当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0104880

漏洞标题:某通用漏洞致一大批政务站点躺各种命令执行可getshell

相关厂商:政务站点

漏洞作者: 姗姗来迟

提交时间:2015-03-31 09:28

修复时间:2015-07-02 15:42

公开时间:2015-07-02 15:42

漏洞类型:命令执行

危害等级:高

自评Rank:18

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-03-31: 细节已通知厂商并且等待厂商处理中
2015-04-03: 厂商已经确认,细节仅向厂商公开
2015-04-06: 细节向第三方安全合作伙伴开放
2015-05-28: 细节向核心白帽子及相关领域专家公开
2015-06-07: 细节向普通白帽子公开
2015-06-17: 细节向实习白帽子公开
2015-07-02: 细节向公众公开

简要描述:

安全不可姗姗来迟!

详细说明:

#一大批政务站点存在S-016命令执行可getshell!
URl中均存在:website-rank
通用字眼,路径中均存在:UCMSServer
各种组合,各种google!
案例1说明
测试入口:http://117.78.19.27:9888/website-rank/getVoteRecordByManuscriptId.action

dir:/opt/Minge/UCMSServer/tomcat/webapps/website-rank/


root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin
avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rtkit:x:499:497:RealtimeKit:/proc:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
saslauth:x:498:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
pulse:x:497:495:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
oracle:x:500:500::/home/oracle:/bin/bash
wuzhengfeng:x:501:502::/home/wuzhengfeng:/bin/bash
zabbix:x:502:503::/home/zabbix:/bin/bash
mysql:x:496:504::/home/mysql:/bin/bash
clamav:x:495:492:Clam Anti Virus Checker:/var/clamav:/sbin/nologin
db2inst1:x:1004:999::/home/db2inst1:/bin/bash
db2fenc1:x:1003:998::/home/db2fenc1:/bin/bash
dasusr1:x:1002:997::/home/dasusr1:/bin/bash


