Tucows (VDP) · Report #3255910
Vulnerability: XML-RPC Interface Enabled and Accessible
How it was found
Summary The website ███ has the XMLRPC interface enabled which exposes several methods including pingbackping and systemmulticall These methods can be abused by attackers to perform high volume denial of service DDoS attacks and brute force amplification attacks which can severely impact the availability and security of the website
Steps To Reproduce 1 Send a POST request to ███████ with the following XML payload
<?xml version="10"?> <methodCall> <methodName>systemlistMethods</methodName> </methodCall>Observe the response which includes a list of exposed XMLRPC methods such as pingbackping and systemmulticall 3 An attacker can exploit these methods to launch pingback based DDoS attacks or use systemmulticall for brute force amplification
Supporting Material References Official Wordpress documentation on XMLRPC usage Public advisories on XMLRPC pingback DDoS attacks and vulnerabilities Common security reports on brute force amplification using systemmulticall CWE 611 XML External Entity (XXE) Processing (related risks) OWASP API Security Top 10
Impact
The enabled XMLRPC interface allows unauthenticated attackers to abuse these methods potentially leading to distributed denial of service attacks on the website or third parties and amplification of brute force login attempts This threatens the website availability and can expose sensitive information