CVE-2017-9065: Improper Input Validation (CWE-20)
value: In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2017-05-18T14:29Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-includes/class-wp-xmlrpc-server.php, wp-includes/version.php
Commit date: 2017-05-16 08:09:42 +0000
Commit message: Whitelist post arguments in XML-RPC

Built from https://develop.svn.wordpress.org/trunk@40677


git-svn-id: http://core.svn.wordpress.org/trunk@40540 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-includes/class-wp-xmlrpc-server.php b/wp-includes/class-wp-xmlrpc-server.php
index 5084da65cb9..7bbde05c2bd 100644
--- a/wp-includes/class-wp-xmlrpc-server.php
+++ b/wp-includes/class-wp-xmlrpc-server.php
@@ -1293,14 +1293,35 @@ class wp_xmlrpc_server extends IXR_Server {
 	 * @param WP_User         $user           The post author if post_author isn't set in $content_struct.
 	 * @param array|IXR_Error $content_struct Post data to insert.
 	 * @return IXR_Error|string
 	 */
 	protected function _insert_post( $user, $content_struct ) {
-		$defaults = array( 'post_status' => 'draft', 'post_type' => 'post', 'post_author' => 0,
-			'post_password' => '', 'post_excerpt' => '', 'post_content' => '', 'post_title' => '' );
+		$defaults = array(
+			'post_status'    => 'draft',
+			'post_type'      => 'post',
+			'post_author'    => null,
+			'post_password'  => null,
+			'post_excerpt'   => null,
+			'post_content'   => null,
+			'post_title'     => null,
+			'post_date'      => null,
+			'post_date_gmt'  => null,
+			'post_format'    => null,
+			'post_name'      => null,
+			'post_thumbnail' => null,
+			'post_parent'    => null,
+			'ping_status'    => null,
+			'comment_status' => null,
+			'custom_fields'  => null,
+			'terms_names'    => null,
+			'terms'          => null,
+			'sticky'         => null,
+			'enclosure'      => null,
+			'ID'             => null,
+		);
 
-		$post_data = wp_parse_args( $content_struct, $defaults );
+		$post_data = wp_parse_args( array_intersect_key( $content_struct, $defaults ), $defaults );
 
 		$post_type = get_post_type_object( $post_data['post_type'] );
 		if ( ! $post_type )
 			return new IXR_Error( 403, __( 'Invalid post type.' ) );
 
@@ -1486,13 +1507,10 @@ class wp_xmlrpc_server extends IXR_Server {
 				}
 			}
 
 			$post_data['tax_input'] = $terms;
 			unset( $post_data['terms'], $post_data['terms_names'] );
-		} else {
-			// Do not allow direct submission of 'tax_input', clients must use 'terms' and/or 'terms_names'.
-			unset( $post_data['tax_input'], $post_data['post_category'], $post_data['tags_input'] );
 		}
 
 		if ( isset( $post_data['post_format'] ) ) {
 			$format = set_post_format( $post_ID, $post_data['post_format'] );
 
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 2614f176c1e..7cf6b4c2b07 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '4.8-beta1-40676';
+$wp_version = '4.8-beta1-40677';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: 		$defaults = array( 'post_status' => 'draft', 'post_type' => 'post', 'post_author' => 0,
			'post_password' => '', 'post_excerpt' => '', 'post_content' => '', 'post_title' => '' );
		$post_data = wp_parse_args( $content_struct, $defaults );
		} else {
			// Do not allow direct submission of 'tax_input', clients must use 'terms' and/or 'terms_names'.
			unset( $post_data['tax_input'], $post_data['post_category'], $post_data['tags_input'] );
$wp_version = '4.8-beta1-40676';
Fixed code: 		$defaults = array(
			'post_status'    => 'draft',
			'post_type'      => 'post',
			'post_author'    => null,
			'post_password'  => null,
			'post_excerpt'   => null,
			'post_content'   => null,
			'post_title'     => null,
			'post_date'      => null,
			'post_date_gmt'  => null,
			'post_format'    => null,
			'post_name'      => null,
			'post_thumbnail' => null,
			'post_parent'    => null,
			'ping_status'    => null,
			'comment_status' => null,
			'custom_fields'  => null,
			'terms_names'    => null,
			'terms'          => null,
			'sticky'         => null,
			'enclosure'      => null,
			'ID'             => null,
		);
		$post_data = wp_parse_args( array_intersect_key( $content_struct, $defaults ), $defaults );
$wp_version = '4.8-beta1-40677';