wuzhengf pts/1        221.219.230.175  Mon Mar 30 21:11   still logged in   
wuzhengf pts/1 122.70.113.17 Mon Mar 30 14:42 - 15:08 (00:25)
wuzhengf pts/1 122.70.113.19 Thu Mar 26 16:53 - 16:55 (00:02)
wuzhengf pts/1 111.199.50.185 Wed Mar 25 22:05 - 23:24 (01:19)
wuzhengf pts/2 118.194.192.100 Tue Mar 24 10:15 - 10:23 (00:07)
wuzhengf pts/1 118.194.192.100 Tue Mar 24 09:59 - 10:23 (00:23)
wuzhengf pts/1 118.194.192.100 Mon Mar 23 15:17 - 15:43 (00:26)
wuzhengf pts/1 118.194.192.100 Mon Mar 23 10:33 - 14:41 (04:08)
wuzhengf pts/4 118.194.192.100 Sat Mar 21 13:25 - 13:43 (00:18)
wuzhengf pts/3 118.194.192.100 Sat Mar 21 13:23 - 15:41 (02:17)
wuzhengf pts/2 118.194.192.100 Sat Mar 21 09:48 - 15:04 (05:16)
wuzhengf pts/1 118.194.192.100 Sat Mar 21 09:44 - 15:04 (05:20)
wuzhengf pts/1 106.37.213.195 Fri Mar 20 11:27 - 20:10 (08:43)
wuzhengf pts/2 122.70.113.17 Thu Mar 19 16:49 - 16:53 (00:03)
wuzhengf pts/2 118.194.192.100 Thu Mar 19 16:45 - 16:45 (00:00)
wuzhengf pts/1 118.194.192.100 Thu Mar 19 16:07 - 18:26 (02:18)
wuzhengf pts/1 118.194.192.100 Thu Mar 19 14:34 - 15:36 (01:02)
wuzhengf pts/1 111.193.1.255 Wed Mar 18 22:39 - 23:03 (00:24)
wuzhengf pts/2 122.70.113.18 Tue Mar 17 15:25 - 17:40 (02:14)
wuzhengf pts/1 122.70.113.18 Tue Mar 17 15:23 - 17:40 (02:17)
wuzhengf pts/1 118.194.192.100 Tue Mar 17 14:37 - 14:44 (00:06)
wuzhengf pts/1 118.194.192.100 Mon Mar 16 16:38 - 17:56 (01:18)
wuzhengf pts/1 118.194.192.100 Mon Mar 16 10:42 - 14:00 (03:17)
wuzhengf pts/1 118.194.192.100 Fri Mar 13 16:54 - 18:08 (01:14)
wuzhengf pts/1 118.194.192.100 Mon Mar 9 16:24 - 18:51 (02:26)
wuzhengf pts/1 118.194.192.100 Mon Mar 9 16:23 - 16:24 (00:00)
wuzhengf pts/2 118.194.192.100 Tue Mar 3 10:41 - 16:27 (05:46)
wuzhengf pts/4 118.194.192.100 Tue Mar 3 10:01 - 10:01 (00:00)
wuzhengf pts/3 118.194.192.100 Tue Mar 3 10:01 - 10:01 (00:00)
wuzhengf pts/2 118.194.192.100 Tue Mar 3 10:01 - 10:01 (00:00)
wuzhengf pts/1 118.194.192.100 Tue Mar 3 09:28 - 12:25 (02:56)
wuzhengf pts/2 118.194.192.100 Mon Mar 2 15:47 - 18:12 (02:24)
wuzhengf pts/1 118.194.192.100 Mon Mar 2 10:24 - 18:39 (08:15)
wuzhengf pts/1 118.194.192.100 Fri Feb 27 11:05 - 18:39 (07:34)
wuzhengf pts/1 118.194.192.100 Thu Feb 26 09:23 - 09:34 (00:10)
wuzhengf pts/1 118.194.192.100 Wed Feb 25 16:29 - 16:38 (00:08)
wuzhengf pts/2 118.194.192.100 Fri Feb 13 11:48 - 14:43 (02:55)
wuzhengf pts/1 118.194.192.100 Fri Feb 13 11:08 - 13:21 (02:13)
wuzhengf pts/1 61.49.18.11 Wed Feb 11 21:51 - 22:40 (00:49)
wuzhengf pts/1 111.193.2.215 Tue Feb 10 22:20 - 22:25 (00:04)
wuzhengf pts/1 61.49.18.12 Tue Feb 10 19:00 - 19:44 (00:43)
wuzhengf pts/2 111.203.34.12 Tue Feb 10 17:55 - 18:33 (00:38)
wuzhengf pts/1 111.203.34.12 Tue Feb 10 17:53 - 18:33 (00:40)
wuzhengf pts/1 111.203.34.12 Tue Feb 10 10:59 - 16:45 (05:46)
wuzhengf pts/1 118.194.192.100 Tue Feb 10 09:46 - 09:47 (00:00)
wuzhengf pts/1 118.194.192.100 Mon Feb 9 20:40 - 20:44 (00:04)
wuzhengf pts/3 118.194.192.100 Mon Feb 9 15:59 - 18:16 (02:16)
wuzhengf pts/3 118.194.192.100 Mon Feb 9 15:47 - 15:51 (00:04)
wuzhengf pts/2 118.194.192.100 Mon Feb 9 15:11 - 16:59 (01:47)
wuzhengf pts/2 118.194.192.100 Mon Feb 9 15:01 - 15:01 (00:00)
wuzhengf pts/2 118.194.192.100 Mon Feb 9 15:01 - 15:01 (00:00)
wuzhengf pts/2 118.194.192.100 Mon Feb 9 15:01 - 15:01 (00:00)
wuzhengf pts/1 118.194.192.100 Mon Feb 9 15:00 - 17:52 (02:51)

漏洞证明:

案例图组:

a.png


b.png


c.png


给予此通用漏洞部分站点:

http://117.78.19.27:9888/website-rank/getVoteRecordByManuscriptId.action
http://168.160.193.139:8888/website-rank/addVoteRecord.action
http://219.141.213.23/website-rank/addVoteRecord.action
http://42.123.76.155:8080/website-rank/addVoteRecord.action
http://www.hhhtbtjc.com/website-rank/addVoteRecord.action
http://bauhinia.forestry.gov.cn/website-rank/addVoteRecord.action
http://42.123.76.89/website-rank/addVoteRecord.action
http://219.141.213.23/website-rank/addVoteRecord.action
http://www.12320.gov.cn/website-rank/addVoteRecord.action
http://www.minge.gov.cn/website-rank/addVoteRecord.action

修复方案:

#含有此WEB程序的政务站点很多,各种命令执行!可以getshell,甚至提升权限!危害多大,你懂我懂大家懂,希望正确面对网络安全问题,尽快修复。作为白帽子这是我应该做的!精华$$有木有!

版权声明:转载请注明来源 姗姗来迟@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:20

确认时间:2015-04-03 15:40

厂商回复:

CNVD确认并复现所述情况,根据测试用例,已经转由CNCERT下发给对应多个分中心,由其后续协调网站管理单位处置。

最新状态:

暂无