漏洞详情

披露状态:

2014-03-20: 细节已通知厂商并且等待厂商处理中
2014-03-24: 厂商已经确认,细节仅向厂商公开
2014-04-03: 细节向核心白帽子及相关领域专家公开
2014-04-13: 细节向普通白帽子公开
2014-04-23: 细节向实习白帽子公开
2014-05-04: 细节向公众公开

简要描述:

描述引用猪猪侠,“大公司常有的诟病,随处可见的安全隐患,任意一个小问题都能引发企业安全的崩盘。” 淘宝!我这个能在500万奖励计划里吗?

详细说明:

当数据库、自动化攻击工具和最重要的无任何安全控制的接口融合在一起的时候,就发生了本次安全事件。

现阶段的安全测试更多的还是倾向于pc端的web安全,本次测试中无意中发现阿里巴巴移动端与web端相比存在多处安全问题。



问题描述



http://yunpan.alibaba-inc.com/

当我通过搜索引擎获得该URL的时候,随便翻了翻没发现什么问题

于是便修改useragent



1.jpg





于是刷新页面便切换到手机端UI



2.jpg





通过多次测试发现,该登录接口无登录次数、验证码等限制,这样我们就可以使用自动化工具和利用网络上泄漏的众多数据库fuzz。下面为实际测试结果,下面以C**N数据作为测试



3.jpg





漏洞证明:

