作品发布     邀请码    设为首页  收藏 

当前位置:文章漏洞 → 文章内容 >> UCSTAR即时通讯工具未授权访问导致企业内部聊天信息泄露及GETSHELL内网漫游(三)


UCSTAR即时通讯工具未授权访问导致企业内部聊天信息泄露及GETSHELL内网漫游(三)

更新时间:2014-11-15 16:56:50   作者:佚名  来源:不详

UcSTAR统一通信是擎旗技术推出的企业级融合通信平台;提供多种通讯手段(IM企业即时通信、文件、VcSTAR视频、语音、EMAIL、SMS短信中心、电话、VOIP、MSN/QQ互通、UCALL多媒体呼叫中心),融合企业的多种应用系统紧密集成(OA、CMS>、ERP、EIP、Portal、网站、应用软件),交流对象和交流内容可管理,可控制,可扩展,轻松实现部署企业的统一工作平台。







1.通过 WooYun: 某客服服务系统任意文件下载漏洞涉及多家银行、证券、基金、政府(二) 读取到web.xml配置文件发现多处文件可进行未授权访问,文件名如下;



code 区域
<init-param>

<param-name>excludes</param-name>

<param-value>myLeavemessage.action,seatknowledgeList.action,newWorksheetmanager.action,getQueueUser.action,seatnotebooklist.action,qualityGradeList.action,seatBlackerList.action,getchatsessionlist.action,seatContractMessageList.action,getUserList.action,tradesys-chatsessionstat.jsp,customerInfo.jsp,consultantInfo.jsp,webcall/knoLibIframe.jsp,webcall/ucstarVisitorStatueData.jsp,blackerSave.action,newBlackerSave.action,webcall_chat/addblacker.jsp,webcall/messageRoleMenuView2.jsp,seatListSelect.jsp,webcall/worksheetAdd.jsp,webcall/messageNoteAdd.jsp,webcall/messageNoteAdd.jsp,login_bysso.jsp,queryusername.action,userregisterforclient.jsp,clientGroupmessagerList.action,panel/,randImages.jsp,softphone/,result,ssoOaUserConfig,ssoOaUserList,mypanel-showurl.jsp,test.jsp,test1.jsp,sso-,plugins/gateway/gateway-rtx-autocreate.jsp,login.jsp,index.jsp?logout=true,setup/index.jsp,setup/setup-,.gif,.png,error-serverdown.jsp,client_showaffiche.action,client_affiche.action,client_affiche_list.action,client_affiche_scroll.action,client_affiche_grade.action,saveAfficheofcleint.action,issuedaffichesuccess.jsp,client_subscriber.action,client-subscribersave.action,subscriber_success.jsp,client-subscribersave.action,client-subscriberupdatesave.action,client_subscriberupdate.action,client_subscriberdelete.action,client-subscriberadd.action,client_mail.jsp,client_systemaffiche_scroll.action,clientaffichesystemscroll.jsp,client-systemaffiche-list.action,client_issueaffiche.action,client-deleteAffiche.action,client-editAffiche.action,client-updateAffiche.action,plugins/gateway/gateway-client-registrations.jsp,exportmessagetofile.jsp,plugins/gateway/gateway-checker.jsp,plugins/gateway/gateway-client-registrationsadd.jsp,plugins/gateway/gateway-client-editregistrations.jsp,clientregister.action,register_sucess.jsp,ipphoneList.action,bbsdiscuss/dhtreeForums.jsp,js_list_nodes.jsp,grouptreehome-inner.jsp,bindgroup-index-inner.jsp,gjpanel-showurl.jsp,clientBindGroupAffEdit.jsp,clientBindGroupAffDelete.jsp,clientAfficheShow.jsp,plugins/sms/sms-limit-user-ajaxset.jsp,share_own.jsp,mypanel-redirect.jsp,panelextends-registertairan.jsp,plugins/sms/sms-user-config.jsp,zk/show_personalsch.zul,zk/show_commonsch.zul,zk/show_notice.zul,zk/sch_personal.zul,zk/sch_common.zul,zk/sch_notice.zul,user-email-edit.jsp,outlinker-export.jsp,outlinker-loadexport.jsp,outlinerload.action,outlinerload_star.action,user-register.jsp,user-register.action,zkau1,worksheetmanager.action,webcall_chat/knowledgeSearchTreeData.jsp,webcall_chat/knowledgeSearchData.jsp,webcall_chat/knowledgeSearchData.jsp,webcall_chat/knowledge-search.jsp,webcall_chat/newContractMessageList.action,webcall_chat/notebooklist.action,webcall_chat/newknowledgeList.action,webcall_chat/newBlackerList.action,webcall_chat/leaveMessage.jsp,webcall_chat/knowledge-search.jsp,webcall_chat/newVisitorManagerSeat.jsp,getQueueUser.action,/WEB-INF/ucstar/user/bindgroupuser.html,schedulemsgdelete.action,hint/hint_client_show.jsp,system-message-schedule-client.jsp,share_own.jsp,schedulemsglist.action,hint_client_show.jsp,hint/hint_client_show.jsp,offlineBroadcastList.jsp,chatsessionmsgMiniList.action,chatsession_messageview_minilist.jsp,service_tousu.jsp,xinda_clientchatwinmarquee.jsp,web-client-updatepwd.jsp,userinfo.jsp,userinfo-basic.jsp,userinfo-contact.jsp,userinfo-detail.jsp,ucstarVisitorStatueMain.jsp,emp-detail-info-customershow.jsp,xinda_mymanager.jsp,changepassword.jsp,xinda_onlinebusinesshall.jsp,xinda_clientsso.jsp,xinda_call.jsp,xinda_crmsys.jsp,xinda_ssologin.jsp,emp-detail-info.jsp,clientaffiche_manager.jsp,blank.jsp,clientaffichesystemscroll2.jsp,client_systemaffiche_scroll.action,tradesys-share.jsp,tradesys-fund.jsp,userclient-card.jsp,analysis_huaxi.action,logincms.jsp,schedulemsglistclient.action,shedulemsg_list_client.jsp,updateuser.action,selectgroupbysession.jsp,ace-select-radio-groups.jsp,selectuserbysession.jsp,system-message-schedule-client.jsp,user-basic-info.jsp,user-contace-info.jsp,user-detail-info.jsp,user-basic-info-emp.jsp,user-contact-info-emp.jsp,user-detail-info-emp.jsp,toedituserbasepage.action,toeditusercontactpage.action,toedituserdetailpage.action,toedituserbasepageemp.action,toeditusercontactpageemp.action,toedituserdetailpageemp.action,tradesys-latencycustomer-list.jsp,tradesys-latencycustomer-create.jsp,latencycustomeredit.action,latencycustomerdelete.action,latencycustomersaveorupdate.action,service_vote.jsp,webcall_chat/contractMessageSave.action,webcall_chat/sendSuccess.jsp,webcall_chat/sendError.jsp,webcall/messageRoleMenuViewBigtree.jsp,mainSeat.action,ucstarMessage-list-new.jsp,ucstarMessageReceiptMain.jsp,vcstar_sg/,refuseReasonSelect.action,webcall/authIdentity.jsp,webcall/surveyView.jsp,answerCollect.action,webcall_chat/leaveSystemMessage.jsp,knowledgefaqsearch.action,knowledgefaqcontent.action,webcall_chat/knowledgeFAQsearch.jsp,webcall_chat/knowledgeFAQContent.jsp,webcall_chat/knowledgeFAQ.jsp,webcall_chat/knowledgefaqmanager.jsp,webcall/modifyPassword.jsp,webcall_chat/paomadeng.jsp,loginManager.jsp</param-value>

