1404112280207",
  "hostname" : "jinglun.domain.003",
  "startTime" : ISODate("2014-06-30T07:11:20Z"),
  "startTimeLocal" : "Mon Jun 30 15:11:20.207",
  "cmdLine" : {
    "net" : {
      "port" : 27017
    },
    "processManagement" : {
      "fork" : true
    },
    "replication" : {
      "oplogSizeMB" : 100,
      "replSet" : "shard1"
    },
    "sharding" : {
      "clusterRole" : "shardsvr"
    },
    "storage" : {
      "dbPath" : "/usr/local/data/mongoDB/data"
    },
    "systemLog" : {
      "destination" : "file",
      "logAppend" : true,
      "path" : "/usr/local/data/mongoDB/log/log1.log"
    }
  },
  "pid" : NumberLong(5116),
  "buildinfo" : {
    "version" : "2.6.3",
    "gitVersion" : "255f67a66f9603c59380b2a389e386910bbb52cb",
    "OpenSSLVersion" : "",
    "sysInfo" : "Linux build12.nj1.10gen.cc 2.6.32-431.3.1.el6.x86_64 #1 SMP Fri Jan 3 21:39:27 UTC 2014 x86_64 BOOST_LIB_VERSION=1_49",
    "loaderFlags" : "-fPIC -pthread -Wl,-z,now -rdynamic",
    "compilerFlags" : "-Wnon-virtual-dtor -Woverloaded-virtual -fPIC -fno-strict-aliasing -ggdb -pthread -Wall -Wsign-compare -Wno-unknown-pragmas -Winvalid-pch -pipe -Werror -O3 -Wno-unused-function -Wno-deprecated-declarations -fno-builtin-memcmp",
    "allocator" : "tcmalloc",
    "versionArray" : [2, 6, 3, 0],
    "javascriptEngine" : "V8",
    "bits" : 64,
    "debug" : false,
    "maxBsonObjectSize" : 16777216
  }

修复方案：

2.jpg

1.jpg


* 0 */
{
  "_id" : "jinglun.domain.003-1404112062383",
  "hostname" : "jinglun.domain.003",
  "startTime" : ISODate("2014-06-30T07:07:42Z"),
  "startTimeLocal" : "Mon Jun 30 15:07:42.383",
  "cmdLine" : {
    "net" : {
      "port" : 27017
    },
    "processManagement" : {
      "fork" : true
    },
    "replication" : {
      "oplogSizeMB" : 100,
      "replSet" : "shard1"
    },
    "sharding" : {
      "clusterRole" : "shardsvr"
    },
    "storage" : {
      "dbPath" : "/usr/local/data/mongoDB/data"
    },
    "systemLog" : {
      "destination" : "file",
      "logAppend" : true,
      "path" : "/usr/local/data/mongoDB/log/log1.log"
    }
  },
  "pid" : NumberLong(5030),
  "buildinfo" : {
    "version" : "2.6.3",
    "gitVersion" : "255f67a66f9603c59380b2a389e386910bbb52cb",
    "OpenSSLVersion" : "",
    "sysInfo" : "Linux build12.nj1.10gen.cc 2.6.32-431.3.1.el6.x86_64 #1 SMP Fri Jan 3 21:39:27 UTC 2014 x86_64 BOOST_LIB_VERSION=1_49",
    "loaderFlags" : "-fPIC -pthread -Wl,-z,now -rdynamic",
    "compilerFlags" : "-Wnon-virtual-dtor -Woverloaded-virtual -fPIC -fno-strict-aliasing -ggdb -pthread -Wall -Wsign-compare -Wno-unknown-pragmas -Winvalid-pch -pipe -Werror -O3 -Wno-unused-function -Wno-deprecated-declarations -fno-builtin-memcmp",
    "allocator" : "tcmalloc",
    "versionArray" : [2, 6, 3, 0],
    "javascriptEngine" : "V8",
    "bits" : 64,
    "debug" : false,
    "maxBsonObjectSize" : 16777216
  }
}
/* 1 */
{
  "_id" : "jinglun.domain.003-1404112280207",
  "hostname" : "jinglun.domain.003",
  "startTime" : ISODate("2014-06-30T07:11:20Z"),
  "startTimeLocal" : "Mon Jun 30 15:11:20.207",
  "cmdLine" : {
    "net" : {
      "port" : 27017
    },
    "processManagement" : {
      "fork" : true
    },
    "replication" : {
      "oplogSizeMB" : 100,
      "replSet" : "shard1"
    },
    "sharding" : {
      "clusterRole" : "shardsvr"
    },
    "storage" : {
      "dbPath" : "/usr/local/data/mongoDB/data"
    },
    "systemLog" : {
      "destination" : "file",
      "logAppend" : true,
      "path" : "/usr/local/data/mongoDB/log/log1.log"
    }
  },
  "pid" : NumberLong(5116),
  "buildinfo" : {
    "version" : "2.6.3",
    "gitVersion" : "255f67a66f9603c59380b2a389e386910bbb52cb",
    "OpenSSLVersion" : "",
    "sysInfo" : "Linux build12.nj1.10gen.cc 2.6.32-431.3.1.el6.x86_64 #1 SMP Fri Jan 3 21:39:27 UTC 2014 x86_64 BOOST_LIB_VERSION=1_49",
    "loaderFlags" : "-fPIC -pthread -Wl,-z,now -rdynamic",
    "compilerFlags" : "-Wnon-virtual-dtor -Woverloaded-virtual -fPIC -fno-strict-aliasing -ggdb -pthread -Wall -Wsign-compare -Wno-unknown-pragmas -Winvalid-pch -pipe -Werror -O3 -Wno-unused-function -Wno-deprecated-declarations -fno-builtin-memcmp",
    "allocator" : "tcmalloc",
    "versionArray" : [2, 6, 3, 0],
    "javascriptEngine" : "V8",
    "bits" : 64,
    "debug" : false,
    "maxBsonObjectSize" : 16777216
  }

版权声明：转载请注明来源 苏泽@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