乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-12-31: 细节已通知厂商并且等待厂商处理中 2015-12-31: 厂商已经确认,细节仅向厂商公开 2016-01-10: 细节向核心白帽子及相关领域专家公开 2016-01-20: 细节向普通白帽子公开 2016-01-30: 细节向实习白帽子公开 2016-02-12: 细节向公众公开
优酷某RDM系统配置不当敏感信息泄露
http://rdm.mobile.youku.com/signin/
附送其它设计缺陷
这个站点没有验证码机制,我爆破了半天没发现有一个账号能用,弱口令应该是没有了试了两枚账号证明确实存在账号
还跑出了一大把不是管理员的账号,既然不是管理员那是什么呢,给你一个想象的空间!
扫到一个目录,默认账号已经密码随便填,就会进入到一个报错页面,里面包含很多内容
http://rdm.mobile.youku.com/admin/
醉了,报错为何会看到这些东西,
USE_L10N TrueUSE_THOUSAND_SEPARATOR FalseCSRF_COOKIE_SECURE FalseLANGUAGE_CODE 'zh_cn'ROOT_URLCONF 'app.urls'MANAGERS ()DEFAULT_CHARSET 'utf-8'SESSION_SERIALIZER 'django.contrib.sessions.serializers.JSONSerializer'STATIC_ROOT ''PROXY_MEMCACHE FalseALLOWED_HOSTS ['.youku.com', 'localhost']MESSAGE_STORAGE 'django.contrib.messages.storage.fallback.FallbackStorage'EMAIL_SUBJECT_PREFIX '[Django] 'SEND_BROKEN_LINK_EMAILS FalseSTATICFILES_FINDERS ['django.contrib.staticfiles.finders.FileSystemFinder', 'django.contrib.staticfiles.finders.AppDirectoriesFinder']SESSION_CACHE_ALIAS 'default'CHINA_CACHE_PASS u'********************'SESSION_COOKIE_NAME 'sessionid'ADMIN_FOR ()TIME_INPUT_FORMATS ('%H:%M:%S', '%H:%M:%S.%f', '%H:%M')DATABASES {'default': {'ATOMIC_REQUESTS': False, 'AUTOCOMMIT': True, 'CONN_MAX_AGE': 0, 'ENGINE': 'django.db.backends.mysql', 'HOST': '10.100.**.**', 'NAME': 'rdm_platform', 'OPTIONS': {'init_command': 'SET storage_engine=INNODB, SESSION wait_timeout=31536000, SESSION TRANSACTION ISOLATION LEVEL READ COMMITTED, autocommit=1, names "utf8";'}, 'PASSWORD': u'********************', 'PORT': '', 'TEST_CHARSET': None, 'TEST_COLLATION': None, 'TEST_MIRROR': None, 'TEST_NAME': None, 'TIME_ZONE': 'Asia/Shanghai', 'USER': 'rdm-***'}}
HTTPS_UPLOAD_PREFIX 'https://rdm.mobile.youku.com'APPEND_SLASH TrueFIRST_DAY_OF_WEEK 0DATABASE_ROUTERS []YEAR_MONTH_FORMAT 'F Y'STATICFILES_STORAGE 'django.contrib.staticfiles.storage.StaticFilesStorage'CACHES {'default': {'BACKEND': 'django.core.cache.backends.memcached.PyLibMCCache', 'LOCATION': ['10.100.***.***:11211'], 'OPTIONS': {}, 'TIMEOUT': 0}}SERVER_EMAIL 'root@localhost'SESSION_COOKIE_PATH '/'MODULES ('m-rdm.base', 'm-rdm.app')DOWNLOAD_URL 'http://dl.m.youku.com/g/'MIDDLEWARE_CLASSES ['django.middleware.common.CommonMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.transaction.TransactionMiddleware', 'app.middleware.profile_middleware.ProfileMiddleware']USE_I18N True
其它的你们慢慢排查吧
你们更专业
危害等级:中
漏洞Rank:8
确认时间:2015-12-31 10:25
多谢提醒!已去掉外网访问权限!
暂无