[公开漏洞]阿里巴巴某系统设计缺陷可造成淘宝无限制撞库

阿里巴巴某系统设计缺陷可造成淘宝无限制撞库相关厂商：淘宝网漏洞作者：bing 提交时间：2014-03-20 17:26 公开时间：2014-05-04 17:27 漏洞类型：设计缺陷/逻辑错误危害等级：高自评Rank：20 漏洞状态：厂商已经确认漏洞来源：http://www.wooyun.org Tags标签：设计缺陷/边界绕过敏感接口缺乏校验逻辑错误设计不当认证设计不合理漏洞详情披露状态：

2014-03-20：细节已通知厂商并且等待厂商处理中
2014-03-24：厂商已经确认，细节仅向厂商公开
2014-04-03：细节向核心白帽子及相关领域专家公开
2014-04-13：细节向普通白帽子公开
2014-04-23：细节向实习白帽子公开
2014-05-04：细节向公众公开

简要描述：

描述引用猪猪侠，“大公司常有的诟病，随处可见的安全隐患，任意一个小问题都能引发企业安全的崩盘。” 淘宝！我这个能在500万奖励计划里吗？

详细说明：

当数据库、自动化攻击工具和最重要的无任何安全控制的接口融合在一起的时候，就发生了本次安全事件。

现阶段的安全测试更多的还是倾向于pc端的web安全，本次测试中无意中发现阿里巴巴移动端与web端相比存在多处安全问题。

问题描述

http://yunpan.alibaba-inc.com/

当我通过搜索引擎获得该URL的时候，随便翻了翻没发现什么问题

于是便修改useragent

于是刷新页面便切换到手机端UI

通过多次测试发现，该登录接口无登录次数、验证码等限制，这样我们就可以使用自动化工具和利用网络上泄漏的众多数据库fuzz。下面为实际测试结果，下面以C**N数据作为测试

