当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0141630

漏洞标题：时趣互动某漏洞可泄露数十万数据引发蝴蝶效应

相关厂商：social-touch.com

漏洞作者： 路人甲

提交时间：2015-09-16 18:47

修复时间：2015-09-17 13:06

公开时间：2015-09-17 13:06

漏洞类型：重要敏感信息泄露

危害等级：高

自评Rank：18

漏洞状态：厂商已经修复

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-09-16： 细节已通知厂商并且等待厂商处理中
2015-09-17： 厂商已经确认，细节仅向厂商公开
2015-09-17： 厂商已经修复漏洞并主动公开，细节向公众公开

简要描述：

上一个漏洞：http://www.wooyun.org/bugs/wooyun-2015-0140660
说好的小礼物都没送我，这是第二发了！
求礼物！！

详细说明：

上次提交的第一个漏洞，说好的小礼物都不给我！这次再来一个大点的。源于某处配置不当，导致目录遍历，可下载备份文件，内含大量敏感信息，包括不限于用户姓名/密码/家庭住址/联系方式!还有驴妈妈和新浪的一些信息，包括众多个人微信的案例!
0x00:起初，由于未授权访问引起：

http://api.social-touch.com/log/ 上级目录不重要，重要的就是备份的1.5G的文件


大图来了：

1.png


由于信息量过大，只能点到为止！因此分为四个部分一一列举出部分重点：
第一部分：

用户数十万详细信息信息包括：会员等级/新老会员/会员姓名/联系方式/家庭住址/消费途径……各种，看表头，以下四张表不同的，每张数据量过万！！*路径下所针对文件夹内月份销售以及赠送详细信息 #由于Excel文档用户数据过多，单个文件已经不能用用户量表示，直接用大小吧。月份allmember_info 28MB！


2015-09-16_171635.png


001.png


002.png


003.png


第二部分:

详细过万物流信息+部分账户cookie


00001.png


1.png


随便贴出一小部分：

2015/05/28 14:56:22  服务名：query_trace 返回内容：{"response":{"isSuccess":"T","traceList":[{"trace":[{"billCode":669046284454,"desc":"快件已签收，签收人是【图片】","optTime":"2015-04-07 16:23:52","optType":"签收"},{"billCode":669046284454,"operateSite":"朝阳十三部","nextSite":"朝阳十三部","desc":"[朝阳十三部]的【孙浩18401689711】正在派件, 电话：010-57232725","optTime":"2015-04-07 08:35:11","optType":"派件"},{"billCode":669046284454,"operateSite":"朝阳十三