</init-param>





2.通过测试部分文件,可进行查看ucstar所有用户名及企业内部人员所有聊天信息,其中包括一些企业敏感信息等。



code 区域
http://x.x.x.x/seatListSelect.jsp                  查看ucstar所有用户

http://x.x.x.x/ucstarMessage-list-new.jsp 查看UCstar所有用户聊天记录

http://x.x.x.x/webcall/messageNoteAdd.jsp



xx.png







3.万恶的fckeditor

code 区域
http://x.x.x.x/client-editAffiche.action   

http://x.x.x.x/FCKeditor/editor/filemanager/browser/default/browser.html?Connector=connectors/jsp/connector 任意后缀上传,jsp马访问时会进行跳转首页,但可以解析jspx后缀的木马。



xxx2.png



xxx.png

漏洞证明:



code 区域
http://im.dhzq.com.cn:9090/ucstarMessage-list-new.jsp

http://119.147.80.161:8002/ucstarMessage-list-new.jsp

http://oa.hdbp.com:9090/ucstarMessage-list-new.jsp

http://www.qqtech.com:9090/ucstarMessage-list-new.jsp



更多案例:

http://www.qqtech.com/casefinance/index.htm

修复方案:

漏洞太多,先把这个UcSTAR 管理控制台不对外网开放吧。

责任编辑:华中帝国        



本文引用网址: 

UCSTAR即时通讯工具未授权访问导致企业内部聊天信息泄露及GETSHELL内网漫游(三)的相关文章
发表评论

用户名: 查看更多评论

分 值:100分 85分 70分 55分 40分 25分 10分 0分

内 容:

         (注“”为必填内容。) 验证码: 验证码,看不清楚?请点击刷新验证码