[wp-trac] [WordPress Trac] #41808: Attacks against wp.getUsersBlogs with no user name but with a password

[WordPress Trac]

#41808: Attacks against wp.getUsersBlogs with no user name but with a password
--------------------------+-----------------------------
 Reporter:  krader        |      Owner:
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  Security      |    Version:  4.8
 Severity:  normal        |   Keywords:
  Focuses:  rest-api      |
--------------------------+-----------------------------
 In the past few hours I've seen several attacks that `POST` to
 `/xmlrpc.php` with content like this resulting in a 200 HTTP response:

 {{{
 POST /xmlrpc.php HTTP/1.1
 Content-Type: application/xml
 Host: skepticism.us
 Content-Length: 173
 Connection: Close

 <?xml
 version="1.0"?><methodCall><methodName>wp.getUsersBlogs</methodName><params><param><value></value></param><param><value>123456789</value></param></params></methodCall>
 }}}

 That method is not correctly validating its input.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/41808>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform