Executive brief
WordPress, a popular website management platform, contained a flaw in its REST API that allowed public access to user information. An attacker could use this to list all users who have authored public posts, potentially facilitating targeted attacks or password guessing. This issue was resolved in version 4.7.1.
Technical details
The vulnerability exists in 'wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php' within the WordPress REST API. In version 4.7, the API did not sufficiently restrict the listing of users who had authored public posts, allowing unauthenticated remote attackers to perform username harvesting by querying the 'wp-json/wp/v2/users' endpoint. The fix introduced in version 4.7.1 restricts this listing to only include post types specifically configured to be shown within the REST API. This is a classic CWE-200 (Information Exposure) issue that can be exploited via a simple GET request without any special privileges or user interaction.
Affected products
- WordPress WordPress 4.7 before 4.7.1
Timeline
- 2017-01-11: patched: WordPress 4.7.1 released
- 2017-01-14: disclosed: Public disclosure via oss-security mailing list
- 2017-01-15: advisory: NVD publication date
References
- http://www.openwall.com/lists/oss-security/2017/01/14/6
- http://www.securityfocus.com/bid/95391
- http://www.securitytracker.com/id/1037591
- https://codex.wordpress.org/Version_4.7.1
- https://github.com/WordPress/WordPress/commit/daf358983cc1ce0c77bf6d2de2ebbb43df2add60
- https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance-release/
- https://wpvulndb.com/vulnerabilities/8715