UCSTAR即时通讯工具未授权访问导致企业内部聊天信息泄露及GETSHELL内网漫游（三）

UcSTAR统一通信是擎旗技术推出的企业级融合通信平台；提供多种通讯手段（IM企业即时通信、文件、VcSTAR视频、语音、EMAIL、SMS短信中心、电话、VOIP、MSN/QQ互通、UCALL多媒体呼叫中心），融合企业的多种应用系统紧密集成（OA、CMS>、ERP、EIP、Portal、网站、应用软件），交流对象和交流内容可管理，可控制，可扩展，轻松实现部署企业的统一工作平台。

1.通过http://**.**.**.**/bugs/wooyun-2014-072080读取到web.xml配置文件发现多处文件可进行未授权访问，文件名如下；

<init-param> <param-name>excludes</param-name> <param-value>myLeavemessage.action,seatknowledgeList.action,newWorksheetmanager.action,getQueueUser.action,seatnotebooklist.action,qualityGradeList.action,seatBlackerList.action,getchatsessionlist.action,seatContractMessageList.action,getUserList.action,tradesys-chatsessionstat.jsp,customerInfo.jsp,consultantInfo.jsp,webcall/knoLibIframe.jsp,webcall/ucstarVisitorStatueData.jsp,blackerSave.action,newBlackerSave.action,webcall_chat/addblacker.jsp,webcall/messageRoleMenuView2.jsp,seatListSelect.jsp,webcall/worksheetAdd.jsp,webcall/messageNoteAdd.jsp,webcall/messageNoteAdd.jsp,login_bysso.jsp,queryusername.action,userregisterforclient.jsp,clientGroupmessagerList.action,panel/,randImages.jsp,softphone/,result,ssoOaUserConfig,ssoOaUserList,mypanel-showurl.jsp,test.jsp,test1.jsp,sso-,plugins/gateway/gateway-rtx-autocreate.jsp,login.jsp,index.jsp?logout=true,setup/index.jsp,setup/setup-,.gif,.png,error-serverdown.jsp,client_showaffiche.action,client_affiche.action,client_affiche_list.action,client_affiche_scroll.action,client_affiche_grade.action,saveAfficheofcleint.action,issuedaffichesuccess.jsp,client_subscriber.action,client-subscribersave.action,subscriber_success.jsp,client-subscribersave.action,client-subscriberupdatesave.action,client_subscriberupdate.action,client_subscriberdelete.action,client-subscriberadd.action,client_mail.jsp,client_systemaffiche_scroll.action,clientaffichesystemscroll.jsp,client-systemaffiche-list.action,client_issueaffiche.action,client-deleteAffiche.action,client-editAffiche.action,client-updateAffiche.action,plugins/gateway/gateway-client-registrations.jsp,exportmessagetofile.jsp,plugins/gateway/gateway-checker.jsp,plugins/gateway/gateway-client-registrationsadd.jsp,plugins/gateway/gateway-client-editregistrations.jsp,clientregister.action,register_sucess.jsp,ipphoneList.action,bbsdiscuss/dhtreeForums.jsp,js_list_nodes.jsp,grouptreehome-inner.jsp,bindgroup-index-inner.jsp,gjpanel-showurl.jsp,clientBindGroupAffEdit.jsp,clientBindGroupAffDelete.jsp,clientAfficheShow.jsp,plugins/sms/sms-limit-user-ajaxset.jsp,share_own.jsp,mypanel-redirect.jsp,panelextends-registertairan.jsp,plugins/sms/sms-user-config.jsp,zk/show_personalsch.zul,zk/show_commonsch.zul,zk/show_notice.zul,zk/sch_personal.zul,zk/sch_common.zul,zk/sch_notice.zul,user-email-edit.jsp,outlinker-export.jsp,outlinker-loadexport.jsp,outlinerload.action,outlinerload_star.action,user-register.jsp,user-register.action,zkau1,worksheetmanager.action,webcall_chat/knowledgeSearchTreeData.jsp,webcall_chat/knowledgeSearchData.jsp,webcall_chat/knowledgeSearchData.jsp,webcall_chat/knowledge-search.jsp,webcall_chat/newContractMessageList.action,webcall_chat/notebooklist.action,webcall_chat/newknowledgeList.action,webcall_chat/newBlackerList.action,webcall_chat/leaveMessage.jsp,webcall_chat/knowledge-search.jsp,webcall_chat/newVisitorManagerSeat.jsp,getQueueUser.action,/WEB-INF/ucstar/user/bindgroupuser.html,schedulemsgdelete.action,hint/hint_client_show.jsp,system-message-schedule-client.jsp,share_own.jsp,schedulemsglist.action,hint_client_show.jsp,hint/hint_client_show.jsp,offlineBroadcastList.jsp,chatsessionmsgMiniList.action,chatsession_messageview_minilist.jsp,service_tousu.jsp,xinda_clientchatwinmarquee.jsp,web-client-updatepwd.jsp,userinfo.jsp,userinfo-basic.jsp,userinfo-contact.jsp,userinfo-detail.jsp,ucstarVisitorStatueMain.jsp,emp-detail-info-customershow.jsp,xinda_mymanager.jsp,changepassword.jsp,xinda_onlinebusinesshall.jsp,xinda_clientsso.jsp,xinda_call.jsp,xinda_crmsys.jsp,xinda_ssologin.jsp,emp-detail-info.jsp,clientaffiche_manager.jsp,blank.jsp,clientaffichesystemscroll2.jsp,client_systemaffiche_scroll.action,tradesys-share.jsp,tradesys-fund.jsp,userclient-card.jsp,analysis_huaxi.action,logincms.jsp,schedulemsglistclient.action,shedulemsg_list_client.jsp,updateuser.action,selectgroupbysession.jsp,ace-select-radio-groups.jsp,selectuserbysession.jsp,system-message-schedule-client.jsp,user-basic-info.jsp,user-contace-info.jsp,user-detail-info.jsp,user-basic-info-emp.jsp,user-contact-info-emp.jsp,user-detail-info-emp.jsp,toedituserbasepage.action,toeditusercontactpage.action,toedituserdetailpage.action,toedituserbasepageemp.action,toeditusercontactpageemp.action,toedituserdetailpageemp.action,tradesys-latencycustomer-list.jsp,tradesys-latencycustomer-create.jsp,latencycustomeredit.action,latencycustomerdelete.action,latencycustomersaveorupdate.action,service_vote.jsp,webcall_chat/contractMessageSave.action,webcall_chat/sendSuccess.jsp,webcall_chat/sendError.jsp,webcall/messageRoleMenuViewBigtree.jsp,mainSeat.action,ucstarMessage-list-new.jsp,ucstarMessageReceiptMain.jsp,vcstar_sg/,refuseReasonSelect.action,webcall/authIdentity.jsp,webcall/surveyView.jsp,answerCollect.action,webcall_chat/leaveSystemMessage.jsp,knowledgefaqsearch.action,knowledgefaqcontent.action,webcall_chat/knowledgeFAQsearch.jsp,webcall_chat/knowledgeFAQContent.jsp,webcall_chat/knowledgeFAQ.jsp,webcall_chat/knowledgefaqmanager.jsp,webcall/modifyPassword.jsp,webcall_chat/paomadeng.jsp,loginManager.jsp</param-value> </init-param>

