{"id":1388,"date":"2011-05-26T09:35:27","date_gmt":"2011-05-26T12:35:27","guid":{"rendered":"http:\/\/www.talsoft.com.ar\/?p=1388"},"modified":"2011-05-26T09:35:27","modified_gmt":"2011-05-26T12:35:27","slug":"talsoft-advisory-security-wordpress-user-id-and-user-name-disclosure","status":"publish","type":"post","link":"https:\/\/www.talsoft-security.com\/site\/talsoft-advisory-security-wordpress-user-id-and-user-name-disclosure\/","title":{"rendered":"Talsoft Advisory Security – WordPress User ID and User Name Disclosure"},"content":{"rendered":"

I. Advisory information<\/h3>\n

Title: WordPress User IDs and User Names Disclosure
\nAdvisory Id: TALSOFT-2011-0526
\nAdvisory URL: http:\/\/www.talsoft.com.ar\/index.php\/research\/security-advisories\/wordpress-user-id-and-user-name-disclosure<\/a>
\nDate published: 2011-05-26
\nVendors contacted: WordPress
\nAuthor: Ver\u00f3nica Valeros<\/p>\n

II. Vulnerability information<\/h3>\n

Class: Insecure Direct Object References (CWE-715)
\nImpact: Low
\nRemotely Exploitable: Yes
\nLocally Exploitable: Yes<\/p>\n

III. Overview<\/h3>\n

WordPress platforms use a parameter called \u2018author\u2019. This parameter accepts integer values and represents the \u2018User ID\u2019 of users in the web site. For example: http:\/\/www.example.com\/?author=1
\nThe problems found are:<\/p>\n

    \n
  1. User ID values are generated consecutively.<\/li>\n
  2. When a valid User ID is found, WordPress redirects to a web page with the name of the author.<\/li>\n<\/ol>\n

    These problems trigger the following attack vectors:<\/p>\n

      \n
    1. The query response discloses whether the User ID is enabled.<\/li>\n
    2. The query response leaks (by redirection) the User Name corresponding with that User ID. (See update for version 3.1.3)<\/li>\n<\/ol>\n

      User IDs can be disabled, leaving holes within the consecutive numbers. Therefore, when an invalid User ID is sent, no redirection is done and no information is disclosed.<\/p>\n

      Also, the attack can be automated, sending multiple queries to extract valid User Names and User IDs from the vulnerable web sites.<\/p>\n

      Update:<\/em><\/p>\n

      In version 3.1.3 the redirection explained in the second attack vector is not done, but is still possible to find the User Name in the source code. Therefore, this version is still vulnerable.<\/p>\n

      IV. Affected versions<\/h3>\n

      This issue was tested in versions 2.6, 3.1, 3.1.1, 3.1.3 and 3.2-beta2. Other versions were not tested and may be vulnerable.<\/p>\n

      V. Non affected versions<\/h3>\n

      Unknown.<\/p>\n

      VI. Proof of concept<\/h3>\n

      A Proof of Concept (PoC) is available at: wp-userdata-disclosure-PoC.py.tar.gz<\/a><\/p>\n

      VII. Solution<\/h3>\n

      WordPress version 3.1.3 fixes the redirection problem, but user names are still been disclosed in the HTML code. No solution was provided for this last problem.<\/p>\n

      VIII. Disclosure timeline<\/h3>\n
        \n
      • 2011-03-14:\n
          \n
        • Vulnerability was identified.<\/li>\n<\/ul>\n<\/li>\n
        • 2011-05-11:\n
            \n
          • WordPress security team was contacted.<\/li>\n<\/ul>\n<\/li>\n
          • 2011-05-12:\n
              \n
            • WordPress confirmed the vulnerability.<\/li>\n<\/ul>\n<\/li>\n
            • 2011-05-25:\n
                \n
              • WordPress released version 3.1.3, which included a fix for canonical redirection problem but did not included a fix for the source code problem.<\/li>\n
              • WordPress security team was informed that after the release of version 3.1.3 the vulnerability was still exploitable.<\/li>\n
              • WordPress team agreed to release the security advisory.<\/li>\n<\/ul>\n<\/li>\n
              • 2011-05-26:\n
                  \n
                • The advisory was released.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n

