2014-03-20：细节已通知厂商并且等待厂商处理中
2014-03-24：厂商已经确认，细节仅向厂商公开
2014-04-03：细节向核心白帽子及相关领域专家公开
2014-04-13：细节向普通白帽子公开
2014-04-23：细节向实习白帽子公开
2014-05-04：细节向公众公开
描述引用猪猪侠，“大公司常有的诟病，随处可见的安全隐患，任意一个小问题都能引发企业安全的崩盘。” 淘宝！我这个能在500万奖励计划里吗？
详细说明：当数据库、自动化攻击工具和最重要的无任何安全控制的接口融合在一起的时候，就发生了本次安全事件。
现阶段的安全测试更多的还是倾向于pc端的web安全，本次测试中无意中发现阿里巴巴移动端与web端相比存在多处安全问题。
问题描述
http://yunpan.alibaba-inc.com/
当我通过搜索引擎获得该URL的时候，随便翻了翻没发现什么问题
于是便修改useragent
于是刷新页面便切换到手机端UI
通过多次测试发现，该登录接口无登录次数、验证码等限制，这样我们就可以使用自动化工具和利用网络上泄漏的众多数据库fuzz。下面为实际测试结果，下面以C**N数据作为测试
测试结果还是很丰盛的，利用网上泄漏的数据库，我平均每小时能成功跑出1万条用户和密码，每天至少可成功fuzz出24万条淘宝用户帐号密码。
444107746@qq.comaaa3900983
flyhunterl@vip.qq.comhunterl6628096
yangbeck@163.combeck13579barry
wgq_779345@msn.com13818216040
376575738@qq.com19860922
158654729@qq.comqinboao123
gnpp-bo@163.com13929806789
394706198@qq.com3062202123
zxzx12561256@163.comzxzx1256
lpwwg@163.comlpwwg000217
360580804@qq.comhaoran070407
82688823@qq.comlxkKXL1984
464053393@qq.comlq63285009
jialin_happy@yeah.net212126lj
jay0zhou07@163.comjay0zhou07
bocjngg@126.comgg731206
zy8782925@163.com19861018a
zhulinsx@126.comzhulin1224
635009132@qq.comk87177015
zhaoyuqiang2009@163.com23261537
857714526@qq.comdy15995843315
a411951490@126.comlu201314
476537651@qq.com258258259
270086896@qq.comhy8518515
116689095@sohu.com15243670000
mifeisite@163.commxc9723045
xxx002mm@163.comxyx032711
314357615@qq.com357793530
htx@wxhtx.comwxhtx8989
252519574@qq.comyanda1983531
hh_jss@163.comwanghuijie
lingdianai@gmail.com123456ok
389007564@qq.com320whimer
qq423133388@163.comkaixin1314
zcs19870320@yahoo.com.cn29432534
455783487@qq.comw137059032
zhaodonghua.hi@163.com3589167468
zulal912@yahoo.com.cndilruz5815
zdx196906@126.com19690618
164382679@qq.comyt19870411
manvkai3780@sina.com111911mayan
1135725628@qq.comzwp9191112
budaiwawacpy@126.comwoaibeyound
yingxiong2888@126.com724473855wu
273608743@qq.comhin13420268636
168592151@qq.com168592151
jinxingtao@yahoo.cnjinxingtao
newheaven@qq.com55070707
andorr@163.coma.22051648
xuzhiyong_2000@163.com19810423
120140833@qq.coma5889123
sxz1955@sina.com19550910
lqh1988@foxmail.comlqh7758258
zmkimi@gmail.comzm3755986
forever-love271441@163.com5512335wl
colin.wyl@gmail.comwoct1217
zhujiaguang_0@163.comzjg486526
qtyeliming@sina.comzx123456
ziyunhongchen@yahoo.com.cnsyf998281
gufeng_0809@qq.comqq5311322
hhh_888111@163.coma123654789
fengshuo9@163.com13864527763
wy_81_11_14@163.com19811209wy
690063350@qq.comjscyl3889477
iverson881017@126.comiverson881017
435713631@qq.comy86639939k
564644045@qq.com12041016
806824536@qq.comHUANGSHENG
26579018@qq.comlh19830311
xufanggogo@163.comxufang1018*
zhanglingfeng-1@163.com200320444
463355090@qq.comlijunshuai
cjm871122@163.comchan1987
pestdong@sohu.com771025
panshilin@sina.compsl161912
0031114@163.comyidan0031114
zhyqing@yahoo.com.cn9801050808
lyham078@hotmail.com777ly777
358353959@qq.comdbsj19870919
372046752@qq.comlong5201203
sunyuzhao09@163.comsunyuzhao123
103395991@qq.com20081003
telex1978@sina.com19781111
358217818@qq.comfxj19900307
bluemoon2008@126.comhappy2000
yoyop@vip.qq.comemilymicky900309
yesosky@163.comyesosky810816*
aoke9601@sohu.comfairydream
439545554@qq.com056198lin
ruanfengsheng@163.comfjlyrfs5
xianglin_vigi@sina.comxianglin1020
123zs@live.cnzs3494451
zhangwei8752969@163.com378294113
413232952@qq.comluowenbo6366691
zq12377@sina.com19880215
zjnuist@126.comzjnuist2564446
tenni0@126.com990162tennis
jlp10735@126.com1042888680jlp