测试结果还是很丰盛的,利用网上泄漏的数据库,我平均每小时能成功跑出1万条用户和密码,每天至少可成功fuzz出24万条淘宝用户帐号密码。

444107746@qq.com	aaa3900983
flyhunterl@vip.qq.com hunterl6628096
yangbeck@163.com beck13579barry
wgq_779345@msn.com 13818216040
376575738@qq.com 19860922
158654729@qq.com qinboao123
gnpp-bo@163.com 13929806789
394706198@qq.com 3062202123
zxzx12561256@163.com zxzx1256
lpwwg@163.com lpwwg000217
360580804@qq.com haoran070407
82688823@qq.com lxkKXL1984
464053393@qq.com lq63285009
jialin_happy@yeah.net 212126lj
jay0zhou07@163.com jay0zhou07
bocjngg@126.com gg731206
zy8782925@163.com 19861018a
zhulinsx@126.com zhulin1224
635009132@qq.com k87177015
zhaoyuqiang2009@163.com 23261537
857714526@qq.com dy15995843315
a411951490@126.com lu201314
476537651@qq.com 258258259
270086896@qq.com hy8518515
116689095@sohu.com 15243670000
mifeisite@163.com mxc9723045
xxx002mm@163.com xyx032711
314357615@qq.com 357793530
htx@wxhtx.com wxhtx8989
252519574@qq.com yanda1983531
hh_jss@163.com wanghuijie
lingdianai@gmail.com 123456ok
389007564@qq.com 320whimer
qq423133388@163.com kaixin1314
zcs19870320@yahoo.com.cn 29432534
455783487@qq.com w137059032
zhaodonghua.hi@163.com 3589167468
zulal912@yahoo.com.cn dilruz5815
zdx196906@126.com 19690618
164382679@qq.com yt19870411
manvkai3780@sina.com 111911mayan
1135725628@qq.com zwp9191112
budaiwawacpy@126.com woaibeyound
yingxiong2888@126.com 724473855wu
273608743@qq.com hin13420268636
168592151@qq.com 168592151
jinxingtao@yahoo.cn jinxingtao
newheaven@qq.com 55070707
andorr@163.com a.22051648
xuzhiyong_2000@163.com 19810423
120140833@qq.com a5889123
sxz1955@sina.com 19550910
lqh1988@foxmail.com lqh7758258
zmkimi@gmail.com zm3755986
forever-love271441@163.com 5512335wl
colin.wyl@gmail.com woct1217
zhujiaguang_0@163.com zjg486526
qtyeliming@sina.com zx123456
ziyunhongchen@yahoo.com.cn syf998281
gufeng_0809@qq.com qq5311322
hhh_888111@163.com a123654789
fengshuo9@163.com 13864527763
wy_81_11_14@163.com 19811209wy
690063350@qq.com jscyl3889477
iverson881017@126.com iverson881017
435713631@qq.com y86639939k
564644045@qq.com 12041016
806824536@qq.com HUANGSHENG
26579018@qq.com lh19830311
xufanggogo@163.com xufang1018*
zhanglingfeng-1@163.com 200320444
463355090@qq.com lijunshuai
cjm871122@163.com chan1987
pestdong@sohu.com 771025
panshilin@sina.com psl161912
0031114@163.com yidan0031114
zhyqing@yahoo.com.cn 9801050808
lyham078@hotmail.com 777ly777
358353959@qq.com dbsj19870919
372046752@qq.com long5201203
sunyuzhao09@163.com sunyuzhao123
103395991@qq.com 20081003
telex1978@sina.com 19781111
358217818@qq.com fxj19900307
bluemoon2008@126.com happy2000
yoyop@vip.qq.com emilymicky900309
yesosky@163.com yesosky810816*
aoke9601@sohu.com fairydream
439545554@qq.com 056198lin
ruanfengsheng@163.com fjlyrfs5
xianglin_vigi@sina.com xianglin1020
123zs@live.cn zs3494451
zhangwei8752969@163.com 378294113
413232952@qq.com luowenbo6366691
zq12377@sina.com 19880215
zjnuist@126.com zjnuist2564446
tenni0@126.com 990162tennis
jlp10735@126.com 1042888680jlp
aotemanlive@qq.com 19831014
jidequana8@163.com 55643212
leaf9212@126.com 19850921
jiuxiaoyinlong@yahoo.com.cn 19830413
729788135@qq.com wanglihua174
374966034@qq.com qq84890405
hyj_0111@163.com www.521hcx.com
rgl387680455@sina.com rgl87576508
