https://blog.leosheu.com/tags/vulnerability/Recent content in Vulnerability on Leo Sheu 的日常筆記Hugo -- gohugo.iozh-twSun, 28 Aug 2022 00:00:00 +0000https://blog.leosheu.com/p/%E6%BC%8F%E6%B4%9E%E5%9B%9E%E5%A0%B1-%E5%81%A5%E6%AA%A2%E4%B8%AD%E5%BF%83%E9%86%AB%E7%99%82%E8%B3%87%E6%96%99%E5%AD%98%E5%8F%96%E6%8E%A7%E5%88%B6%E7%BC%BA%E9%99%B7/Sun, 28 Aug 2022 00:00:00 +0000https://blog.leosheu.com/p/%E6%BC%8F%E6%B4%9E%E5%9B%9E%E5%A0%B1-%E5%81%A5%E6%AA%A2%E4%B8%AD%E5%BF%83%E9%86%AB%E7%99%82%E8%B3%87%E6%96%99%E5%AD%98%E5%8F%96%E6%8E%A7%E5%88%B6%E7%BC%BA%E9%99%B7/<p><img class="gallery-image" data-flex-basis="169px" data-flex-grow="70" height="548" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.leosheu.com/p/%E6%BC%8F%E6%B4%9E%E5%9B%9E%E5%A0%B1-%E5%81%A5%E6%AA%A2%E4%B8%AD%E5%BF%83%E9%86%AB%E7%99%82%E8%B3%87%E6%96%99%E5%AD%98%E5%8F%96%E6%8E%A7%E5%88%B6%E7%BC%BA%E9%99%B7/mornjoy-1.png" width="386"></p> <h3 id="敘述">敘述 </h3><p>做完健康檢查後，在網站上登入後查看報告時，發現有個報告書下載的功能。</p> <p><img class="gallery-image" data-flex-basis="385px" data-flex-grow="160" height="585" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.leosheu.com/p/%E6%BC%8F%E6%B4%9E%E5%9B%9E%E5%A0%B1-%E5%81%A5%E6%AA%A2%E4%B8%AD%E5%BF%83%E9%86%AB%E7%99%82%E8%B3%87%E6%96%99%E5%AD%98%E5%8F%96%E6%8E%A7%E5%88%B6%E7%BC%BA%E9%99%B7/mornjoy-2.png" srcset="https://blog.leosheu.com/p/%E6%BC%8F%E6%B4%9E%E5%9B%9E%E5%A0%B1-%E5%81%A5%E6%AA%A2%E4%B8%AD%E5%BF%83%E9%86%AB%E7%99%82%E8%B3%87%E6%96%99%E5%AD%98%E5%8F%96%E6%8E%A7%E5%88%B6%E7%BC%BA%E9%99%B7/mornjoy-2_hu_b1f6e610d0b34be4.png 800w, https://blog.leosheu.com/p/%E6%BC%8F%E6%B4%9E%E5%9B%9E%E5%A0%B1-%E5%81%A5%E6%AA%A2%E4%B8%AD%E5%BF%83%E9%86%AB%E7%99%82%E8%B3%87%E6%96%99%E5%AD%98%E5%8F%96%E6%8E%A7%E5%88%B6%E7%BC%BA%E9%99%B7/mornjoy-2.png 939w" width="939"></p> <p>下載完成後是一個PDF檔，這時發現下載網址後有個 <code>bid</code> 的參數。</p> <p><img class="gallery-image" data-flex-basis="932px" data-flex-grow="388" height="198" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.leosheu.com/p/%E6%BC%8F%E6%B4%9E%E5%9B%9E%E5%A0%B1-%E5%81%A5%E6%AA%A2%E4%B8%AD%E5%BF%83%E9%86%AB%E7%99%82%E8%B3%87%E6%96%99%E5%AD%98%E5%8F%96%E6%8E%A7%E5%88%B6%E7%BC%BA%E9%99%B7/mornjoy-3.png" width="769"></p> <p>看起來 <code>bid</code> 的參數是有規律且有序的，此時嘗試修改不同的數值嘗試發起 request，發現可以正常取得 PDF 報告書。</p> <p><img class="gallery-image" data-flex-basis="496px" data-flex-grow="206" height="523" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.leosheu.com/p/%E6%BC%8F%E6%B4%9E%E5%9B%9E%E5%A0%B1-%E5%81%A5%E6%AA%A2%E4%B8%AD%E5%BF%83%E9%86%AB%E7%99%82%E8%B3%87%E6%96%99%E5%AD%98%E5%8F%96%E6%8E%A7%E5%88%B6%E7%BC%BA%E9%99%B7/mornjoy-4.png" srcset="https://blog.leosheu.com/p/%E6%BC%8F%E6%B4%9E%E5%9B%9E%E5%A0%B1-%E5%81%A5%E6%AA%A2%E4%B8%AD%E5%BF%83%E9%86%AB%E7%99%82%E8%B3%87%E6%96%99%E5%AD%98%E5%8F%96%E6%8E%A7%E5%88%B6%E7%BC%BA%E9%99%B7/mornjoy-4_hu_c443db8393ee70d5.png 800w, https://blog.leosheu.com/p/%E6%BC%8F%E6%B4%9E%E5%9B%9E%E5%A0%B1-%E5%81%A5%E6%AA%A2%E4%B8%AD%E5%BF%83%E9%86%AB%E7%99%82%E8%B3%87%E6%96%99%E5%AD%98%E5%8F%96%E6%8E%A7%E5%88%B6%E7%BC%BA%E9%99%B7/mornjoy-4.png 1082w" width="1082"></p> <p>此存取控制缺陷的漏洞會造成可以取得他人的健檢報告資料。</p> <p><img class="gallery-image" data-flex-basis="296px" data-flex-grow="123" height="608" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://blog.leosheu.com/p/%E6%BC%8F%E6%B4%9E%E5%9B%9E%E5%A0%B1-%E5%81%A5%E6%AA%A2%E4%B8%AD%E5%BF%83%E9%86%AB%E7%99%82%E8%B3%87%E6%96%99%E5%AD%98%E5%8F%96%E6%8E%A7%E5%88%B6%E7%BC%BA%E9%99%B7/mornjoy-5.png" width="751"></p> <h3 id="相關網址">相關網址 </h3><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback"><span class="line"><span class="cl">https://medirep.mornjoy.com.tw/Login/Index </span></span><span class="line"><span class="cl">http://medirep.mornjoy.com.tw/siteadmin/Print?bid=_{Id}_ </span></span></code></pre></td></tr></table> </div> </div><h3 id="時間軸">時間軸 </h3> <blockquote> <p>2022/05/30 - 提交漏洞<br> 2022/06/02 - 通報未回應 (由 HITCON ZeroDay 服務團隊)<br> 2022/06/07 - 複測已修復 (by Leo)<br> 2022/07/30 - 公開</p> </blockquote> <p>回報於 <a class="link" href="https://zeroday.hitcon.org/vulnerability/ZD-2022-00376" target="_blank" rel="noopener" >HITCON ZeroDay：晨悅預防醫學機構 醫療資料存取漏洞</a></p> <hr> <h3 id="reference">Reference </h3> <blockquote> <p><a class="link" href="https://portswigger.net/web-security/access-control" target="_blank" rel="noopener" >Access control vulnerabilities and privilege escalation | Web Security Academy</a></p> </blockquote>