aotemanlive@qq.com19831014
jidequana8@163.com55643212
leaf9212@126.com19850921
jiuxiaoyinlong@yahoo.com.cn19830413
729788135@qq.comwanglihua174
374966034@qq.comqq84890405
hyj_0111@163.comwww.521hcx.com
rgl387680455@sina.comrgl87576508
tansy670@sina.comtsy811006
yugang2006@gmail.comqinqin0628
lovemyremember@yahoo.com.cnyv251406
593978632@qq.comkai520tao
cqxiewei@163.com19510626
songyingjie2460@163.com48001154
keyl9j@vip.qq.comqwe123qwe123
lqldlove@163.comlq198527
380579369@qq.com987456321qw
xinqiao816@126.comxinqiao81622556
110389151@QQ.com880321wsx
wazwfxln@163.comwangao123
mcwxx001@gmail.com015072mcw
812454276@qq.comzuiainuonuo
a000000g@126.comag000000
407790089@qq.comasd82145502
yangningshang@126.comning118712
etone2005@126.com19840221
97121443@qq.comming5201314
hu8808@163.com44415102
413449300@qq.comjiangzihao
zhaofeng888@163.com13832926240
longshecao06@yahoo.com.cnwec19801213
liyin1022@sina.com20011014
longcky2005@163.comwgejpedx
413492801@qq.comchenqiang241132
zjhywmf@163.com21103243
ywzayc@163.comywz12315
383192753@qq.comymx19911104
365179937@qq.com13738193085
270703001@qq.coma8127761
king.jmh@gmail.comjmh8906146
zhengpin001@yahoo.cn1986724168
49448881@qq.com1110100154
dongshui4@sohu.com19781978
123423374@qq.comye7758521
cjpkk@21cn.com37132510
421584998@qq.com110dd9gMYTH
472744173@qq.com1989425a
slyfx@126.com1046108781
125760706@qq.comdc_3q_you
wfc88888@yahoo.com.cnwfcwfcwfc
zhengyp@vip.qq.comz3811236
353375411@qq.com353375411a
306261835@qq.com306261835
741179788@QQ.COMCANDY5201314
13570235512mzh@163.com13570235512
zhongguo8808@yahoo.com.cnlcm811028
lovecc_hi@126.com685210808
382722417@qq.comlch19891221
dylyb618@163.com54618lyb
jack_589@hotmail.comz5887179
frenkiess@eyou.comewsd1240
aiwuyong@gmail.comwindows@@
gudouyb@126.comlehaotian
tangyan129623@163.comtangyan129623
334644705@qq.comjl4394796
27437795@qq.com27437795
651539675@qq.com19871111abc
kakino_1@163.com105963hn
eem200001@163.com24543701
qhbdfem@163.comqhb770319
851158276@qq.com13891890930
LIUWENHU2007@YAHOO.COM.CN19670925
zhengyaolian_123@yahoo.cn985613zyl
841232047@qq.comlhy03061989
only_calbee@163.commissxiao0316
springpp@qq.com811108asd
oicy@vip.qq.com1986922zq
cmxiaotang@163.com000ty000
gjqq_0824@163.com0824hhh22
liuziyang19880224@163.com6789625a
zhangjinsheng19830@163.com19841203
ftdd94@126.comxfj890805
258264953@qq.comwoaiwow123
sl522@163.comsunlei522
wangjie_5961@126.com275410424
516018873@qq.com92690930/*
747513444@qq.comfree19870301
wangxiangzhen33@163.com54762755
sifengruoshui@163.comzuo3815500
7081650@qq.comq7812679
bokaitjucareer@gmail.comdangvnbk8625
187140608@qq.comzxcvbn04060413
ld_msk@sina.comxlh720905
hackercia007@vip.qq.com779aaccX&
981325285@qq.comfslovessj
471769390@qq.comq79082424
130030700@qq.com8690102387
z_w_sandal@hotmail.comcaoxie1980
wl_cuit@163.comwl461245
qqqqa_q@126.comzhang1229
yaomin1128@163.com60DONGRUI55HUA
w15943323369@yahoo.com.cnw4213100
hejiaxie@126.com008300*/qq
124883206@qq.com66501772
minghua1841@163.comminghua1841
changchengxzy@yahoo.com.cn042477aa
xiyangxixia_2007@163.comxiyangxixia.2007
82072267@163.com88095887
youlei202@yahoo.com.cn19890715
chenmsheng@163.comchen0709
419150247@qq.comkevin1224
rexkissdream@163.comlzy5335566
296489929@qq.com0575zzcsama
wangzhenghua@mail.bnu.edu.cn19900230
zzhangbaoqiang@163.comzhangbaoqiang
threestonezl@163.comxx100200
iweboys@163.comasp2923344
304512281@qq.com19870424liling
