1540509 - xmlrpc.php FILE is enable it will used for bruteforce attack and denial of service in blog.mozilla.org

Status: RESOLVED DUPLICATE of bug 1365661

(Websites :: Other, defect)

Description

[praveen_ucet]

When i look for wordpress site in google i found blog.mozilla.org in https://www.wpbeginner.com/showcase/40-most-notable-big-name-brands-that-are-using-wordpress/ this mentioned site.

Step 1 : as soon as i found blog.mozilla.org uses wordpress i went to find xmlrpc.php is available or not
Step 2: when i find xmlrpc.php i just capture the request https://blog.mozilla.org/xmlrpc.php and sent to repeater
Step 3: Then we should change the method to post and to test for xmlrpc.php i have to add some xml code
<methodCall>
<methodName>system.listMethods</methodName>
<params></params>
</methodCall>

step 4: when i add the above mentioned code via post method i can get all the available methods for xmlrpc.php
step 5: when it list all the method means we can bruteforce the admin login page
step 6: use pingback.ping method to capture the logs

remediation:

If the XMLRPC.php file is not being used, it should be disabled and removed completely to avoid any potential risks. Otherwise, it should at the very least be blocked from external access.

Comment 1

[Caglar Ulucenk [:cag]]

Hi reporter,

Thanks for your report, but this is known behavior and we consider it as public information. Our vendor also has protections against the abuse of xmlrpc.php.