Custom REST API Endpoint may expose data unprividedged users.

Summary

An incorrect capability check in the distributor/list-pull-content REST API endpoint may expose private data, content.raw, users without the correct permissions.

Details

The custom REST API endpoint uses the check_read_permission() function to determine if a user can read the content. While this function is correct for checking if a user can read content, the result is used to determine if the user can read data that is intended to be private:

distributor/includes/rest-api.php

Lines 466 to 486 in 753c325

    
           	if ( ! check_read_permission( $post ) ) { 
        
           		continue; 
        
           	} 
        
           	$formatted_posts[] = array( 
        
           		'id'             => $post->ID, 
        
           		'title'          => array( 'rendered' => $post->post_title ), 
        
           		'excerpt'        => array( 'rendered' => $post->post_excerpt ), 
        
           		'content'        => array( 'raw' => $post->post_content ), 
        
           		'password'       => $post->post_password, 
        
           		'date'           => $post->post_date, 
        
           		'date_gmt'       => $post->post_date_gmt, 
        
           		'guid'           => array( 'rendered' => $post->guid ), 
        
           		'modified'       => $post->post_modified, 
        
           		'modified_gmt'   => $post->post_modified_gmt, 
        
           		'type'           => $post->post_type, 
        
           		'link'           => get_the_permalink( $post ), 
        
           		'comment_status' => $post->comment_status, 
        
           		'ping_status'    => $post->ping_status, 
        
           	); 
        
           }

The effected data is:

$post->post_title (should be obtained via get_the_title())
$post->post_excerpt (should be run through the get_the_excerpt filter)
$post->post_content (should be run obtained via Utils\get_processed_content())
$post->post_password (should not be shared)
$post->guid (should be run through the get_the_guid filter)

Users with the edit_post meta capability are permitted to read each of these items in their unmodified (raw) forms.

PoC

Configuration

Set up a Distributor site from scratch (WP + the plugin only)
Add a subscriber user (wpcli command here for ease)
Log in as the subscriber
Create an application password

POC using default "Hello World" Post

Run a curl request in the edit context for the WP Post endpoint curl 'http://subscriber:[email protected]/wp-json/wp/v2/posts/1?context=edit'
Observe result: Sorry, you are not allowed to edit this post.
Run a curl request to the distributor endpoint curl -XPOST 'http://subscriber:[email protected]/wp-json/wp/v2/distributor/list-pull-content'
Observe the result: post contains raw data

Impact

Data exposure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Custom REST API Endpoint may expose data unprividedged users.

Package

Affected versions

Patched versions

Description

Summary

Details

PoC

Impact

See also

Severity

CVSS overall score

CVSS v3 base metrics

CVSS v3 base metrics

CVE ID

Weaknesses

Credits

	if ( ! check_read_permission( $post ) ) {
	continue;
	}

	$formatted_posts[] = array(
	'id' => $post->ID,
	'title' => array( 'rendered' => $post->post_title ),
	'excerpt' => array( 'rendered' => $post->post_excerpt ),
	'content' => array( 'raw' => $post->post_content ),
	'password' => $post->post_password,
	'date' => $post->post_date,
	'date_gmt' => $post->post_date_gmt,
	'guid' => array( 'rendered' => $post->guid ),
	'modified' => $post->post_modified,
	'modified_gmt' => $post->post_modified_gmt,
	'type' => $post->post_type,
	'link' => get_the_permalink( $post ),
	'comment_status' => $post->comment_status,
	'ping_status' => $post->ping_status,
	);
	}