„Attacks Targeting Recent WordPress File Manager Flaw Ramping Up
By Ionut Arghire on September 11, 2020
Attacks targeting a recently addressed vulnerability in the WordPress plugin File Manager are ramping up, warns the Wordfence Threat Intelligence team at WordPress security company Defiant.
With over 700,000 active installs, File Manager is a highly popular WordPress plugin that provides admins with file and folder management capabilities (copy/paste, delete, download/upload, edit, and archive).
In early September 2020, the plugin’s developer addressed a critical-severity zero-day flaw that was already being actively targeted. Assessed with a CVSS score of 10, the flaw can allow attackers to remotely execute code on a vulnerable installation.
The issue is related to code taken from the elFinder project, with the File Manager developers renaming the elFinder library’s connector.minimal.php.dist file to .php, to have it execute directly. This, however, opened the plugin to attackers.
Nearly two weeks after a patch for the vulnerability was released, multiple threat actors are targeting unpatched installations, Wordfence researchers reveal.
Within days after the zero-day was patched, attackers were targeting over 1.7 million sites, but that number increased to 2.6 million as of September 10.
“We’ve seen evidence of multiple threat actors taking part in these attacks, including minor efforts by the threat actor previously responsible for attacking millions of sites, but two attackers have been the most successful in exploiting vulnerable sites, and at this time, both attackers are password protecting vulnerable copies of the connector.minimal.php file,” Wordfence notes.
The most active of the attackers is a Moroccan threat actor referred to as “bajatax,” which modifies the vulnerable connector.minimal.php file to prevent further attacks. This is the first threat actor observed targeting the vulnerability at scale.
Once it manages to compromise a website, the attacker adds code to exfiltrate user credentials using the Telegram messenger’s API. The code is added to the WordPress core user.php file and, if WooCommerce is installed, two more files are modified to steal user credentials.
A second adversary targeting the security flaw is attempting to inject a backdoor into the vulnerable websites, and is protecting the connector.minimal.php file with a password, in an attempt to prevent other infections. However, it appears that the threat actor is using a consistent password across infections.
Two copies of the backdoor are inserted into the infected website, one in the webroot and the other in a randomized writable folder, likely in an attempt to ensure persistence. The attacker leverages the backdoors to modify core WordPress files which would then be abused for monetization purposes, based on the threat actor’s previously observed modus operandi.
On many of the compromised websites, Wordfence discovered malware from multiple adversaries. Attacks targeting the vulnerability were observed originating from more than 370,000 separate IP addresses, with almost no overlaps between the IPs used by the two most active attackers.
“As more and more users update or remove the File Manager plugin, control of any infected sites will likely be split between these two threat actors,” Wordfence notes.
Site administrators are advised to update the File Manager plugin as soon as possible, but also to scan their website for possible compromise and to remove any malicious code they might find.
Related: WordPress ‚File Manager‘ Plugin Patches Critical Zero-Day Exploited in Attacks
Related: WordPress Malware Targets WooCommerce Stores
Related: Hackers Can Inject Code Into WordPress Sites via Flaw in Product Review Plugin“
Source: https://www.securityweek.com/attacks-targeting-recent-wordpress-file-manager-flaw-ramping
Kategorie: Counterdefense/Cyberterror-Morons
-
Attacks Targeting Recent WordPress File Manager Flaw Ramping Up
-
Hackers are exploiting a critical flaw affecting >350,000 WordPress sites
„Hackers are exploiting a critical flaw affecting >350,000 WordPress sites“
„Flaw is in File Manager, a plugin with more than 700,000 users; 52% are affected.
Dan Goodin – 9/2/2020, 3:40 AM“
„Hackers are actively exploiting a vulnerability that allows them to execute commands and malicious scripts on Websites running File Manager, a WordPress plugin with more than 700,000 active installations, researchers said on Tuesday. Word of the attacks came a few hours after the security flaw was patched.
Attackers are using the exploit to upload files that contain webshells that are hidden in an image. From there, they have a convenient interface that allows them to run commands in plugins/wp-file-manager/lib/files/, the directory where the File Manager plugin resides. While that restriction prevents hackers from executing commands on files outside of the directory, hackers may be able to exact more damage by uploading scripts that can carry out actions on other parts of a vulnerable site.
NinTechNet, a website security firm in Bangkok, Thailand, was among the first to report the in-the-wild attacks. The post said that a hacker was exploiting the vulnerability to upload a script titled hardfork.php and then using it to inject code into the WordPress scripts /wp-admin/admin-ajax.php and /wp-includes/user.php.
Backdooring vulnerable sites at scale
In email, NinTechNet CEO Jerome Bruandet wrote:
It’s a bit too early to know the impact because when we caught the attack, hackers were just trying to backdoor websites. However, one interesting thing we noticed is that attackers were injecting some code to password-protect the access to the vulnerable file (connector.minimal.php) so that other groups of hackers could not exploit the vulnerability on the sites that were already infected.
All commands can be run in the /lib/files folder (create folders, delete files etc), but the most important issue is that they can upload PHP scripts into that folder too, and then run them and do whatever they want to the blog.
