cve-2017-5487

1. What is CVE-2017-5487?

: A vulnerability in the REST API implementation in wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in WordPress versions prior to 4.7.1 that does not restrict the list of authors, allowing remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.

( Reference : https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5487 )

If you don't understand what that means, let's first learn about the background knowledge and then explore through practice.

If you think you don't need the background knowledge, you can start from [3].

2. What is REST API?

: Simply put, an API that defines "what to do and how to do it" can be called a REST API.

: More precisely, REST API is about processing resources defined by HTTP URIs using HTTP Methods and Payload.

: REST is an acronym for REpresentational State Transfer.

2.1 Resources defined by HTTP URIs

: A resource refers to the object to be processed.

e.g., JSON, XML documents, image files like jpg, video files like mp4, etc.

: URI stands for Uniform Resource Identifier, which is a unified resource identifier. The URL we commonly see is also a part of URI, referring to the identification of a resource.

e.g., If you can obtain information about a user named test via http://rootable.tistory.com/user/test, this is also a URI.

2.2 HTTP Method

: These methods work the same regardless of the resource format.

: The methods used in REST API include POST, GET, PUT, PATCH, DELETE, etc. Note that they differ from the functions we typically think. For example, while we often think of POST as a method used to request data or documents from a server, in REST API it performs a create function.

• HTTP Method and CRUD Operation Summary

HTTP Method

CRUD Operation

POST

create

GET

read

PUT

update / replace

PATCH

update / modify

DELETE

delete

• CRUD operation is a term that collectively refers to Create, Read, Update, Delete used when computer software processes data.

e.g., REST API to add a user named doni to users at http://rootable.tistory.com

POST http://rootable.tistroy.com/users/doni

e.g., When creating a user, if various attributes like job, age, gender are needed, specify them in the body using XML or JSON

POST http://rootable.tistory.com/users Content-Type: application/json

{

"username" : "doni"

"age" : "27"

}

3. WordPress REST API

: We said REST API is a pre-defined API on how to handle resources. So what REST APIs are defined in WordPress?

Refer to the table below.

Resource Base Route Posts /wp/v2/posts Post Revisions /wp/v2/revisions Categories /wp/v2/categories Tags /wp/v2/tags Pages /wp/v2/pages Comments /wp/v2/comments Taxonomies /wp/v2/taxonomies Media /wp/v2/media Users /wp/v2/users Post Types /wp/v2/types Post Statuses /wp/v2/statuses Settings /wp/v2/settings

You can see various REST APIs are defined. Here we can see /wp/v2/users, which appears in the CVE we are going to explore this time.

4. CVE Exploitation

4.1. Obtaining information about post authors

• Below is code found on EXPLOIT DB. ( https://www.exploit-db.com/exploits/41497/ )

• As you can see from the code, it just neatly organizes the processing result and displays it on the screen. There is no need to go as far as the FU vulnerability just to clean up the display, since you can get the information by directly accessing it without using this exploit code.

#!usr/bin/php

If you save this as a PHP file in the location where WordPress is installed and run it, the result will appear as shown below.

When accessing directly, it appears as shown below. (Click if it's not clear)

Through this, we can obtain information such as the ID and name of the user who wrote the post.

Note) I thought it would show all registered users, but from the test results, it only shows the accounts of post authors. Looking at the CVE description, the word 'author' appears, which seems to mean the writer.

4.2 Obtaining file upload paths

Among the WordPress REST APIs, there is /wp/v2/posts. Accessing it will show information about the posted articles, and among them, as indicated, you can obtain the file upload path. If a FU vulnerability is discovered, it would be very helpful.

• When doing posts, too much information appears, so if that is inconvenient, accessing [/wp-json/wp/v2/posts/20] will only get information about the 20th post.

5. Reference

Even in version 4.7, it seems that viewing settings or editing posts is not possible.

• When trying to view settings, rest_forbidden appears and access is denied.

• When trying to edit the first post, a message saying the post cannot be read appears.

• It would be more significant than viewing users, but it's a bit disappointing.. According to search results, there seems to be no vulnerability for this. However, there appears to be a vulnerability that allows editing other users' posts in versions prior to 4.7.1. This will be covered in the next post.

Reference)

1. REST API explanation : http://blog.naver.com/PostView.nhn?blogId=complusblog&logNo=220986337770

2. Unicode translation : http://koreanstudies.com/unicode-converter.html

3. Downgrade (I recommend not installing from scratch because it didn't work out; I re-installed, so....) : http://www.bbsetheme.co.kr/%EC%9B%8C%EB%93%9C%ED%94%84%EB%A0%88%EC%8A%A4-%EB%B2%84%EC%A0%84-%EB%8B%A4%EC%9A%B4%EA%B7%B8%EB%A0%88%EC%9D%B4%EB%93%9C-%ED%95%98%EA%B8%B0/