2.通过测试部分文件，可进行查看ucstar所有用户名及企业内部人员所有聊天信息，其中包括一些企业敏感信息等。

http://x.x.x.x/seatListSelect.jsp                  查看ucstar所有用户
 http://x.x.x.x/ucstarMessage-list-new.jsp  查看UCstar所有用户聊天记录
 http://x.x.x.x/webcall/messageNoteAdd.jsp

3.万恶的fckeditor

http://x.x.x.x/client-editAffiche.action   
 http://x.x.x.x/FCKeditor/editor/filemanager/browser/default/browser.html?Connector=connectors/jsp/connector   任意后缀上传，jsp马访问时会进行跳转首页，但可以解析jspx后缀的木马。

http://**.**.**.**:9090/ucstarMessage-list-new.jsp
 **.**.**.**:8002/ucstarMessage-list-new.jsp
 http://**.**.**.**:9090/ucstarMessage-list-new.jsp
 http://**.**.**.**:9090/ucstarMessage-list-new.jsp

更多案例：

http://**.**.**.**/casefinance/index.htm

漏洞太多，先把这个UcSTAR 管理控制台不对外网开放吧。

厂商回应：

危害等级：高

漏洞Rank：18

确认时间：2014-08-18 09:06

厂商回复：

CNVD确认并复现所述情况，已经由CNVD直接向软件生产厂商擎旗公司通报，对方反馈已经着手处置。

最新状态：

暂无

1. 2014-08-13 13:14 | Coody ( 核心白帽子 | Rank:1809 漏洞数:214 | 不接单、不黑产；如遇冒名顶替接单收徒、绝...)

   0

   这个狠了

   1#回复此人

2. 2014-08-13 20:39 | pandas ( 普通白帽子 | Rank:730 漏洞数:84 | 国家特级保护动物)

   0

   唉，还是放出来了阿

   2#回复此人

3. 2014-08-13 21:27 | loli ( 普通白帽子 | Rank:649 漏洞数:59 | 每个男人心中都住着一个叫小红的88号技师。)

   0

   @pandas 。。。。。

   3#回复此人

4. 2014-09-17 22:35 | pandas ( 普通白帽子 | Rank:730 漏洞数:84 | 国家特级保护动物)

   0

   原来提的是fck，虚惊一场

   4#回复此人

5. 2014-10-16 15:14 | 杨絮 ( 路人 | Rank:4 漏洞数:1 | 保密)

   0

   @pandas loli是谁???我似乎猜到了

   5#回复此人

6. 2014-11-26 15:04 | Stardustsky ( 路人 | Rank:4 漏洞数:3 | ……)

   1

   为何要放出来？你这个坏淫……

   6#回复此人