Vulnerability Detail Report
Vulnerability Overview
- ZDID: ZD-2023-00052
- 發信 Vendor: Ragic
- Title: Ragic 資料洩漏
- Introduction: 資料表沒驗證讀取權限
處理狀態
目前狀態
-
新提交
-
已審核
-
已通報
-
已修補
-
已複測
-
公開
處理歷程
- 2023/02/01 16:45:11 : 新提交 (由 Pichu Chen 更新此狀態)
- 2023/02/06 00:12:31 : 審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
- 2023/02/15 12:09:14 : 審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
- 2023/02/15 12:09:14 : 修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
- 2023/02/15 12:09:14 : 修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
- 2023/02/15 14:22:24 : 複測申請中 (由 組織帳號 更新此狀態)
- 2023/02/15 14:24:49 : 確認已修補 (由 Pichu Chen 更新此狀態)
- 2023/02/19 03:00:08 : 公開 (由 HITCON ZeroDay 平台自動更新)
詳細資料
- ZDID：ZD-2023-00052
- 通報者：PichuChen (Pichu Chen)
- 風險：中
- 類型：資訊洩漏 (Information Leakage)
參考資料
OWASP 漏洞說明 (Top 10 2017 - A3 Sensitive Data Exposure)
https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure
CWE-200 漏洞說明
https://cwe.mitre.org/data/definitions/200.html
相關網址
敘述
Vulnerable Report
Ragic Data Leakage Vulnerability
Vulnerability Description
This data leakage vulnerability that allows an attacker scan database data with a known org. name, form name and form id without authentication.
Vulnerability Details
Sent a HTTP request to
https://www.ragic.com/org_name/tab_name/form_id/record_id/action/0org_name is the name of the organization, it can't be changed, so someone like departed empoloees will know it.
tab_name is simalar to database name in Relational Database Management System, it can defined by user, and if no any alpahnum in the string, it will be forms, forms1 ... by default. it can't be change too. If user use the template for creating table, the default name of HR Data (人資) is "ragicforms4", and Wage Management (薪酬管理) is "ragicforms39".
form_id is a number, it is start from 0, and has default number if you use template, for example, Person Data (人事資料表) will be 20010.
record_id is a number, it is start from 0. and it is by sequence.
So if you know the org_name, tab_name, form_id and record_id, you can scan the database data without authentication.
https://ap9.ragic.com/org_name/ragicforms39/20010/0/action/0
https://capture.dropbox.com/465i01Sms5iyJgH9
Proof of Concept
go run main.go -org mobagel -tab forms2 -form 1And you will got the result.
修補建議
存取資源時應驗證權限
紀錄ID應亂數生成，盡可能擴大位址空間避免掃描