Sina Weibo cross-origin hijacking vulnerability and repair solution

 

Brief description:

An interface of Sina Weibo has the cross-origin hijacking vulnerability. You can use this interface to use some important functions of Weibo.

Detailed description:

The IM function interface of the new version of Weibo has security risks and does not prevent json hijacking. At the same time, Access-Control-Allow-Origin :*, as a result, HTML5 browsers can perform any cross-origin AJAX operation on this interface.

Proof of vulnerability:

1. Get the clientid in JSON data through a fixed URL

Www.2cto.com

Http://3.58.web1.im.weibo.com/im? Message = % 5B % 7B % 22 version % 22% 3A % 221.0% 2C % 22 minimumVersion % 22% 3A % 22% 220.9% 2C % 22 channel % 22% 3A % 22% 2 Fmeta % 2 Fhandshake % 22% 2C % 22 supportedConnectionTypes % 22% 3A % 7B % 220% 3A % 22callback-polling % 22% 7D % 2C % 22id % 22% 3A1% 7D % 5D & jsonp = parent.org. cometd. script. _ callback1 & 1316600927500

 

Http://3.58.web1.im.weibo.com/im? Message = [{"version": "1.0", "minimumVersion": "0.9", "channel": "/meta/handshake", "supportedConnectionTypes": {"0 ": "callback-polling"}, "id": 1}] & jsonp = parent.org. cometd. script. _ callback1 & 1316600927500

 

2. Construct Request Parameters Based on clientid to obtain chat records or send Group private messages.

 

Solution:

 

1. Get the clientid URL and add the random token

 

2. Access-Control-Allow-Origin Cross-Origin settings set Sina trusted Server

 

3. Add the while (1) header to the json data format to prevent JSON hijacking.

Author: rayh4c