WP 搭建的外贸站 CMS， Discord Bot 每天访问 xmlrpc. PHP 的作用是什么？今天检测日志发现 Discord Bot 每天都访问这个文件，听说这文件有漏洞被我删除了导致每天都有几条这个文件的 404 错误

V2EX = way to explore

V2EX 是一个关于分享和探索的地方

For Existing Member Sign In

• 请不要在回答技术问题时复制粘贴 AI 生成的内容

This topic created in 1155 days ago, the information mentioned may be changed or developed.

Discord

bot

文件

XMLRPC

4 replies • 2023-03-06 10:15:27 +08:00

jlmzzz

Mar 5, 2023

WordPress XML-RPC Pingback Vulnerability

Threat

XML-RPC in WordPress is an API which allows developers who make third party application and services the ability to interact to your WordPress site using
features like Trackbacks and Pingbacks.
The Pingback feature of XML-RPC API allows attacks like DDOS and Server-Side Request Forgery (SSRF) either against the server hosting WordPress or
against a target server.
QID Detection Logic:
This detection sends a POST request with XML data with invalid URL to verify the presence of vulnerability.

Impact

On Successful exploitation, an attacker can control a WordPress site to conduct DDOS or Server-Side Request Forgery (SSRF) attack against a target server.

Solution

Remove "pingback.ping" method from XML-RPC.

00chang

Mar 5, 2023

The xmlrpc.php file is a critical part of the WordPress CMS system, which is responsible for handling remote API requests. However, it has been found that the Pingback feature in XML-RPC API has a vulnerability that allows attackers to conduct DDOS or Server-Side Request Forgery (SSRF) attacks.

Therefore, it's essential to ensure that the Pingback feature is disabled on the WordPress site by removing the "pingback.ping" method from XML-RPC to minimize the risk of attacks. It's also recommended to keep the WordPress site and all plugins and themes up-to-date to stay protected from known vulnerabilities.

chatgpt 的回复

rb6221

Mar 5, 2023

楼上太吓人了

guxin0123

Mar 6, 2023

建议装一个 wordfence 插件，按照提示仔细检查一下