1365661 - blog.mozilla.com allows access to /wp-json and /wp-admin

Status: RESOLVED WONTFIX

(Infrastructure & Operations :: Blogs, task)

Description

[sakshyam shah]

Admins responsible for hosting blog at blog.mozilla.com  has so far done great job in hiding version numbers and default wordpress pages. But url at https://blog.mozilla.org/wp-json returns json schema specific to blog.mozilla.com which further reveals unnecessary informations which might aid malicious user to enumerate user with user id via url https://blog.mozilla.org/wp-json/wp/v2/users/  , identify allowed HTTP schema and methods via url https://blog.mozilla.org/wp-json/wp/v2/ and so on. 

While this currently does not reveal any sensitive informations, it is better to hide this from public/unauthenticated user which might aid attacker in case of other attack vectors. 

you can visit following url to verify the issue:
https://blog.mozilla.org/wp-json
https://blog.mozilla.org/wp-json/wp/v2/users/
https://blog.mozilla.org/wp-json/wp/v2/

Comment 1

[Jonathan Claudius [:claudijd] (use NEEDINFO)]

sakshyam: thanks for your report, but this is known behavior and we consider it as public information.