破壳企业应急安全(防御方向)课程 应急响应 勒索病毒 挖矿木马 DDOS 日志分析

金山KingGate防火墙存在设计缺陷可直接获取权限控制设备(附POC)

编号135128
Urlhttp://www.wooyun.org/bug.php?action=view&id=135128
漏洞状态厂商已经确认
漏洞标题金山KingGate防火墙存在设计缺陷可直接获取权限控制设备(附POC)
漏洞类型设计缺陷/逻辑错误
厂商金山软件集团
白帽子YY-2012
提交日期2015-08-19 15:39:00
公开日期2015-11-17 16:22:00
修复时间(not set)
确认时间2015-08-19 00:00:00
Confirm Spend0
漏洞标签设计缺陷/边界绕过 逻辑错误
关注数0
收藏数0
白帽评级
白帽自评rank20
厂商评级
厂商评rank15
漏洞简介
用户购买设备想获取安全保障,身为安全厂商偏偏给用户带来未知的安全威胁!!!Why?
该设计缺陷新旧版本的KingGate防火墙通杀,开发团队可以正式宣布解散。。
漏洞细节

zBDhUvybatKrg.jpg


金山旗下"KingGate"硬件防火墙产品存在设计缺陷无需登录情况下可任意添加管理员&任意下载系统配置文件(包含明文账号密码)【新旧版本通杀】

POC

新版案例:
https://www.qh119.gov.cn/src/system/login.php?login_retry=true
https://115.239.246.102/src/system/login.php?login_retry=true
https://111.1.82.143/src/system/login.php?login_retry=true
https://220.173.107.90/src/system/login.php?login_retry=true
https://59.46.73.106/src/system/login.php?login_retry=true
https://www.xn--3dsz23cqb341isz0akob.com/src/system/login.php?login_retry=true
https://202.103.238.229/src/system/login.php?login_retry=true
旧版本案例:
https://116.77.32.13:8443/src/system/login.php
https://116.77.32.3:8443/src/system/login.php
https://116.77.32.4:8443/src/system/login.php
https://222.179.180.74:8443/src/system/login.php
https://116.77.32.11:8443/src/system/login.php
https://210.21.231.102/src/system/login.php
https://116.77.32.12:8443/src/system/login.php
https://116.77.32.10:8443/src/system/login.php
https://116.77.32.2:8443/src/system/login.php
https://120.196.138.212:8443/src/system/login.php
https://218.93.17.154:8443/src/system/login.php
https://218.25.140.137:8443/src/system/login.php
https://124.93.200.105:8443/src/system/login.php
https://218.26.248.71/src/system/login.php
https://211.142.19.11/src/system/login.php
https://202.97.152.130/src/system/login.php
https://www.lt.lskjd.gov.cn/src/system/login.php
https://124.93.200.109:8443/src/system/login.php
https://218.26.24.146:8443/src/system/login.php
https://211.142.24.77:8443/src/system/login.php
https://124.93.200.108:8443/src/system/login.php
https://124.93.200.100:8443/src/system/login.php
https://110.249.216.198/src/system/login.php
https://hbsrfb.gov.cn/src/system/login.php
http://116.95.130.3/src/system/login.php
https://222.74.54.234:8443/src/system/login.php
https://222.74.54.234/src/system/login.php
https://116.95.130.3:8443/src/system/login.php
https://218.21.230.154:8443/src/system/login.php
https://218.26.1.75:8443/src/system/login.php
http://60.210.101.238/src/system/login.php
https://211.142.29.10/src/system/login.php
https://218.26.164.26/src/system/login.php
https://www.yucoffee.com/src/system/login.php
https://en.diyuan.cc/src/system/login.php
https://restartclub.com/src/system/login.php
https://58.22.6.39:8443/src/system/login.php
https://218.26.4.186/src/system/login.php
https://182.151.197.195/src/system/login.php
https://220.193.65.237/src/system/login.php
https://220.193.65.236/src/system/login.php
https://220.193.65.238/src/system/login.php
https://183.6.133.179/src/system/login.php
https://220.166.83.98/src/system/login.php
https://220.193.65.238:8443/src/system/login.php
https://222.169.100.142/src/system/login.php
https://182.151.197.195:8443/src/system/login.php
https://218.56.144.171/src/system/login.php
https://27.195.159.2/src/system/login.php
https://218.56.144.172/src/system/login.php
https://www.taaic.gov.cn/src/system/login.php
https://220.193.65.234:8443/src/system/login.php
https://www.gzzygts.com/src/system/login.php
https://www.zyhsj.com/src/system/login.php
https://58.22.6.40:8443/src/system/login.php
https://218.26.168.72/src/system/login.php
https://www.yczyzz.cn/src/system/login.php
https://218.26.96.71:8443/src/system/login.php
https://218.61.70.246:8443/src/system/login.php
https://222.33.40.27:8443/src/system/login.php
https://183.238.241.46:8443/src/system/login.php
https://61.138.108.74:8443/src/system/login.php
https://61.161.214.62/src/system/login.php
https://125.32.94.203:8443/src/system/login.php


aaaaaaaaaaaa1111111111111111111111.jpg


aaaaaaaaaaaaa22222222222222222.jpg


aaaaaaaaaaa333333333333333333.jpg


aaaaaaaaaaaaa444444444444444.jpg


aaaaaaaaa555555555555555555.jpg


aaaaaaaaa66666666666666666666.jpg


aaaaaaaaa777777777777777777777.jpg


aaaaaaaaaaaa88888888888888888.jpg

修复方案

状态信息 2015-08-19: 细节已通知厂商并且等待厂商处理中
2015-08-19: 厂商已经确认,细节仅向厂商公开
2015-08-22: 细节向第三方安全合作伙伴开放
2015-10-13: 细节向核心白帽子及相关领域专家公开
2015-10-23: 细节向普通白帽子公开
2015-11-02: 细节向实习白帽子公开
2015-11-17: 细节向公众公开
厂商回复非常感谢提交!马上跟进
回应信息危害等级:高漏洞Rank:15 确认时间:2015-08-19 16:21
Showing 1-5 of 5 items.
评论内容评论人点赞数评论时间

安全产品本身不安全。。。。,金山还有这产品?一如既往的支持金山与发现漏洞的白帽子。开发团队还是别解散了否则没人打补丁,罚集体去看泡沫剧花钱雇吧

大漠長河02015-09-01 14:02:00

用户购买设备想获取安全保障,身为安全厂商偏偏给用户带来未知的安全威胁!!!Why?该设计缺陷新旧版本的KingGate防火墙通杀,开发团队可以正式宣布解散。。

我就是_than02015-08-19 16:31:00

不给活路?

cloud克劳德02015-08-19 16:20:00

你为何总是这么的吊

huoji02015-08-19 15:53:00

你为何总是这么的吊

index02015-08-19 15:46:00