漏洞证明：

测试结果还是很丰盛的，利用网上泄漏的数据库，我平均每小时能成功跑出1万条用户和密码，每天至少可成功fuzz出24万条淘宝用户帐号密码。

444107746@qq.comaaa3900983

flyhunterl@vip.qq.comhunterl6628096

yangbeck@163.combeck13579barry

wgq_779345@msn.com13818216040

376575738@qq.com19860922

158654729@qq.comqinboao123

gnpp-bo@163.com13929806789

394706198@qq.com3062202123

zxzx12561256@163.comzxzx1256

lpwwg@163.comlpwwg000217

360580804@qq.comhaoran070407

82688823@qq.comlxkKXL1984

464053393@qq.comlq63285009

jialin_happy@yeah.net212126lj

jay0zhou07@163.comjay0zhou07

bocjngg@126.comgg731206

zy8782925@163.com19861018a

zhulinsx@126.comzhulin1224

635009132@qq.comk87177015

zhaoyuqiang2009@163.com23261537

857714526@qq.comdy15995843315

a411951490@126.comlu201314

476537651@qq.com258258259

270086896@qq.comhy8518515

116689095@sohu.com15243670000

mifeisite@163.commxc9723045

xxx002mm@163.comxyx032711

314357615@qq.com357793530

htx@wxhtx.comwxhtx8989

252519574@qq.comyanda1983531

hh_jss@163.comwanghuijie

lingdianai@gmail.com123456ok

389007564@qq.com320whimer

qq423133388@163.comkaixin1314

zcs19870320@yahoo.com.cn29432534

455783487@qq.comw137059032

zhaodonghua.hi@163.com3589167468

zulal912@yahoo.com.cndilruz5815

zdx196906@126.com19690618

164382679@qq.comyt19870411

manvkai3780@sina.com111911mayan

1135725628@qq.comzwp9191112

budaiwawacpy@126.comwoaibeyound

yingxiong2888@126.com724473855wu

273608743@qq.comhin13420268636

168592151@qq.com168592151

jinxingtao@yahoo.cnjinxingtao

newheaven@qq.com55070707

andorr@163.coma.22051648

xuzhiyong_2000@163.com19810423

120140833@qq.coma5889123

sxz1955@sina.com19550910

lqh1988@foxmail.comlqh7758258

zmkimi@gmail.comzm3755986

forever-love271441@163.com5512335wl

colin.wyl@gmail.comwoct1217

zhujiaguang_0@163.comzjg486526

qtyeliming@sina.comzx123456

ziyunhongchen@yahoo.com.cnsyf998281

gufeng_0809@qq.comqq5311322

hhh_888111@163.coma123654789

fengshuo9@163.com13864527763

wy_81_11_14@163.com19811209wy

690063350@qq.comjscyl3889477

iverson881017@126.comiverson881017

435713631@qq.comy86639939k

564644045@qq.com12041016

806824536@qq.comHUANGSHENG

26579018@qq.comlh19830311

xufanggogo@163.comxufang1018*

zhanglingfeng-1@163.com200320444

463355090@qq.comlijunshuai

cjm871122@163.comchan1987

pestdong@sohu.com771025

panshilin@sina.compsl161912

0031114@163.comyidan0031114

zhyqing@yahoo.com.cn9801050808

lyham078@hotmail.com777ly777

358353959@qq.comdbsj19870919

372046752@qq.comlong5201203

sunyuzhao09@163.comsunyuzhao123

103395991@qq.com20081003

telex1978@sina.com19781111

358217818@qq.comfxj19900307

bluemoon2008@126.comhappy2000

yoyop@vip.qq.comemilymicky900309

yesosky@163.comyesosky810816*

aoke9601@sohu.comfairydream

439545554@qq.com056198lin

ruanfengsheng@163.comfjlyrfs5

xianglin_vigi@sina.comxianglin1020

123zs@live.cnzs3494451

zhangwei8752969@163.com378294113

413232952@qq.comluowenbo6366691

zq12377@sina.com19880215

zjnuist@126.comzjnuist2564446

tenni0@126.com990162tennis

jlp10735@126.com1042888680jlp

aotemanlive@qq.com19831014

jidequana8@163.com55643212

leaf9212@126.com19850921

jiuxiaoyinlong@yahoo.com.cn19830413

729788135@qq.comwanglihua174

374966034@qq.comqq84890405

hyj_0111@163.comwww.521hcx.com

rgl387680455@sina.comrgl87576508

tansy670@sina.comtsy811006

yugang2006@gmail.comqinqin0628

lovemyremember@yahoo.com.cnyv251406