tansy670@sina.com tsy811006
yugang2006@gmail.com qinqin0628
lovemyremember@yahoo.com.cn yv251406
593978632@qq.com kai520tao
cqxiewei@163.com 19510626
songyingjie2460@163.com 48001154
keyl9j@vip.qq.com qwe123qwe123
lqldlove@163.com lq198527
380579369@qq.com 987456321qw
xinqiao816@126.com xinqiao81622556
110389151@QQ.com 880321wsx
wazwfxln@163.com wangao123
mcwxx001@gmail.com 015072mcw
812454276@qq.com zuiainuonuo
a000000g@126.com ag000000
407790089@qq.com asd82145502
yangningshang@126.com ning118712
etone2005@126.com 19840221
97121443@qq.com ming5201314
hu8808@163.com 44415102
413449300@qq.com jiangzihao
zhaofeng888@163.com 13832926240
longshecao06@yahoo.com.cn wec19801213
liyin1022@sina.com 20011014
longcky2005@163.com wgejpedx
413492801@qq.com chenqiang241132
zjhywmf@163.com 21103243
ywzayc@163.com ywz12315
383192753@qq.com ymx19911104
365179937@qq.com 13738193085
270703001@qq.com a8127761
king.jmh@gmail.com jmh8906146
zhengpin001@yahoo.cn 1986724168
49448881@qq.com 1110100154
dongshui4@sohu.com 19781978
123423374@qq.com ye7758521
cjpkk@21cn.com 37132510
421584998@qq.com 110dd9gMYTH
472744173@qq.com 1989425a
slyfx@126.com 1046108781
125760706@qq.com dc_3q_you
wfc88888@yahoo.com.cn wfcwfcwfc
zhengyp@vip.qq.com z3811236
353375411@qq.com 353375411a
306261835@qq.com 306261835
741179788@QQ.COM CANDY5201314
13570235512mzh@163.com 13570235512
zhongguo8808@yahoo.com.cn lcm811028
lovecc_hi@126.com 685210808
382722417@qq.com lch19891221
dylyb618@163.com 54618lyb
jack_589@hotmail.com z5887179
frenkiess@eyou.com ewsd1240
aiwuyong@gmail.com windows@@
gudouyb@126.com lehaotian
tangyan129623@163.com tangyan129623
334644705@qq.com jl4394796
27437795@qq.com 27437795
651539675@qq.com 19871111abc
kakino_1@163.com 105963hn
eem200001@163.com 24543701
qhbdfem@163.com qhb770319
851158276@qq.com 13891890930
LIUWENHU2007@YAHOO.COM.CN 19670925
zhengyaolian_123@yahoo.cn 985613zyl
841232047@qq.com lhy03061989
only_calbee@163.com missxiao0316
springpp@qq.com 811108asd
oicy@vip.qq.com 1986922zq
cmxiaotang@163.com 000ty000
gjqq_0824@163.com 0824hhh22
liuziyang19880224@163.com 6789625a
zhangjinsheng19830@163.com 19841203
ftdd94@126.com xfj890805
258264953@qq.com woaiwow123
sl522@163.com sunlei522
wangjie_5961@126.com 275410424
516018873@qq.com 92690930/*
747513444@qq.com free19870301
wangxiangzhen33@163.com 54762755
sifengruoshui@163.com zuo3815500
7081650@qq.com q7812679
bokaitjucareer@gmail.com dangvnbk8625
187140608@qq.com zxcvbn04060413
ld_msk@sina.com xlh720905
hackercia007@vip.qq.com 779aaccX&
981325285@qq.com fslovessj
471769390@qq.com q79082424
130030700@qq.com 8690102387
z_w_sandal@hotmail.com caoxie1980
wl_cuit@163.com wl461245
qqqqa_q@126.com zhang1229
yaomin1128@163.com 60DONGRUI55HUA
w15943323369@yahoo.com.cn w4213100
hejiaxie@126.com 008300*/qq
124883206@qq.com 66501772
minghua1841@163.com minghua1841
changchengxzy@yahoo.com.cn 042477aa
xiyangxixia_2007@163.com xiyangxixia.2007
82072267@163.com 88095887
youlei202@yahoo.com.cn 19890715
chenmsheng@163.com chen0709
419150247@qq.com kevin1224
rexkissdream@163.com lzy5335566
296489929@qq.com 0575zzcsama
wangzhenghua@mail.bnu.edu.cn 19900230
zzhangbaoqiang@163.com zhangbaoqiang
threestonezl@163.com xx100200
iweboys@163.com asp2923344
304512281@qq.com 19870424liling
