当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0108935

漏洞标题：某省气象台官网命令执行getshell#root权限

相关厂商：气象台

漏洞作者： 路人甲

提交时间：2015-04-23 17:59

修复时间：2015-06-11 11:20

公开时间：2015-06-11 11:20

漏洞类型：命令执行

危害等级：高

自评Rank：18

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-04-23： 细节已通知厂商并且等待厂商处理中
2015-04-27： 厂商已经确认，细节仅向厂商公开
2015-05-07： 细节向核心白帽子及相关领域专家公开
2015-05-17： 细节向普通白帽子公开
2015-05-27： 细节向实习白帽子公开
2015-06-11： 细节向公众公开

简要描述：

某省气象台站点命令执行getshell#root权限

详细说明：

广东省气象台：http://www.gdmo.cn/weather-gdmo/weathervideo/weather-video!init.action
描述：站点存在Struts2命令执行可直接getshell/root权限！

1.png


漏洞证明：

#mysql version database setting
jdbc.driver=com.mysql.jdbc.Driver
jdbc.url=jdbc\:mysql\://127.0.0.1\:3306/weathergdmo?useUnicode\=true&characterEncoding\=utf-8
jdbc.username=root
jdbc.password=root
hibernate.dialect=org.hibernate.dialect.MySQL5InnoDBDialect
#hibernate settings
hibernate.show_sql=true
hibernate.format_sql=false
hibernate.ehcache_config_file=/ehcache/ehcache-hibernate-local.xml
#mysql version database setting
jdbc.driver=com.mysql.jdbc.Driver
jdbc.url=jdbc\:mysql\://10.12.12.62\:3306/weathergdmo?useUnicode\=true&characterEncoding\=utf-8
jdbc.username=root
jdbc.password=root
jdbc.initialPoolSize=5 
jdbc.maxPoolSize=10
jdbc.minPoolSize=6 
jdbc.maxIdleTime=600  
jdbc.acquireIncrement=5  
jdbc.maxStatements=5  
jdbc.idleConnectionTestPeriod=60 
hibernate.dialect=org.hibernate.dialect.MySQL5InnoDBDialect
#hibernate settings
hibernate.show_sql=true
hibernate.format_sql=false
hibernate.ehcache_config_file=/ehcache/ehcache-hibernate-local.xml

system_path=/home/grmc/gdmo/apache-tomcat-6.0.39/webapps/weather-gdmo/
weatherservice_path=/home/grmc/gdmo/won/serviceForcast
czCityForcast_path=/home/grmc/gdmo/won/testXml/
czCityForcast_path_bak=/home/grmc/gdmo/won/testXmlBak/
weatherservice_requesturl = http://10.12.12.115/GridService/XXZXQuery.asmx/ForecastElements?
video_path=/data/videomodule/video/
photo_path=/data/videomodule/img/
weather_data_url=http://10.12.12.114/di/services/DataApp?wsdl
weatherservice_url = http://10.12.12.114/di/http.action?
weatherservice_temp = /home/grmc/gdmo/won/temp
weatherservice_china = userId=gdmo&pwd=gdmo123&interfaceId=getRACSnwfdTime4IIIII&dataFormat=xml
weatherservice_world = userId=gdmo&pwd=gdmo123&interfaceId=getRACWordWeather4City&dataFormat=xml
weatherservice_hour = userId=gdmo&pwd=gdmo123&interfaceId=getRACAwst4Prov&dataFormat=xml
weatherservice_warn = userId=gdmo&pwd=gdmo123&interfaceId=getRACYjxh4Prov&dataFormat=xml
weatherservice_image = userId=gdmo&pwd=gdmo123&dataFormat=image
weatherservice_lvy = userId=gdmo&pwd=gdmo123&interfaceId=getRACTour4Prov&dataFormat=xml
weatherservice_site = userId=gdmo&pwd=gdmo123&interfaceId=getRACTourStationInfo&dataFormat=xml
weatherservice_air = userId=gdmo&pwd=gdmo123&interfaceId=getRACEnvir4Prov&dataFormat=xml
weatherservice_live_gd = userId=gdmo&pwd=gdmo123&interfaceId=getRACNewAuto4Prov&dataFormat=xml
weatherservice_day_live_gd = userId=gdmo&pwd=gdmo123&interfaceId=getRACAutoDay4Prov&dataFormat=xml
weatherservice_live_china = userId=gdmo&pwd=gdmo123&interfaceId=getRACAuto4Iiiii&dataFormat=xml
weatherservice_pm2_5_gd = userId=gdmo&pwd=gdmo123&interfaceId=getPM2_54Prov&dataFormat=xml
ocean_area_path=/home/grmc/gdmo/apache-tomcat-6.0.39/webapps/weather-gdmo/data/ocean/area/
ocean_point_path=/home/grmc/gdmo/apache-tomcat-6.0.39/webapps/weather-gdmo/data/ocean/point/
weathertyphoon_url =http://10.12.12.114/di/http.action?
weathertyphooninfo =userId=gdmo&pwd=gdmo123
city_lonlat =/home/grmc/gdmo/apache-tomcat-6.0.39/webapps/weather-gdmo/WEB-INF/classes/city/cityLonlat.xml
#tc--------------------------------------
time12=60
time24=160
time36=190
time48=240
time60=300
time72=320
time84=415
time96=400
time108=500
time120=480
tcPicPath=/home/grmc/gdmo/apache-tomcat-6.0.39/webapps/weather-gdmo/resource/img/image/typhoon/tc/
weathertZSJAir_url=http://10.12.12.114/di/http.action?
weathertZSJAir=userId=gdmo&pwd=gdmo123

修复方案：

补丁+重新配置！20Rank~

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-04-27 11:19

厂商回复：

已经转由CNCERT下发给相应分中心，由其后续协调网站管理单位处置。

最新状态：

暂无