593978632@qq.comkai520tao

cqxiewei@163.com19510626

songyingjie2460@163.com48001154

keyl9j@vip.qq.comqwe123qwe123

lqldlove@163.comlq198527

380579369@qq.com987456321qw

xinqiao816@126.comxinqiao81622556

110389151@QQ.com880321wsx

wazwfxln@163.comwangao123

mcwxx001@gmail.com015072mcw

812454276@qq.comzuiainuonuo

a000000g@126.comag000000

407790089@qq.comasd82145502

yangningshang@126.comning118712

etone2005@126.com19840221

97121443@qq.comming5201314

hu8808@163.com44415102

413449300@qq.comjiangzihao

zhaofeng888@163.com13832926240

longshecao06@yahoo.com.cnwec19801213

liyin1022@sina.com20011014

longcky2005@163.comwgejpedx

413492801@qq.comchenqiang241132

zjhywmf@163.com21103243

ywzayc@163.comywz12315

383192753@qq.comymx19911104

365179937@qq.com13738193085

270703001@qq.coma8127761

king.jmh@gmail.comjmh8906146

zhengpin001@yahoo.cn1986724168

49448881@qq.com1110100154

dongshui4@sohu.com19781978

123423374@qq.comye7758521

cjpkk@21cn.com37132510

421584998@qq.com110dd9gMYTH

472744173@qq.com1989425a

slyfx@126.com1046108781

125760706@qq.comdc_3q_you

wfc88888@yahoo.com.cnwfcwfcwfc

zhengyp@vip.qq.comz3811236

353375411@qq.com353375411a

306261835@qq.com306261835

741179788@QQ.COMCANDY5201314

13570235512mzh@163.com13570235512

zhongguo8808@yahoo.com.cnlcm811028

lovecc_hi@126.com685210808

382722417@qq.comlch19891221

dylyb618@163.com54618lyb

jack_589@hotmail.comz5887179

frenkiess@eyou.comewsd1240

aiwuyong@gmail.comwindows@@

gudouyb@126.comlehaotian

tangyan129623@163.comtangyan129623

334644705@qq.comjl4394796

27437795@qq.com27437795

651539675@qq.com19871111abc

kakino_1@163.com105963hn

eem200001@163.com24543701

qhbdfem@163.comqhb770319

851158276@qq.com13891890930

LIUWENHU2007@YAHOO.COM.CN19670925

zhengyaolian_123@yahoo.cn985613zyl

841232047@qq.comlhy03061989

only_calbee@163.commissxiao0316

springpp@qq.com811108asd

oicy@vip.qq.com1986922zq

cmxiaotang@163.com000ty000

gjqq_0824@163.com0824hhh22

liuziyang19880224@163.com6789625a

zhangjinsheng19830@163.com19841203

ftdd94@126.comxfj890805

258264953@qq.comwoaiwow123

sl522@163.comsunlei522

wangjie_5961@126.com275410424

516018873@qq.com92690930/*

747513444@qq.comfree19870301

wangxiangzhen33@163.com54762755

sifengruoshui@163.comzuo3815500

7081650@qq.comq7812679

bokaitjucareer@gmail.comdangvnbk8625

187140608@qq.comzxcvbn04060413

ld_msk@sina.comxlh720905

hackercia007@vip.qq.com779aaccX&

981325285@qq.comfslovessj

471769390@qq.comq79082424

130030700@qq.com8690102387

z_w_sandal@hotmail.comcaoxie1980

wl_cuit@163.comwl461245

qqqqa_q@126.comzhang1229

yaomin1128@163.com60DONGRUI55HUA

w15943323369@yahoo.com.cnw4213100

hejiaxie@126.com008300*/qq

124883206@qq.com66501772

minghua1841@163.comminghua1841

changchengxzy@yahoo.com.cn042477aa

xiyangxixia_2007@163.comxiyangxixia.2007

82072267@163.com88095887

youlei202@yahoo.com.cn19890715

chenmsheng@163.comchen0709

419150247@qq.comkevin1224

rexkissdream@163.comlzy5335566

296489929@qq.com0575zzcsama

wangzhenghua@mail.bnu.edu.cn19900230

zzhangbaoqiang@163.comzhangbaoqiang

threestonezl@163.comxx100200

iweboys@163.comasp2923344

304512281@qq.com19870424liling

luohaifeng19870914@yahoo.cn13578923465

53309733@qq.comjy01784593

zhonghualin.2008@163.comz5823209

lxycpcplxy@163.comlxy213112

114574672@qq.comzyq13791382716

