1635356 - [Mozilla Bug Bounty] Vulnerability report - WordPress REST API User Enumeration (/wp-json/wp/v2/users/)

Status: RESOLVED DUPLICATE of bug 1365661

(Websites :: Other, task)

Description

[security.rd]

Attachment: POC of one of the affected asset

Summary:

WordPress includes a REST API that can be used to list the information about the registered users on a WordPress installation. The REST API exposed user data for all users who had authored a post of a public post type. I noticed that multiple Mozilla website allows anonymous enumeration of valid user accounts.

Affected assets:

https://hacks.mozilla.org/wp-json/wp/v2/users/
https://toolkit.mozilla.org/wp-json/wp/v2/users/
https://community.mozilla.org/wp-json/wp/v2/users/
https://research.mozilla.org/wp-json/wp/v2/users/
https://blog.nightly.mozilla.org/wp-json/wp/v2/users/
https://blog.mozilla.org/wp-json/wp/v2/users/
https://quality.mozilla.org/wp-json/wp/v2/users/

Business impact:

With a list of valid usernames, attackers can perform targeted bruteforce attacks.

Steps To Reproduce:

1. Issue below command to confirm the key is being used:
   curl -s https://hacks.mozilla.org/wp-json/wp/v2/users/
   curl -s https://toolkit.mozilla.org/wp-json/wp/v2/users/
   curl -s https://community.mozilla.org/wp-json/wp/v2/users/
   curl -s https://research.mozilla.org/wp-json/wp/v2/users/
   curl -s https://blog.nightly.mozilla.org/wp-json/wp/v2/users/
   curl -s https://blog.mozilla.org/wp-json/wp/v2/users/
   curl -s https://quality.mozilla.org/wp-json/wp/v2/users/

Additional reference:

https://www.acunetix.com/vulnerabilities/web/wordpress-rest-api-user-enumeration/

Please let me know if there's anything that you need from me to help you with this, or if you need any further clarification.

Comment 1

[April King [:April]]

This list of user names is all considered to be public data.