[5.16]从微信小程序越权渗透某edu站的实例

阿尔法神域

9个月前更新

1166923

引入

来自于5.16提交的某edu站的漏洞,所有隐私信息均打码发布,只分享思路,

漏洞1:未授权访问

图片[1],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

图片[2],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

填写信息

图片[3],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

之后查看申请记录

此时可得到/api/applyInfo/getListById接口

图片[4],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

构造数据包(POC在圈内)

遍历ID接口可获得大量的Openid和个人信息及身份证号

未授权访问*1

返回结果:

图片[5],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

得到身份证信息等相关信息,记录openid

以下以40209的openid为例

未授权访问*2

再次点击入校申请:

图片[6],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

得到/api/applyInfo/getListByUser接口

图片[7],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

用openid遍历/api/applyInfo/getListByUser也可未授权访问大量身份证,姓名等信息

未授权访问*2

返回结果：

图片[8],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

文件上传(此洞edu不收,但可以作为一个思路)

再次点击入校申请

图片[9],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

图片[10],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

上传接口未对白名单进行有效鉴别

导致部分后缀如txt和js可以上传到服务器里并成功解析

图片[11],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

得到接口/api/upload/fileUpload

构造数据包

Js成功上传

图片[12],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

访问成功上传的js路径:

图片[13],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

成功访问

如不对相关后缀进行拦截,用户可以上传大量JS内容并成功在外部引用消耗服务器资源

构造引用接口

<!DOCTYPE html>

<html lang="en">

<head>

    <meta charset="UTF-8">

    <meta name="viewport" content="width=device-width, initial-scale=1.0">

    <title>Document</title>

</head>

<body>

    <button id="shenyu">测试</button>

    <script src="https://xxxxxx/1715851871562.js"></script>

</body>

</html>

图片[14],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

JS成功被解析

图片[15],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

伪造申请

再次点击入校申请

图片[16],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

填写信息
得到/api/applyInfo/subit接口

图片[17],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

进行openid替换

图片[18],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

申请成功后在/api/applyInfo/getListByUser (即未授权访问接口*2)当中查看申请结果

伪造申请成功

图片[19],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

伪造取消:

图片[20],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

得到接口/api/applyInfo/cancelSubmit

图片[21],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

遍历ID可取消别人和之前不小心申请的

图片[22],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

图片[23],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

结束

最后祝大家都能挖到洞

图片[24],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

博客内容均为打码内容,而我们圈内写的报告不打码而且包含poc,更适合挖洞小白学习复现!

欢迎加入我们的圈子,每日分享一手edu,cnvd,企业src报告(挖完就分享),带你领略渗透圈,手把手教挖洞!

图片[25],[5.16]从微信小程序越权渗透某edu站的实例,网络安全爱好者中心-神域博客网

------本文已结束，感谢您的阅读------

THE END

渗透测试网络安全网络攻防

喜欢就支持一下吧

相关推荐

评论共11条

请登录后发表评论

登录注册

只看作者

- search engine optimization0
  Your exemplary work demonstrates remarkable potential. With strategic enhancements, this foundation can be transformed into a pioneering contribution that advances the field and solidifies your position as an industry authority.
  7个月前回复
- internation seo company0
  Your article holds considerable promise, showcasing insightful ideas and a solid foundation. To elevate it to a truly outstanding level, consider the following enhancements: Deepen your analysis by exploring key concepts more thoroughly, providing nuanced explanations, and addressing potential counterarguments. Strengthen your arguments with additional evidence, including peer-reviewed sources, relevant statistics, and illustrative case studies. Refine your writing style to engage advanced readers by varying sentence structures, employing more sophisticated vocabulary, and ensuring each paragraph flows seamlessly into the next. Enhance the overall narrative arc by crafting a more compelling introduction that clearly outlines your thesis and a conclusion that reinforces your key points while highlighting broader implications. Incorporate a more critical examination of alternative viewpoints to demonstrate a comprehensive understanding of the topic and preemptively address potential critiques. Elaborate on the practical implications and real-world applications of your arguments to increase the relevance and impact of your work. Draw connections to related fields or concepts, broadening the scope and appeal of your article while showcasing its interdisciplinary significance. Consider incorporating more vivid examples or analogies to illustrate complex ideas, making your work more accessible without sacrificing depth. If appropriate, include visual elements such as graphs, charts, or infographics to support your textual arguments and appeal to visual learners. Ensure your conclusion not only summarizes your main points but also opens up avenues for further research or discussion, encouraging ongoing engagement with your ideas. Your innovative approach and clear writing provide an excellent foundation, and by implementing these suggestions, you can transform your already solid work into an exceptional piece that resonates deeply with a professional audience and makes a significant contribution to your field. The potential for greatness in your work is evident. Your commitment to excellence shines through, and I'm confident that your continued efforts and refinements will yield truly impressive results. I eagerly anticipate seeing how you build upon these strengths in your future endeavors, further establishing yourself as a thought leader in your area of expertise.
  7个月前回复
- Donavon Hamill0
  In a world where sharing and managing digital files have become crucial, FlashUpload.cloud stands out as an indispensable online storage solution. Whether you are an occasional user or a professional looking for a reliable and efficient platform, FlashUpload.cloud has something to offer everyone. In this blog post, we will explore the benefits and unique features of FlashUpload.cloud, with a focus on its premium membership plans.
  7个月前回复
- Sicherheit0
  Your article reflects a deep understanding of the subject matter. The comprehensive coverage and insightful analysis provide substantial value to readers. Your clear explanations and well-structured arguments demonstrate a strong grasp of the topic. The practical implications you've drawn out are particularly useful. While there's always room for further exploration, this piece makes a meaningful contribution to the discourse. I look forward to seeing how you build on these ideas in future work.
  8个月前回复
- elektriker gesundbrunnen0
  Your article demonstrates an exceptional level of professionalism and expertise. The thoroughness and depth with which you have covered the topic are truly impressive. Readers will greatly benefit from the valuable insights and practical advice you have shared. The clarity of your understanding is evident throughout the entire piece. I anticipate more of your high-quality work in the future. Thank you for offering your profound knowledge and providing such a detailed and enlightening resource.
  8个月前回复
- Norris Heathcote0
  Usually I do not read article on blogs however I would like to say that this writeup very compelled me to take a look at and do so Your writing taste has been amazed me Thanks quite nice post
  8个月前回复
- 404Xyunxi_1
  tqllllllllllllll
  8个月前回复
- 404Xyunxi_0
  tqllllllllllllll
  8个月前回复
- 404Xyunxi_0
  tqllllllllllllll
  8个月前回复
- 阿尔法神域0
  后续审核结果
  9个月前回复
- Login Rajaspin0
  The article's thought-provoking questions at the end invite readers to reflect on the topic.
  9个月前回复