luohaifeng19870914@yahoo.cn 13578923465
53309733@qq.com jy01784593
zhonghualin.2008@163.com z5823209
lxycpcplxy@163.com lxy213112
114574672@qq.com zyq13791382716
hehe__dong@126.com 19871222
228834351@qq.com chenjun83716
sh722@126.com msh..722
woailinux.cool@163.com xsz=89732118
jwzhao@mail.tmedi.com.cn zjwcyx001
sichuanadu@163.com p0o9i8u7
zouliyan_2003@sina.com zlyqgf3018
354683020@qq.com woaixianga
fengfeng3532@163.com 19860306x
bjwqt_0_0@sina.com 1qaz2wsx
fengyutian555@126.com 13572593208
lvpenglv1234@163.com lv1987328
153236799@qq.com mengyuan031047
guojigj_2233@163.com 127158xw
derekli992@yahoo.com.cn 19990603
lele43@sina.com leleqq@www
373916248@qq.com cwd850623
1741335@qq.com cl77413cl
zhangzhenjiecumt@126.com zzj19870228
robbin059@21cn.com robbin3223059
qiming880122@sina.com kobe98allen83lqm
liu88433491@163.com 88433491
806118795@qq.com zhoujin074888
liu.chun.jiang.1@163.com you666666
lj0120@qq.com lj520731
liweipiaoliang@163.com ywlw117331
huanghuirainy@163.com 410228love
jimmyliu007@163.com 19821121
lurenjiaddlg@sina.com txzlovespz
makubex19850306@163.com 13793281378
hongyuan.zhu@163.com zhuhongyuan123
zms1984624@yahoo.com.cn zms19840624
yzhe@people.com.cn jsbkyy000
white81_gis@yahoo.com.cn b5q10z10
663592903@qq.com 1314520zml
lj19888888@163.com wsdy1988
luofan923@163.com 1295212251
Alizee_bao@hotmail.com Baojie00
850006680@qq.com lk6995007
kuailezizai123@163.com 23111811
gsx-168@163.com gsx121618
renjianweiaini@126.com 19868299912
kongchao1983@163.com a19830922
gynnx@163.com 1331695274gy
263768209@qq.com sbb13776668338
905238839@qq.com 5211314*
820937242@qq.com lily841218
haoweieee3207362@163.com 15153207
wilwar3@126.com 7124112icbc
abcd16069@163.com 19820330
blueskywml@126.com wml13098999088
wangsicong1116@126.com 12345asdf
jk118cn@yahoo.com.cn 16232591
tdyx1985@sina.com.cn xjn342623
xuzhenkui1234@yahoo.com.cn hhxcttxs
crliqinlong@qq.com liqinlong
jtcw@163.com px07925226288
fzc82@sina.com fuzhichao0
442885851@qq.com 13679084882xx
nmgchengwenjie@sina.com 123qwe123
406517246@qq.com 10197891417
756361153@qq.com fsw176221
343080460@qq.com 1989519s
592512924@qq.com 13132829123
215983122@qq.com a13936506144
wang19920226@163.com 86226320
lxbljw68@163.com lxb810223
jiaxinbing2009@126.com 7736269wo
1007287241@qq.com A1022575
403612678@qq.COM can988512
444960684@qq.com w198626xd
396369767@qq.com 8sa796e5
409080901@qq.com lh8181189
lnxq1986@126.com xq7700675
346563659@qq.com hanhanhan123
sunfeedy@163.com j1981924
ttu4545cl@163.com wea4360501
ruizhibest@gmail.com liruizhi
qujun747@eyou.com 58457520
wyqschumi@163.com wyq19890402
alin87111@163.com a5s8d7f9f9
hzsjbzdjj@163.com hzsjbzdjj
waj111.cool@163.com wangaijian
zhaowei1987123@163.com zhaob311b
630922774@qq.com 19890816
huangyuan44519@163.com 89101920
jswl8888@qq.com qwqw1222
cissy_sx@163.com 218322love1228
276221811@qq.com 7586312mwmd
3832210@sina.com wwq3832210
easypaycard@vip.qq.com abc198593
xiedan315200@qq.com 13896315200
orangecxy@sina.com yinyinty6h1eyy3n
263538636@163.com wxs092123
sqxxlhq118@sina.com 43625809
zhangyongli7@126.com 254551224
1046140301@qq.com wenquan2699
236180133@qq.com 236180133
zzibm@163.com wangyang721
317939363@qq.com 52youyou
mafeiyan2008@yahoo.cn 2008070101
