A vulnerability in youxin can cause Intranet roaming (involving a large amount of internal Sensitive Information)

A vulnerability in youxin can cause Intranet roaming (involving a large amount of internal Sensitive Information)

It only proves that the vulnerability exists.
Are you still recruiting security personnel?

There are many problems. There are no restrictions on the mailbox system, and the number can be scanned and cracked; there are no restrictions on multiple backend, And the mailbox and other background uniform authentication, so you can roam multiple systems. The email contains multiple system passwords, such as the VPN password and IDC office network structure, which leads to intranet roaming.


I. weak passwords in multiple mailboxes. For details, refer to the list.

Https://mail.youxinpai.com

User name/Password
 

Mask Region

  
   *****uxin.**********hu/ux**********ing/a**********2/ux**********hi/ux**********uxin.**********ng/ux**********ei/ux**********bc.1**********uxin**********g/ux**********/uxi**********ng/ux**********/uxin**********n/uxi**********g/uxi**********/uxin**********a/uxi**********/uxi**********2/ab**********n/ux**********uxin**********uxin**********/uxin**********n/ux**********/uxi**********ng/uxi**********3/uxi**********n/ux**********/uxi**********g/ux**********1/ux**********ng/uxi**********n/uxi**********/uxin**********an/ux**********ue/ux**********ng/uxi**********g/ux**********in/ux**********/uxin**********n/uxi**********hu/u*****
  

In fact, there are more weak passwords. Please check them yourself.


2. the OA system may disclose the organizational structure and contact information of all employees.
 

 

Iii. Major business backend (because it is the same password as the email, even cracking is saved)
 

 

 

4. A large amount of sensitive information (for areas without human bypass, ask wooyun Jun to help with human bypass)
 

 

 

 

5. VPN (Unified VPN password and mailbox .......)
 

 

 

 

6. I always thought this guy was an O & M engineer and was engaged in security for half a day...
 

Solution:

You are so awesome in security, I believe he can solve it.