hehe__dong@126.com19871222

228834351@qq.comchenjun83716

sh722@126.commsh..722

woailinux.cool@163.comxsz=89732118

jwzhao@mail.tmedi.com.cnzjwcyx001

sichuanadu@163.comp0o9i8u7

zouliyan_2003@sina.comzlyqgf3018

354683020@qq.comwoaixianga

fengfeng3532@163.com19860306x

bjwqt_0_0@sina.com1qaz2wsx

fengyutian555@126.com13572593208

lvpenglv1234@163.comlv1987328

153236799@qq.commengyuan031047

guojigj_2233@163.com127158xw

derekli992@yahoo.com.cn19990603

lele43@sina.comleleqq@www

373916248@qq.comcwd850623

1741335@qq.comcl77413cl

zhangzhenjiecumt@126.comzzj19870228

robbin059@21cn.comrobbin3223059

qiming880122@sina.comkobe98allen83lqm

liu88433491@163.com88433491

806118795@qq.comzhoujin074888

liu.chun.jiang.1@163.comyou666666

lj0120@qq.comlj520731

liweipiaoliang@163.comywlw117331

huanghuirainy@163.com410228love

jimmyliu007@163.com19821121

lurenjiaddlg@sina.comtxzlovespz

makubex19850306@163.com13793281378

hongyuan.zhu@163.comzhuhongyuan123

zms1984624@yahoo.com.cnzms19840624

yzhe@people.com.cnjsbkyy000

white81_gis@yahoo.com.cnb5q10z10

663592903@qq.com1314520zml

lj19888888@163.comwsdy1988

luofan923@163.com1295212251

Alizee_bao@hotmail.comBaojie00

850006680@qq.comlk6995007

kuailezizai123@163.com23111811

gsx-168@163.comgsx121618

renjianweiaini@126.com19868299912

kongchao1983@163.coma19830922

gynnx@163.com1331695274gy

263768209@qq.comsbb13776668338

905238839@qq.com5211314*

820937242@qq.comlily841218

haoweieee3207362@163.com15153207

wilwar3@126.com7124112icbc

abcd16069@163.com19820330

blueskywml@126.comwml13098999088

wangsicong1116@126.com12345asdf

jk118cn@yahoo.com.cn16232591

tdyx1985@sina.com.cnxjn342623

xuzhenkui1234@yahoo.com.cnhhxcttxs

crliqinlong@qq.comliqinlong

jtcw@163.compx07925226288

fzc82@sina.comfuzhichao0

442885851@qq.com13679084882xx

nmgchengwenjie@sina.com123qwe123

406517246@qq.com10197891417

756361153@qq.comfsw176221

343080460@qq.com1989519s

592512924@qq.com13132829123

215983122@qq.coma13936506144

wang19920226@163.com86226320

lxbljw68@163.comlxb810223

jiaxinbing2009@126.com7736269wo

1007287241@qq.comA1022575

403612678@qq.COMcan988512

444960684@qq.comw198626xd

396369767@qq.com8sa796e5

409080901@qq.comlh8181189

lnxq1986@126.comxq7700675

346563659@qq.comhanhanhan123

sunfeedy@163.comj1981924

ttu4545cl@163.comwea4360501

ruizhibest@gmail.comliruizhi

qujun747@eyou.com58457520

wyqschumi@163.comwyq19890402

alin87111@163.coma5s8d7f9f9

hzsjbzdjj@163.comhzsjbzdjj

waj111.cool@163.comwangaijian

zhaowei1987123@163.comzhaob311b

630922774@qq.com19890816

huangyuan44519@163.com89101920

jswl8888@qq.comqwqw1222

cissy_sx@163.com218322love1228

276221811@qq.com7586312mwmd

3832210@sina.comwwq3832210

easypaycard@vip.qq.comabc198593

xiedan315200@qq.com13896315200

orangecxy@sina.comyinyinty6h1eyy3n

263538636@163.comwxs092123

sqxxlhq118@sina.com43625809

zhangyongli7@126.com254551224

1046140301@qq.comwenquan2699

236180133@qq.com236180133

zzibm@163.comwangyang721

317939363@qq.com52youyou

mafeiyan2008@yahoo.cn2008070101

1776643@qq.comzxczxc01

liu770826@hotmail.comtony770826

wang_da_bo@126.com322867ok88wdb

3425090@qq.comwoaini521

liyaochange@126.comliyaolinux*2

www.529170389@qq.coma1234567

1149146316@qq.comzxxccc1224

liliangping19851016@126.comliang1016

hudianjun359@126.com521lyf...