1776643@qq.com zxczxc01
liu770826@hotmail.com tony770826
wang_da_bo@126.com 322867ok88wdb
3425090@qq.com woaini521
liyaochange@126.com liyaolinux*2
www.529170389@qq.com a1234567
1149146316@qq.com zxxccc1224
liliangping19851016@126.com liang1016
hudianjun359@126.com 521lyf...
135936293@qq.com IL0VEYOU
aidexuanlv@126.com wd5211314
hrgs_521@sina.com hrgs_521
yhao19841031@sina.com 965364asd
duanjun1984@qq.com xian3599
352382935@qq.com Tao880410
vabene2008@yahoo.com.cn rourou419
yangxiumei726@yahoo.cn yxm1988726
lxw800506@163.com lxw422129
anpei88@163.com 2514038mmm
510344255@qq.com hanmeng123
522253343@qq.com kandysfj
yhf1027@126.com junlei1027
liyanxinhong@126.com 4292457hua
liuqing.0121@163.com liuqing520shan3
bluecoffee_123@163.com wanghaoqq36
yuanpengxu1@126.com 3235561635
hui.junqing@163.com qweasd24865
joeyvercetti@sina.com 5566energy
likelei3@126.com ray180125
lwllh0104@sina.com llhlw0104
280376383@qq.com sdssdn7517
xiren1331@163.com 980516ww
zhangyumin39@163.com 147258369
ashley-jack@hotmail.com shirong520*
565625632@qq.com zq123456
yuanmeijie99@126.com yuan200856
lp9313@163.com 19830205
352622654@qq.com qiongo16739
469933891@qq.com MRJpo7282101
xmcjf646589@sina.com xmcjf06190224
huangyisuxing@163.com 102921763
hth18@163.com 31415926
714025967@qq.com jianwei0906
sunjun728@tom.com 19730728
sunweinibang@126.com sunwei2771617
729471203@qq.com wo27119360
houjie19860614@126.com h19860614
ybb35789@sina.com suzhen1103
spring4231107@126.com chunchun4
ck23@163.com kevin64116
jlyysxiaoyan@163.com jlyysxiaoyan87
sandyj1984@gmail.com samjevons1984
794634258@qq.com wtq13758157344
abcabc199@qq.com abc7770314
lysun123@163.com lvyusong123456
lw7561@sina.com qazse19850128
neo_lion@qq.com b1m2g3d4
61921623@qq.com spider2006
370311051@qq.com 31415926
kxzzyl@163.com 694685521
33313115@qq.com bread790203
dmfs_616@163.com gh616008
lsj890130@126.com lsj890130
418056086@qq.com 19861013mz
413119355@qq.com liuxvying987827
532965332@qq.com chenlei007
zhangjianrun@yahoo.cn shuangru19860707
dbetter@yeah.net dbetter
mingxuemei780625@163.com jhr070407*
jiaopan1124@126.com guagua1124
xiaokeaizhang123@163.com 63612815q
343474078@qq.com zhongyang
tsxkkk@163.com 361397908
wangzhuan19901209@yahoo.cn 454676067
lidoudou929@163.com lidoudou12
346486236@qq.com 3209097z
caoyitao@yahoo.cn caoyitao
35186853@qq.com 031123tjd
1025434264@qq.com 19901020number
464687007@qq.com 464687007
doitmyself89@163.com 1829xiaoxin89
cmandy2132@163.com cm821024
hzjdym2@163.com mttqgh123
491788900@qq.com shyh5891
lzlove2008@163.com iwillgo83
jiang934661@163.com iayjte1987
gjjbltdyh@sina.com gjj491654644
wzcsxl_123@126.com wzcsxl123
apple_89078320@126.com xqc890783201989
sijinping@vip.qq.com 502279950
185366845@qq.com 185366845
ggqwr@126.com world19880914
bingle1983@126.com 19830127
yaohuisct@163.com YHSCT022629
391678015@qq.com yu88044177
hcl87311@yahoo.com.cn 37581520
302832826@qq.com yyzly1314521
1003429312@qq.com wzs591216
29932143@qq.com 36954007521
951205760@qq.com 940908qq
gn153768@126.com gn0209153768
305937006@qq.com lgl198815
405922026@qq.com lj6881156
xyl__@126.com xiangyu0

修复方案:

you know it!

版权声明:转载请注明来源 bing@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2014-03-24 16:20

厂商回复:

感谢你对我们的支持与关注!

最新状态:

暂无


漏洞评价: