Changes between Initial Version and Version 1 of Ticket #47856
- Timestamp:
- 08/09/2019 01:50:51 PM (7 years ago)
Legend:
- Unmodified
- Added
- Removed
- Modified
-
Ticket #47856
-
Property
Status
changed from
assignedtoclosed -
Property
Component
changed from
GeneraltoXML-RPC -
Property
Resolution
changed from
toduplicate -
Property
Milestone
changed from
Awaiting Reviewto
-
Property
Status
changed from
-
Ticket #47856 – Description
initial v1 1 1 ## I found that productivity should be turned off from the beginning or minimized possible harmful functions but it still exists in wordpress.org/xmlrpc.php like Multi brute force and DDoS attack. If you check the data correctly, you will see its search hazard. 2 2 3 1.First with the payload I list the available methods and can be exploited like: 3 4 -wp.getUserBlogs … … 6 7 -system.multicall 7 8 -pingback.ping 8 9 {{{ 9 10 POST /xmlrpc.php HTTP/1.1 10 11 Host: wordpress.org … … 22 23 <params> </params> 23 24 </methodCall> 25 }}} 26 24 27 ## Bruceforce attack 25 28 The first place I can exploit is brute force login! 29 {{{ 26 30 POST /xmlrpc.php HTTP/1.1 27 31 Host: wordpress.org … … 42 46 </params> 43 47 </methodCall> 44 48 }}} 45 49 3. Now I can easily log in with different methods by available methods, and I can write a code to attack it with the existing user and password. That will take a lot of time but will have results. It can happen faster when you read my third item !!! 46 50 … … 50 54 The intend of Pingback is to notify a site that you link to about the link hoping that the site you are linking to will return the favor. Some systems automate this and maintain automated lists linking back to sites that covered their article. In order to implement pingback, WordPress implements an XML-RPC API function. This function will then send a request to the site to which you would like to send a "pingback". 51 55 However, an attacker can take advantage of it to walk around DDos attacks that affect the service. 56 {{{ 52 57 POST /xmlrpc.php HTTP/1.1 53 58 Host: wordpress.org … … 67 72 </value></param></params> 68 73 </methodCall> 69 74 }}} 70 75 ##Multicall 71 76 This increases the attack capability of methods, for example when attacking bruteforce 72 77 The vulnerability can easily be abused by a simple script to try a significant number of username and password combinations with a relatively small number of HTTP requests. The following diagram shows a 4-fold increase in login attempts to HTTP requests, but this can trivially be expanded to a thousand logins. 73 78 {{{ 74 79 POST /xmlrpc.php HTTP/1.1 75 80 Host: wordpress.org … … 120 125 </params> 121 126 </methodCall> 122 127 }}} 123 128 What about combining it with some other way? For pingback methods, for example. It increases time and danger !! 124 129 During testing, I was able to call the method wp.getUserBlogs 1,000 times in a single HTTP request (limited only by PHP memory issues). If a user creates a simple shell loop that executes one thousand times and runs a PHP script that crafts an HTTP request with one thousand method calls all requiring authentication, then that user would be able to try one million unique logins in a very short period of time. 125 130 126 This makes brute forcing the login very fast and can run down a pretty large wordlist in a short period of time. Also note that the wp.getUserBlogs method isn’t the only RPC call requiring authentication. It’s possible to use any RPC method which requires authentication to attempt logins and brute force the Word press credentials.131 This makes brute forcing the login very fast and can run down a pretty large wordlist in a short period of time. Also note that the wp.getUserBlogs method isn’t the only RPC call requiring authentication. It’s possible to use any RPC method which requires authentication to attempt logins and brute force the WordPress credentials. 127 132 128 133 Damage from the above holes is the damage to the remains that need to be patched. You can remove it if not needed. Or minimize the methods that can cause injury as the above methods !!!