Cloudanix VulnDB

CVE-2017-1001000

High · 7.5

CVSS

7.5

EPSS

84.9%

Published

Apr 3, 2017

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Attend

A flaw in how certain web software checks request identifiers lets outsiders change pages or posts they should not be allowed to touch.

Weaponized
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Tampering
Component
Web Framework
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The register_routes function fails to enforce integer-only identifiers for REST API post endpoints, permitting crafted requests that bypass authorization and allow modification of arbitrary content objects.

Why it matters to the business

Attackers can alter published content or site data without authentication, risking site integrity, reputation damage, and potential downstream operational disruption; the issue affects multiple Keycloak distributions with fixes available since 25.0.0-r0.

How an attack unfolds

An unauthenticated attacker discovers a REST endpoint, appends a malformed identifier containing non-numeric characters to a numeric post reference, and submits a modification request that the server accepts due to insufficient type validation.

How to fix it

Upgrade all listed Keycloak packages to the fixed versions: keycloak (Chainguard) 25.0.0-r0, keycloak (Wolfi) 25.0.0-r0, keycloak-compat (Chainguard) 25.0.0-r0, keycloak-compat (Wolfi) 25.0.0-r0, keycloak-bitnami-compat (Chainguard) 25.0.0-r0, keycloak-bitnami-compat (Wolfi) 25.0.0-r0. Validate that the integer-identifier enforcement is present after upgrade.

How to confirm the fix worked

Confirm package versions match the fixed releases, then test the endpoint with both valid integer and malformed non-integer identifiers to verify rejections occur for the latter.

Typical attack path

  1. Identify exposed REST API endpoint
  2. Craft URI with numeric ID followed by non-numeric suffix (e.g., /posts/123?id=123helloworld)
  3. Issue unauthenticated modification request
  4. Observe successful content change without authorization checks

How to detect it

Search web server and application logs for REST requests containing mixed numeric and non-numeric identifiers targeting post or content endpoints; look for successful modification responses from unauthenticated sources.

  • wp-json/wp/v2/posts/.*\?id=.*[0-9][^0-9]
  • HTTP requests to /wp-json/wp/v2/posts/ returning 200 with non-integer ID parameters

What your security team should do

  • Immediately apply the 25.0.0-r0 updates across all affected Keycloak distributions
  • Review public-facing REST API exposure and restrict unnecessary endpoints
  • Monitor for post-modification anomalies in application logs

The record

The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 wordpress 0 4.7.2+dfsg-1
Debian:12 wordpress 0 4.7.2+dfsg-1
Debian:13 wordpress 0 4.7.2+dfsg-1

Related vulnerabilities