135936293@qq.comIL0VEYOU

aidexuanlv@126.comwd5211314

hrgs_521@sina.comhrgs_521

yhao19841031@sina.com965364asd

duanjun1984@qq.comxian3599

352382935@qq.comTao880410

vabene2008@yahoo.com.cnrourou419

yangxiumei726@yahoo.cnyxm1988726

lxw800506@163.comlxw422129

anpei88@163.com2514038mmm

510344255@qq.comhanmeng123

522253343@qq.comkandysfj

yhf1027@126.comjunlei1027

liyanxinhong@126.com4292457hua

liuqing.0121@163.comliuqing520shan3

bluecoffee_123@163.comwanghaoqq36

yuanpengxu1@126.com3235561635

hui.junqing@163.comqweasd24865

joeyvercetti@sina.com5566energy

likelei3@126.comray180125

lwllh0104@sina.comllhlw0104

280376383@qq.comsdssdn7517

xiren1331@163.com980516ww

zhangyumin39@163.com147258369

ashley-jack@hotmail.comshirong520*

565625632@qq.comzq123456

yuanmeijie99@126.comyuan200856

lp9313@163.com19830205

352622654@qq.comqiongo16739

469933891@qq.comMRJpo7282101

xmcjf646589@sina.comxmcjf06190224

huangyisuxing@163.com102921763

hth18@163.com31415926

714025967@qq.comjianwei0906

sunjun728@tom.com19730728

sunweinibang@126.comsunwei2771617

729471203@qq.comwo27119360

houjie19860614@126.comh19860614

ybb35789@sina.comsuzhen1103

spring4231107@126.comchunchun4

ck23@163.comkevin64116

jlyysxiaoyan@163.comjlyysxiaoyan87

sandyj1984@gmail.comsamjevons1984

794634258@qq.comwtq13758157344

abcabc199@qq.comabc7770314

lysun123@163.comlvyusong123456

lw7561@sina.comqazse19850128

neo_lion@qq.comb1m2g3d4

61921623@qq.comspider2006

370311051@qq.com31415926

kxzzyl@163.com694685521

33313115@qq.combread790203

dmfs_616@163.comgh616008

lsj890130@126.comlsj890130

418056086@qq.com19861013mz

413119355@qq.comliuxvying987827

532965332@qq.comchenlei007

zhangjianrun@yahoo.cnshuangru19860707

dbetter@yeah.netdbetter

mingxuemei780625@163.comjhr070407*

jiaopan1124@126.comguagua1124

xiaokeaizhang123@163.com63612815q

343474078@qq.comzhongyang

tsxkkk@163.com361397908

wangzhuan19901209@yahoo.cn454676067

lidoudou929@163.comlidoudou12

346486236@qq.com3209097z

caoyitao@yahoo.cncaoyitao

35186853@qq.com031123tjd

1025434264@qq.com19901020number

464687007@qq.com464687007

doitmyself89@163.com1829xiaoxin89

cmandy2132@163.comcm821024

hzjdym2@163.commttqgh123

491788900@qq.comshyh5891

lzlove2008@163.comiwillgo83

jiang934661@163.comiayjte1987

gjjbltdyh@sina.comgjj491654644

wzcsxl_123@126.comwzcsxl123

apple_89078320@126.comxqc890783201989

sijinping@vip.qq.com502279950

185366845@qq.com185366845

ggqwr@126.comworld19880914

bingle1983@126.com19830127

yaohuisct@163.comYHSCT022629

391678015@qq.comyu88044177

hcl87311@yahoo.com.cn37581520

302832826@qq.comyyzly1314521

1003429312@qq.comwzs591216

29932143@qq.com36954007521

951205760@qq.com940908qq

gn153768@126.comgn0209153768

305937006@qq.comlgl198815

405922026@qq.comlj6881156

xyl__@126.comxiangyu0