支付平台通商宝Struts2命令执行漏洞

编号10067
Urlhttp://www.wooyun.org/bug.php?action=view&id=10067
漏洞状态未联系到厂商或者厂商积极忽略
漏洞标题支付平台通商宝Struts2命令执行漏洞
漏洞类型命令执行
厂商通商宝
白帽子%22
提交日期2012-07-24 12:38:00
公开日期2012-09-07 12:39:00
修复时间(not set)
确认时间0000-00-00 00:00:00
Confirm Spend-1
漏洞标签
关注数0
收藏数0
白帽评级
白帽自评rank15
厂商评级
厂商评rank0
漏洞简介
Struts2漏洞 满地都是了
漏洞细节

Struts2漏洞
http://www.t3pay.cn/gameAction!getSingleGame.action

POC

http://www.t3pay.cn/gameAction!getSingleGame.action

uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
?? 194
drwxr-xr-x 2 root root 4096 2010-05-20 bin
drwxr-xr-x 4 root root 1024 2010-12-14 boot
-rw-r--r-- 1 503 mailuser 4819 2012-01-10 buttom18-2.png
drwxr-xr-x 11 root root 3600 07-16 18:25 dev
drwxr-xr-x 104 root root 12288 07-24 04:06 etc
drwxr-xr-x 43 root root 4096 07-19 17:30 home
drwxr-xr-x 13 root root 4096 2010-05-20 lib
drwx------ 2 root root 16384 2010-05-20 lost+found
drwxr-xr-x 2 root root 4096 07-16 18:25 media
-rw-r--r-- 1 root root 10240 06-21 16:59 mini.tar
drwxr-xr-x 2 root root 0 07-16 18:25 misc
drwxr-xr-x 3 root root 4096 2010-05-28 mnt
drwxr-xr-x 2 root root 0 07-16 18:25 net
drwxr-xr-x 3 root root 4096 2010-05-22 opt
dr-xr-xr-x 253 root root 0 07-16 18:24 proc
drwxr-x--- 21 root root 4096 07-23 19:18 root
drwxr-xr-x 2 root root 12288 2010-05-20 sbin
drwxr-xr-x 2 root root 4096 2010-05-20 selinux
drwxr-xr-x 2 root root 4096 2008-08-08 srv
drwxr-xr-x 11 root root 0 07-16 18:24 sys
drwxr-xr-x 3 root root 4096 2010-05-20 tftpboot
drwxrwxrwt 7 root root 12288 07-24 04:05 tmp
drwxr-xr-x 19 root root 4096 06-21 17:01 usr
drwxr-xr-x 27 root root 4096 05-21 20:42 var
drwxr-xr-x 19 root root 4096 2011-07-13 webbackup
drwxr-xr-x 3 root root 4096 07-09 15:11 WEB-INF
drwxr-xr-x 4 root root 4096 05-29 11:08 WebRoot

修复方案

打补丁

状态信息 2012-07-24: 积极联系厂商并且等待厂商认领中,细节不对外公开
2012-09-07: 厂商已经主动忽略漏洞,细节向公众公开
厂商回复(not set)
回应信息未能联系到厂商或者厂商积极拒绝
Showing 1-1 of 1 item.
评论内容评论人点赞数评论时间

@xsser 又一个bug的楼主

风萧萧02012-07-25 20:21:00