                  IX. Credits<\/h3>\n

                  This vulnerability was discovered and reported by Ver\u00f3nica Valeros (veronicavaleros at talsoft.com.ar)<\/p>\n

                  X. Disclaimer<\/h3>\n

                  The information provided in this document is for information purposes only. Talsoft S.R.L. accepts no responsibility for any damage caused by the use or misuse of this information. The content of this advisory may be distributed freely, provided that no fee is charged for this distribution and proper credit is given.<\/p>\n

                  XI. About Talsoft S.R.L.<\/h3>\n

                  Talsoft S.R.L is a growing company with the mission to provide solutions in the following areas:<\/p>\n

                    \n
                  • Information Security<\/li>\n
                  • Technology administration<\/li>\n
                  • Open source solutions<\/li>\n
                  • Trainings and courses<\/li>\n<\/ul>\n

                    Talsoft S.R.L. is also involved in many information security research projects.<\/p>\n

                     <\/p>\n","protected":false},"excerpt":{"rendered":"

                    I. Advisory information Title: WordPress User IDs and User Names Disclosure Advisory Id: TALSOFT-2011-0526 Advisory URL: http:\/\/www.talsoft.com.ar\/index.php\/research\/security-advisories\/wordpress-user-id-and-user-name-disclosure Date published: 2011-05-26 Vendors contacted: WordPress Author: Ver\u00f3nica Valeros II. Vulnerability information Class: Insecure Direct Object References (CWE-715) Impact: Low Remotely Exploitable: Yes Locally Exploitable: Yes III. Overview WordPress platforms use a parameter called \u2018author\u2019. This parameter accepts […]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-1388","post","type-post","status-publish","format-standard","hentry","category-profesional"],"yoast_head":"\nTalSoft - Seguridad Inform\u00e1tica Empresarial - Talsoft Advisory Security - WordPress User ID and User Name Disclosure<\/title>\n<meta name=\"description\" content=\"Talsoft transforma la visi\u00f3n de las empresas para que puedan proteger su informaci\u00f3n cr\u00edtica y confidencial frente ataques inform\u00e1ticos. Cons\u00faltenos sin cargo.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.talsoft-security.com\/site\/talsoft-advisory-security-wordpress-user-id-and-user-name-disclosure\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Leandro Ferrari\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.talsoft-security.com\/site\/talsoft-advisory-security-wordpress-user-id-and-user-name-disclosure\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.talsoft-security.com\/site\/talsoft-advisory-security-wordpress-user-id-and-user-name-disclosure\/\"},\"author\":{\"name\":\"Leandro Ferrari\",\"@id\":\"https:\/\/www.talsoft-security.com\/site\/#\/schema\/person\/83d2ebde035a5a030c14e522351953c8\"},\"headline\":\"Talsoft Advisory Security – WordPress User ID and User Name Disclosure\",\"datePublished\":\"2011-05-26T12:35:27+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.talsoft-security.com\/site\/talsoft-advisory-security-wordpress-user-id-and-user-name-disclosure\/\"},\"wordCount\":508,\"publisher\":{\"@id\":\"https:\/\/www.talsoft-security.com\/site\/#organization\"},\"articleSection\":[\"Profesional\"],\"inLanguage\":\"en-GB\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.talsoft-security.com\/site\/talsoft-advisory-security-wordpress-user-id-and-user-name-disclosure\/\",\"url\":\"https:\/\/www.talsoft-security.com\/site\/talsoft-advisory-security-wordpress-user-id-and-user-name-disclosure\/\",\"name\":\"TalSoft - Seguridad Inform\u00e1tica Empresarial - Talsoft Advisory Security - WordPress User ID and User Name Disclosure\",\"isPartOf\":{\"@id\":\"https:\/\/www.talsoft-security.com\/site\/#website\"},\"datePublished\":\"2011-05-26T12:35:27+00:00\",\"description\":\"Talsoft transforma la visi\u00f3n de las empresas para que puedan proteger su informaci\u00f3n cr\u00edtica y confidencial frente ataques inform\u00e1ticos. Cons\u00faltenos sin cargo.