漏洞证明：

第三部分：

用户登陆设备敏感信息，我们发现了大量的微信请求。包括微信账户信息，地址等敏感信息


1234.png


第四部分：

驴妈妈以及新浪的一些请求等


1.png


1.png


再赠一个：

大量的crocs_info/系统配置


1.png


随便贴出一个Crocs_info：

2015/07/13 08:06:35  array (
  'flag' => 0,
  'data' => 'lack of openid',
  'openId' => '',
  'info' => '',
  'func' => 'getrelation',
)
2015/07/13 08:06:35  array (
  'flag' => 0,
  'data' => 'lack of openid',
  'openId' => '',
  'info' => '',
  'func' => 'getrelation',
)
2015/07/13 08:06:36  array (
  'func' => 'oauth',
  'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode',
  'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3F1aXplLz9ybmQ9MTQxOTcxMTgzOSZzaWQ9MTIzMTUmZnJvbT10aW1lbGluZSZpc2FwcGluc3RhbGxlZD0w%26rid%3D651a22fd1533e12c8a68bd018dc27cbc&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect',
  'rid' => '651a22fd1533e12c8a68bd018dc27cbc',
)
2015/07/13 08:06:36  array (
  'func' => 'oauth',
  'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode',
  'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3F1aXplLz9ybmQ9MTQxOTcxMTgzOSZzaWQ9MTIzMTUmZnJvbT10aW1lbGluZSZpc2FwcGluc3RhbGxlZD0w%26rid%3D6e6edfe0385c8fa1a46bc58ca4e8ecd8&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect',
  'rid' => '6e6edfe0385c8fa1a46bc58ca4e8ecd8',
)
2015/07/13 08:06:36  array (
  'func' => 'oauth',
  'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode',
  'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3F1aXplLz9ybmQ9MTQxOTcxMTgzOSZzaWQ9MTIzMTUmZnJvbT10aW1lbGluZSZpc2FwcGluc3RhbGxlZD0w%26rid%3D6e6edfe0385c8fa1a46bc58ca4e8ecd8&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect',
  'rid' => '6e6edfe0385c8fa1a46bc58ca4e8ecd8',
)
2015/07/13 08:20:01  array (
  'flag' => 0,
  'data' => 'lack of openid',
  'openId' => '',
  'info' => '',
  'func' => 'getrelation',
)
2015/07/13 08:20:01  array (
  'func' => 'oauth',
  'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode',
  'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3F1aXplLz9ybmQ9MTQxOTcxMTgzOSZzaWQ9MTIzMTUmZnJvbT10aW1lbGluZSZpc2FwcGluc3RhbGxlZD0w%26rid%3Df87f6083275c9288ac39ece509494be4&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect',
  'rid' => 'f87f6083275c9288ac39ece509494be4',
)
2015/07/13 08:20:03  array (
  'func' => 'getcode',
  'url' => 'http://event.gemground.com/crocs.draw2014/index.php/callback/authorize/?redirect=http://event.gemground.com/crocs.draw2014/index.php/entrance/share/quize/?rnd=1419711839&sid=12315&from=timeline&isappinstalled=0&rid=6e6edfe0385c8fa1a46bc58ca4e8ecd8&openid=',
  'cache_openid' => false,
  'mark' => 2,
)
2015/07/13 09:20:11  array (
  'flag' => 0,
  'data' => 'lack of openid',
  'openId' => '',
  'info' => '',
  'func' => 'getrelation',
)
2015/07/13 09:20:12  array (
  'func' => 'oauth',
  'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode',
  'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3F1aXplLz9ybmQ9MTQxOTcxMTgzOSZzaWQ9MTIzMTUmZnJvbT10aW1lbGluZSZpc2FwcGluc3RhbGxlZD0w%26rid%3D7235561f7d037f46a330905b9c372a4c&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect',
  'rid' => '7235561f7d037f46a330905b9c372a4c',
)
2015/07/13 22:43:54  array (
  'func' => 'oauth',
  'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode',
  'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL3Nob2Vib3gvZmV0Y2hlZC8%2Fcm5kPTE0MjI0MTMxOTQmZnJvbT10aW1lbGluZSZpc2FwcGluc3RhbGxlZD0w%26rid%3D0748c8c59509f301803fb99abf37d01e&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect',
  'rid' => '0748c8c59509f301803fb99abf37d01e',
)
2015/07/13 22:48:06  array (
  'flag' => 0,
  'data' => 'lack of openid',
  'openId' => '',
  'info' => '',
  'func' => 'getrelation',
)
2015/07/13 22:48:06  array (
  'func' => 'oauth',
  'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode',
  'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3JlY3J1aXQvP3NpZD0yMjU5JmZyb209dGltZWxpbmUmaXNhcHBpbnN0YWxsZWQ9MA%3D%3D%26rid%3Dd9fddcdabbb52da6a62d7b3d69cfabde&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect',
  'rid' => 'd9fddcdabbb52da6a62d7b3d69cfabde',
)
2015/07/13 22:48:06  array (
  'flag' => 0,
  'data' => 'lack of openid',
  'openId' => '',
  'info' => '',
  'func' => 'getrelation',
)
2015/07/13 22:48:07  array (
  'func' => 'oauth',
  'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode',
  'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3JlY3J1aXQvP3NpZD0yMjU5JmZyb209dGltZWxpbmUmaXNhcHBpbnN0YWxsZWQ9MA%3D%3D%26rid%3D9e960b247e655eec58e95a5cd2231ec4&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect',
  'rid' => '9e960b247e655eec58e95a5cd2231ec4',
)
2015/07/13 22:48:11  array (
  'func' => 'getcode',
  'result' => NULL,
  'mark' => 1,
)
2015/07/13 22:48:11  array (
  'func' => 'getcode',
  'url' => 'http://event.gemground.com/crocs.draw2014/index.php/callback/authorize/?redirect=http://event.gemground.com/crocs.draw2014/index.php/entrance/share/recruit/?sid=2259&from=timeline&isappinstalled=0&rid=9e960b247e655eec58e95a5cd2231ec4&openid=',
  'cache_openid' => false,
  'mark' => 2,
)
2015/07/13 22:48:21  array (
  'func' => 'getcode',
  'result' => NULL,
  'mark' => 1,
)
2015/07/13 22:48:21  array (
  'func' => 'getcode',
  'url' => 'http://event.gemground.com/crocs.draw2014/index.php/callback/authorize/?redirect=http://event.gemground.com/crocs.draw2014/index.php/entrance/share/recruit/?sid=2259&from=timeline&isappinstalled=0&rid=9e960b247e655eec58e95a5cd2231ec4&openid=',
  'cache_openid' => false,
  'mark' => 2,
)
2015/07/13 23:01:40  array (
  'flag' => 0,
  'data' => 'lack of openid',
  'openId' => '',
  'info' => '',
  'func' => 'getrelation',
)
2015/07/13 23:01:40  array (
  'func' => 'oauth',
  'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode',
  'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2VudHJhbmNlL3NoYXJlL3JlY3J1aXQvP3NpZD0yMjU5JmZyb209dGltZWxpbmUmaXNhcHBpbnN0YWxsZWQ9MA%3D%3D%26rid%3D93d083dc0291eee8bdb3bc43ff11cda8&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect',
  'rid' => '93d083dc0291eee8bdb3bc43ff11cda8',
)
2015/07/13 23:17:14  array (
  'func' => 'oauth',
  'callback' => 'http://wechat.social-touch.com/plugins/index?app=crocs&class=crocsapi&method=getcode',
  'url' => 'https://open.weixin.qq.com/connect/oauth2/authorize?appid=wxe4b86e16b02f0ed7&redirect_uri=http%3A%2F%2Fwechat.social-touch.com%2Fplugins%2Findex%3Fapp%3Dcrocs%26class%3Dcrocsapi%26method%3Dgetcode%26callback%3DaHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL2NhbGxiYWNrL2F1dGhvcml6ZS8%2FcmVkaXJlY3Q9aHR0cDovL2V2ZW50LmdlbWdyb3VuZC5jb20vY3JvY3MuZHJhdzIwMTQvaW5kZXgucGhwL3Nob2Vib3gvZmV0Y2hlZC8%2Fcm5kPTE0MjI0MTMxOTQmZnJvbT10aW1lbGluZSZpc2FwcGluc3RhbGxlZD0w%26rid%3D7de0c2fc4b53533a98b70da791fdfcae&response_type=code&scope=snsapi_userinfo&state=STATE#wechat_redirect',
  'rid' => '7de0c2fc4b53533a98b70da791fdfcae',
)


修复方案：

已经第二发了，我是来找礼物的！

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：低

漏洞Rank：1

确认时间：2015-09-17 13:05

厂商回复：

旧的数据备份

最新状态：

2015-09-17：已经关闭这个链接，并删除旧的数据备份。