luohaifeng19870914@yahoo.cn13578923465
53309733@qq.comjy01784593
zhonghualin.2008@163.comz5823209
lxycpcplxy@163.comlxy213112
114574672@qq.comzyq13791382716
hehe__dong@126.com19871222
228834351@qq.comchenjun83716
sh722@126.commsh..722
woailinux.cool@163.comxsz=89732118
jwzhao@mail.tmedi.com.cnzjwcyx001
sichuanadu@163.comp0o9i8u7
zouliyan_2003@sina.comzlyqgf3018
354683020@qq.comwoaixianga
fengfeng3532@163.com19860306x
bjwqt_0_0@sina.com1qaz2wsx
fengyutian555@126.com13572593208
lvpenglv1234@163.comlv1987328
153236799@qq.commengyuan031047
guojigj_2233@163.com127158xw
derekli992@yahoo.com.cn19990603
lele43@sina.comleleqq@www
373916248@qq.comcwd850623
1741335@qq.comcl77413cl
zhangzhenjiecumt@126.comzzj19870228
robbin059@21cn.comrobbin3223059
qiming880122@sina.comkobe98allen83lqm
liu88433491@163.com88433491
806118795@qq.comzhoujin074888
liu.chun.jiang.1@163.comyou666666
lj0120@qq.comlj520731
liweipiaoliang@163.comywlw117331
huanghuirainy@163.com410228love
jimmyliu007@163.com19821121
lurenjiaddlg@sina.comtxzlovespz
makubex19850306@163.com13793281378
hongyuan.zhu@163.comzhuhongyuan123
zms1984624@yahoo.com.cnzms19840624
yzhe@people.com.cnjsbkyy000
white81_gis@yahoo.com.cnb5q10z10
663592903@qq.com1314520zml
lj19888888@163.comwsdy1988
luofan923@163.com1295212251
Alizee_bao@hotmail.comBaojie00
850006680@qq.comlk6995007
kuailezizai123@163.com23111811
gsx-168@163.comgsx121618
renjianweiaini@126.com19868299912
kongchao1983@163.coma19830922
gynnx@163.com1331695274gy
263768209@qq.comsbb13776668338
905238839@qq.com5211314*
820937242@qq.comlily841218
haoweieee3207362@163.com15153207
wilwar3@126.com7124112icbc
abcd16069@163.com19820330
blueskywml@126.comwml13098999088
wangsicong1116@126.com12345asdf
jk118cn@yahoo.com.cn16232591
tdyx1985@sina.com.cnxjn342623
xuzhenkui1234@yahoo.com.cnhhxcttxs
crliqinlong@qq.comliqinlong
jtcw@163.compx07925226288
fzc82@sina.comfuzhichao0
442885851@qq.com13679084882xx
nmgchengwenjie@sina.com123qwe123
406517246@qq.com10197891417
756361153@qq.comfsw176221
343080460@qq.com1989519s
592512924@qq.com13132829123
215983122@qq.coma13936506144
wang19920226@163.com86226320
lxbljw68@163.comlxb810223
jiaxinbing2009@126.com7736269wo
1007287241@qq.comA1022575
403612678@qq.COMcan988512
444960684@qq.comw198626xd
396369767@qq.com8sa796e5
409080901@qq.comlh8181189
lnxq1986@126.comxq7700675
346563659@qq.comhanhanhan123
sunfeedy@163.comj1981924
ttu4545cl@163.comwea4360501
ruizhibest@gmail.comliruizhi
qujun747@eyou.com58457520
wyqschumi@163.comwyq19890402
alin87111@163.coma5s8d7f9f9
hzsjbzdjj@163.comhzsjbzdjj
waj111.cool@163.comwangaijian
zhaowei1987123@163.comzhaob311b
630922774@qq.com19890816
huangyuan44519@163.com89101920
jswl8888@qq.comqwqw1222
cissy_sx@163.com218322love1228
276221811@qq.com7586312mwmd
3832210@sina.comwwq3832210
easypaycard@vip.qq.comabc198593
xiedan315200@qq.com13896315200
orangecxy@sina.comyinyinty6h1eyy3n
263538636@163.comwxs092123
sqxxlhq118@sina.com43625809
zhangyongli7@126.com254551224
1046140301@qq.comwenquan2699
236180133@qq.com236180133
zzibm@163.comwangyang721
317939363@qq.com52youyou
mafeiyan2008@yahoo.cn2008070101
1776643@qq.comzxczxc01
liu770826@hotmail.comtony770826
wang_da_bo@126.com322867ok88wdb
3425090@qq.comwoaini521
liyaochange@126.comliyaolinux*2
www.529170389@qq.coma1234567
1149146316@qq.comzxxccc1224
liliangping19851016@126.comliang1016
hudianjun359@126.com521lyf...
