当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0150083

漏洞标题:丁丁贷某处java语言dos漏洞导致系统崩溃

相关厂商:丁丁贷

漏洞作者: 汇投网

提交时间:2015-10-28 21:59

修复时间:2015-12-12 22:00

公开时间:2015-12-12 22:00

漏洞类型:设计缺陷/逻辑错误

危害等级:低

自评Rank:1

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-10-28: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-12-12: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

参数前端后台都没有做过滤,会造成服务器挂掉。

详细说明:

http://www.tintinloan.com/newCaculate.jsp
没有对参数进行过滤,提交什么就计算什么
那么温和一点,从92233720368547758070,92233720开始尝试。。
打开5个TAB提交
然后服务器挂了。。

漏洞证明:

HTTP Status 500 - Handler processing failed; nested exception is java.lang.OutOfMemoryError: GC overhead limit exceeded
type Exception report
message Handler processing failed; nested exception is java.lang.OutOfMemoryError: GC overhead limit exceeded
description The server encountered an internal error that prevented it from fulfilling this request.
exception
org.springframework.web.util.NestedServletException: Handler processing failed; nested exception is java.lang.OutOfMemoryError: GC overhead limit exceeded
org.springframework.web.servlet.DispatcherServlet.triggerAfterCompletionWithError(DispatcherServlet.java:1260)
org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:939)
org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:851)
org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:953)
org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:855)
javax.servlet.http.HttpServlet.service(HttpServlet.java:650)
org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:829)
javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
com.alibaba.druid.support.http.WebStatFilter.doFilter(WebStatFilter.java:123)
org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:88)
org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:106)
com.tintinloan.common.filter.ConsoleValidateFilter.doFilter(ConsoleValidateFilter.java:94)
com.tintinloan.common.filter.security.SecurityFilter.doFilter(SecurityFilter.java:143)
org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:61)
org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108)
org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137)
org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
org.apache.shiro.web.servlet.AbstractShiroFilter.executeChain(AbstractShiroFilter.java:449)
org.apache.shiro.web.servlet.AbstractShiroFilter$1.call(AbstractShiroFilter.java:365)
org.apache.shiro.subject.support.SubjectCallable.doCall(SubjectCallable.java:90)
org.apache.shiro.subject.support.SubjectCallable.call(SubjectCallable.java:83)
org.apache.shiro.subject.support.DelegatingSubject.execute(DelegatingSubject.java:383)
org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:362)
org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:343)
org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:260)
root cause
java.lang.OutOfMemoryError: GC overhead limit exceeded
java.util.Arrays.copyOfRange(Arrays.java:2694)
java.lang.String.<init>(String.java:203)
java.lang.StringBuilder.toString(StringBuilder.java:405)
ch.qos.logback.core.pattern.PatternLayoutBase.writeLoopOnConverters(PatternLayoutBase.java:122)
ch.qos.logback.classic.PatternLayout.doLayout(PatternLayout.java:149)
ch.qos.logback.classic.PatternLayout.doLayout(PatternLayout.java:39)
ch.qos.logback.core.encoder.LayoutWrappingEncoder.doEncode(LayoutWrappingEncoder.java:134)
ch.qos.logback.core.OutputStreamAppender.writeOut(OutputStreamAppender.java:194)
ch.qos.logback.core.OutputStreamAppender.subAppend(OutputStreamAppender.java:219)
ch.qos.logback.core.OutputStreamAppender.append(OutputStreamAppender.java:103)
ch.qos.logback.core.UnsynchronizedAppenderBase.doAppend(UnsynchronizedAppenderBase.java:88)
ch.qos.logback.core.spi.AppenderAttachableImpl.appendLoopOnAppenders(AppenderAttachableImpl.java:48)
ch.qos.logback.classic.Logger.appendLoopOnAppenders(Logger.java:273)
ch.qos.logback.classic.Logger.callAppenders(Logger.java:260)
ch.qos.logback.classic.Logger.buildLoggingEventAndAppend(Logger.java:442)
ch.qos.logback.classic.Logger.filterAndLog_0_Or3Plus(Logger.java:396)
ch.qos.logback.classic.Logger.info(Logger.java:600)
com.tintinloan.common.loan.strategy.AverageCapitalInterestStrategyImpl.makeRepayPlan(AverageCapitalInterestStrategyImpl.java:99)
com.tintinloan.common.loan.RepayAndGainPlanImpl.calculateRepayAndGainPlan(RepayAndGainPlanImpl.java:30)
com.tintinloan.controller.user.LoginController.caculateBenefit(LoginController.java:98)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
java.lang.reflect.Method.invoke(Method.java:606)
org.springframework.web.method.support.InvocableHandlerMethod.invoke(InvocableHandlerMethod.java:215)
org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:132)
org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:104)
org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandleMethod(RequestMappingHandlerAdapter.java:745)
org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:685)
org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:80)
org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:919)
org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:851)
note The full stack trace of the root cause is available in the Apache Tomcat/7.0.63 logs.

修复方案:

JS验证一下提交数据,后台同时验证数据。
不符合规范不予通过

版权声明:转载请注明来源 汇投网@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