YS Web socket has a horizontal vulnerability, the current user can arbitrarily view other user's alarm information, can cause sensitive information leakage "high"

YS Web SocketThere is a horizontal ultra-vires vulnerability, the current user can arbitrarily view other user's alarm information, can cause sensitive information leakage "high"

Problem Description:

          YS Use timed polling web socket

Test steps:

1. Openburpintercept the agent and starthttprequest interception function.

2. sign in with a normal accountYS(assuming that the current logged-on user is namedOuyy) and intercept the followingWeb Socketrequest to change the user name of the current login account to the user name of some other existing user:

3. Cancelburpof thehttpintercept function, the client will periodically send a polling request to the server to triggerHIKWPFThis account corresponds to the device to alarm, can capture its alarm information:

4. in the returned information can be seen in the alarm pictureURL, in the browser address bar, enter theURL, you can seeHIKWPFAlarm picture of the user's device:

Note: If the user turns on Safe mode, the URL The image you access is encrypted, so you cannot view the contents of the image.

problem Extension:

         Judging from the current situation,WebSocketmodules andWebThe backstage is completely independent, i.e.WebSocketdo not log after user logonSessionstate, which means gettingWeb Socket Sessionthe request and the request to send the poll is not required to bring the user after the loginCookies, therefore, verifying that the problem actually does not require an account that can be legally logged in.

Solution Recommendations:

1. WebSocketmodules andWebbackground to combine, send poll request to carry the current login user authentication afterCookies, throughCookiesto control who the alarm information should be sent to.

Summary: To enter the internet of things industry, to protect the privacy of users is very important, and how to protect the privacy of users need to think a lot, this example is a user privacy disclosure of a typical example.

YS Web socket has a horizontal vulnerability, the current user can arbitrarily view other user's alarm information, can cause sensitive information leakage "high"