135936293@qq.comIL0VEYOU
aidexuanlv@126.comwd5211314
hrgs_521@sina.comhrgs_521
yhao19841031@sina.com965364asd
duanjun1984@qq.comxian3599
352382935@qq.comTao880410
vabene2008@yahoo.com.cnrourou419
yangxiumei726@yahoo.cnyxm1988726
lxw800506@163.comlxw422129
anpei88@163.com2514038mmm
510344255@qq.comhanmeng123
522253343@qq.comkandysfj
yhf1027@126.comjunlei1027
liyanxinhong@126.com4292457hua
liuqing.0121@163.comliuqing520shan3
bluecoffee_123@163.comwanghaoqq36
yuanpengxu1@126.com3235561635
hui.junqing@163.comqweasd24865
joeyvercetti@sina.com5566energy
likelei3@126.comray180125
lwllh0104@sina.comllhlw0104
280376383@qq.comsdssdn7517
xiren1331@163.com980516ww
zhangyumin39@163.com147258369
ashley-jack@hotmail.comshirong520*
565625632@qq.comzq123456
yuanmeijie99@126.comyuan200856
lp9313@163.com19830205
352622654@qq.comqiongo16739
469933891@qq.comMRJpo7282101
xmcjf646589@sina.comxmcjf06190224
huangyisuxing@163.com102921763
hth18@163.com31415926
714025967@qq.comjianwei0906
sunjun728@tom.com19730728
sunweinibang@126.comsunwei2771617
729471203@qq.comwo27119360
houjie19860614@126.comh19860614
ybb35789@sina.comsuzhen1103
spring4231107@126.comchunchun4
ck23@163.comkevin64116
jlyysxiaoyan@163.comjlyysxiaoyan87
sandyj1984@gmail.comsamjevons1984
794634258@qq.comwtq13758157344
abcabc199@qq.comabc7770314
lysun123@163.comlvyusong123456
lw7561@sina.comqazse19850128
neo_lion@qq.comb1m2g3d4
61921623@qq.comspider2006
370311051@qq.com31415926
kxzzyl@163.com694685521
33313115@qq.combread790203
dmfs_616@163.comgh616008
lsj890130@126.comlsj890130
418056086@qq.com19861013mz
413119355@qq.comliuxvying987827
532965332@qq.comchenlei007
zhangjianrun@yahoo.cnshuangru19860707
dbetter@yeah.netdbetter
mingxuemei780625@163.comjhr070407*
jiaopan1124@126.comguagua1124
xiaokeaizhang123@163.com63612815q
343474078@qq.comzhongyang
tsxkkk@163.com361397908
wangzhuan19901209@yahoo.cn454676067
lidoudou929@163.comlidoudou12
346486236@qq.com3209097z
caoyitao@yahoo.cncaoyitao
35186853@qq.com031123tjd
1025434264@qq.com19901020number
464687007@qq.com464687007
doitmyself89@163.com1829xiaoxin89
cmandy2132@163.comcm821024
hzjdym2@163.commttqgh123
491788900@qq.comshyh5891
lzlove2008@163.comiwillgo83
jiang934661@163.comiayjte1987
gjjbltdyh@sina.comgjj491654644
wzcsxl_123@126.comwzcsxl123
apple_89078320@126.comxqc890783201989
sijinping@vip.qq.com502279950
185366845@qq.com185366845
ggqwr@126.comworld19880914
bingle1983@126.com19830127
yaohuisct@163.comYHSCT022629
391678015@qq.comyu88044177
hcl87311@yahoo.com.cn37581520
302832826@qq.comyyzly1314521
1003429312@qq.comwzs591216
29932143@qq.com36954007521
951205760@qq.com940908qq
gn153768@126.comgn0209153768
305937006@qq.comlgl198815
405922026@qq.comlj6881156
xyl__@126.comxiangyu0修复方案：
you know it!
版权声明：转载请注明来源 bing@乌云 漏洞回应 厂商回应：危害等级：高
漏洞Rank：15
确认时间：2014-03-24 16:20
厂商回复：感谢你对我们的支持与关注!
最新状态：暂无