\",\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.talsoft-security.com\/site\/talsoft-advisory-security-wordpress-user-id-and-user-name-disclosure\/\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.talsoft-security.com\/site\/#website\",\"url\":\"https:\/\/www.talsoft-security.com\/site\/\",\"name\":\"TalSoft TS - Services IT Security\",\"description\":\"Talsoft is transforming awareness, control and decision-making power so that companies can protect their critical and confidential information from computer attacks.\",\"publisher\":{\"@id\":\"https:\/\/www.talsoft-security.com\/site\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.talsoft-security.com\/site\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.talsoft-security.com\/site\/#organization\",\"name\":\"Talsoft TS\",\"url\":\"https:\/\/www.talsoft-security.com\/site\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.talsoft-security.com\/site\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.talsoft-security.com\/site\/wp-content\/uploads\/2014\/02\/talsoft_logo_270x125.png\",\"contentUrl\":\"https:\/\/www.talsoft-security.com\/site\/wp-content\/uploads\/2014\/02\/talsoft_logo_270x125.png\",\"width\":270,\"height\":125,\"caption\":\"Talsoft TS\"},\"image\":{\"@id\":\"https:\/\/www.talsoft-security.com\/site\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"http:\/\/www.facebook.com\/talsoftsrl\",\"https:\/\/x.com\/talsoft\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.talsoft-security.com\/site\/#\/schema\/person\/83d2ebde035a5a030c14e522351953c8\",\"name\":\"Leandro Ferrari\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.talsoft-security.com\/site\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/cd259c10675b9fd302b2e6264231febeeeb3de578400cf8c91c6577e50a0d34a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/cd259c10675b9fd302b2e6264231febeeeb3de578400cf8c91c6577e50a0d34a?s=96&d=mm&r=g\",\"caption\":\"Leandro Ferrari\"},\"sameAs\":[\"http:\/\/www.talsoft.com.ar\",\"https:\/\/www.facebook.com\/talsoftsrl\/\",\"https:\/\/x.com\/avatar_leandro\"],\"url\":\"https:\/\/www.talsoft-security.com\/site\/author\/leandro\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"TalSoft - Seguridad Inform\u00e1tica Empresarial - Talsoft Advisory Security - WordPress User ID and User Name Disclosure","description":"Talsoft transforma la visi\u00f3n de las empresas para que puedan proteger su informaci\u00f3n cr\u00edtica y confidencial frente ataques inform\u00e1ticos. Cons\u00faltenos sin cargo.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.talsoft-security.com\/site\/talsoft-advisory-security-wordpress-user-id-and-user-name-disclosure\/","twitter_misc":{"Written by":"Leandro Ferrari","Estimated reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.talsoft-security.com\/site\/talsoft-advisory-security-wordpress-user-id-and-user-name-disclosure\/#article","isPartOf":{"@id":"https:\/\/www.talsoft-security.com\/site\/talsoft-advisory-security-wordpress-user-id-and-user-name-disclosure\/"},"author":{"name":"Leandro Ferrari","@id":"https:\/\/www.talsoft-security.com\/site\/#\/schema\/person\/83d2ebde035a5a030c14e522351953c8"},"headline":"Talsoft Advisory Security – WordPress User ID and User Name Disclosure","datePublished":"2011-05-26T12:35:27+00:00","mainEntityOfPage":{"@id":"https:\/\/www.talsoft-security.com\/site\/talsoft-advisory-security-wordpress-user-id-and-user-name-disclosure\/"},"wordCount":508,"publisher":{"@id":"https:\/\/www.talsoft-security.com\/site\/#organization"},"articleSection":["Profesional"],"inLanguage":"en-GB"},{"@type":"WebPage","@id":"https:\/\/www.talsoft-security.com\/site\/talsoft-advisory-security-wordpress-user-id-and-user-name-disclosure\/","url":"https:\/\/www.talsoft-security.com\/site\/talsoft-advisory-security-wordpress-user-id-and-user-name-disclosure\/","name":"TalSoft - Seguridad Inform\u00e1tica Empresarial - Talsoft Advisory Security - WordPress User ID and User Name Disclosure","isPartOf":{"@id":"https:\/\/www.talsoft-security.com\/site\/#website"},"datePublished":"2011-05-26T12:35:27+00:00","description":"Talsoft transforma la visi\u00f3n de las empresas para que puedan proteger su informaci\u00f3n cr\u00edtica y confidencial frente ataques inform\u00e1ticos. Cons\u00faltenos sin cargo.","inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.talsoft-security.com\/site\/talsoft-advisory-security-wordpress-user-id-and-user-name-disclosure\/"]}]},{"@type":"WebSite","@id":"https:\/\/www.talsoft-security.com\/site\/#website","url":"https:\/\/www.talsoft-security.com\/site\/","name":"TalSoft TS - Services IT Security","description":"Talsoft is transforming awareness, control and decision-making power so that companies can protect their critical and confidential information from computer attacks.","publisher":{"@id":"https:\/\/www.talsoft-security.com\/site\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.talsoft-security.com\/site\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/www.talsoft-security.com\/site\/#organization","name":"Talsoft TS","url":"https:\/\/www.talsoft-security.com\/site\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.talsoft-security.com\/site\/#\/schema\/logo\/image\/","url":"https:\/\/www.talsoft-security.com\/site\/wp-content\/uploads\/2014\/02\/talsoft_logo_270x125.png","contentUrl":"https:\/\/www.talsoft-security.com\/site\/wp-content\/uploads\/2014\/02\/talsoft_logo_270x125.png","width":270,"height":125,"caption":"Talsoft TS"},"image":{"@id":"https:\/\/www.talsoft-security.com\/site\/#\/schema\/logo\/image\/"},"sameAs":["http:\/\/www.facebook.com\/talsoftsrl","https:\/\/x.com\/talsoft"]},{"@type":"Person","@id":"https:\/\/www.talsoft-security.com\/site\/#\/schema\/person\/83d2ebde035a5a030c14e522351953c8","name":"Leandro Ferrari","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.talsoft-security.com\/site\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/cd259c10675b9fd302b2e6264231febeeeb3de578400cf8c91c6577e50a0d34a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/cd259c10675b9fd302b2e6264231febeeeb3de578400cf8c91c6577e50a0d34a?s=96&d=mm&r=g","caption":"Leandro Ferrari"},"sameAs":["http:\/\/www.talsoft.com.ar","https:\/\/www.facebook.com\/talsoftsrl\/","https:\/\/x.com\/avatar_leandro"],"url":"https:\/\/www.talsoft-security.com\/site\/author\/leandro\/"}]}},"_links":{"self":[{"href":"https:\/\/www.talsoft-security.com\/site\/wp-json\/wp\/v2\/posts\/1388","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.talsoft-security.com\/site\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.talsoft-security.com\/site\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.talsoft-security.com\/site\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.talsoft-security.com\/site\/wp-json\/wp\/v2\/comments?post=1388"}],"version-history":[{"count":1,"href":"https:\/\/www.talsoft-security.com\/site\/wp-json\/wp\/v2\/posts\/1388\/revisions"}],"predecessor-version":[{"id":1389,"href":"https:\/\/www.talsoft-security.com\/site\/wp-json\/wp\/v2\/posts\/1388\/revisions\/1389"}],"wp:attachment":[{"href":"https:\/\/www.talsoft-security.com\/site\/wp-json\/wp\/v2\/media?parent=1388"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.talsoft-security.com\/site\/wp-json\/wp\/v2\/categories?post=1388"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.talsoft-security.com\/site\/wp-json\/wp\/v2\/tags?post=1388"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}