So far, they are uploading „FilesMan“, another file manager often used by hackers. This one is heavily obfuscated. In the next few hours and days we’ll see exactly what they will do, because if they password-protected the vulnerable file to prevent other hackers to exploit the vulnerability it is likely they are expecting to come back to visit the infected sites.
Fellow website security firm Wordfence, meanwhile, said in its own post that it had blocked more than 450,000 exploit attempts in the past few days. The post said that the attackers are trying to inject various files. In some cases, those files were empty, most likely in an attempt to probe for vulnerable sites and, if successful, inject a malicious file later. Files being uploaded had names including hardfork.php, hardfind.php, and x.php.
„A file manager plugin like this would make it possible for an attacker to manipulate or upload any files of their choosing directly from the WordPress dashboard, potentially allowing them to escalate privileges once in the site’s admin area,“ Chloe Chamberland, a researcher with security firm Wordfence, wrote in Tuesday’s post. „For example, an attacker could gain access to the admin area of the site using a compromised password, then access this plugin and upload a webshell to do further enumeration of the server and potentially escalate their attack using another exploit.“
52% of 700,000 = potential for damage
The File Manager plugin helps administrators manage files on sites running the WordPress content management system. The plugin contains an additional file manager known as elFinder, an open source library that provides the core functionality in the plugin, along with a user interface for using it. The vulnerability arises from the way the plugin implemented elFinder.
„The core of the issue began with the File Manager plugin renaming the extension on the elFinder library’s connector.minimal.php.dist file to .php so it could be executed directly, even though the connector file was not used by the File Manager itself,“ Chamberland explained. „Such libraries often include example files that are not intended to be used ‚as is‘ without adding access controls, and this file had no direct access restrictions, meaning the file could be accessed by anyone. This file could be used to initiate an elFinder command and was hooked to the elFinderConnector.class.php file.“
The developers of File Manager credited researcher Ville Korhonen of security firm Seravo with discovering and first reporting the vulnerability. The researchers, who said they found the vulnerability as part of their regular „WordPress upkeep service,“ published their own writeup here.
Sal Aguilar, a contractor who sets up and secures WordPress sites, took to Twitter to warn of attacks he’s seeing.
„Oh crap!!!“ he wrote. „The WP File Manager vulnerability is SERIOUS. Its spreading fast and I’m seeing hundreds of sites getting infected. Malware is being uploaded to /wp-content/plugins/wp-file-manager/lib/files.“
The security flaw is in File Manager versions ranging from 6.0 to 6.8. Statistics from WordPress show that currently about 52 percent of installations are vulnerable. With more than half of File Manager’s installed base of 700,000 sites vulnerable, the potential for damage is high. Sites running any of these versions should updated to 6.9 as soon as possible.“
Source: https://arstechnica.com/information-technology/2020/09/hackers-are-exploiting-a-critical-flaw-affecting-350000-wordpress-sites/ -
Conspiracy Revelation hat Bajatax-Exploit zertrümmert…/ Conspiracy Revelation smashed Bajatax exploit…
Conspiracy Revelation hat Bajatax-Exploit zertrümmert… Bajatax-Exploit hatte conspiracyrevelation befallen, ich habe die Seite gesäubert, von ihrem widerlichen Shellcode..
Er hatte einige Modifikationen vorgenommen, um mir den Zugriff zum Back-End zu blockieren und hatte die leere Antikeymagic-HP komplett in einen Bajatax Ordner verfrachtet, auf dem Domain-Server. Die Exploits sind russischer Natur… Wenn man versucht hatte über Bing auf conspiracyrevelation.com zu gelangen wurde man auf japanische Webseiten umgelenkt.
Also eine triplistische Ausländerfraktion von Marokko-Maghreb/russischer und japanischer Mixtur.
Kundalini Devi ist verzaubert… du hast keine Chance… egal was du gegen mich versuchst.
//
Conspiracy Revelation smashed Bajatax exploit… Bajatax exploit had attacked conspiracyrevelation, I cleaned the page of its disgusting shellcode.. He had made some modifications to block my access to the back-end and had put the empty Antikeymagic-HP completely in a Bajatax folder on the domain server. The exploits are Russian in nature … If you tried to get to conspiracyrevelation.com via Bing, you were redirected to Japanese websites. So a tripartite foreigners faction from Morocco-Maghreb/Russian and Japanese mixture.
Kundalini Devi is enchanted…you have zero chance…no matter what you try against me.
//
[28.09.20 00:33]:
[Weitergeleitet aus ConspiracyRevelation]
Hier nochmal der absolute Beweis dass conspiracyrevelation.com der Bajatax Attacke unterzogen wurde…
//
Here again the absolute proof that conspiracyrevelation.com was subjected to the Bajatax attack…
„$password = „bajatax_cae5fff19c1…“; // Password“
//
spamxtoolz_com:104.24.99.74 Cloud14 Server… „Hacked By Hunter Bajwa“
//
[Weitergeleitet aus ConspiracyRevelation]
logpass=““; //FORMAT: md5(loginIMAILpassword);
session_start();
define(‚DEBUG‘, FALSE);
define(‚SIMULATION‘, FALSE);
define(‚SERVICEMODE‘, FALSE);
if(isset($_POST[„password_bajatax“])){
if(md5(md5(md5($_POST[„password_bajatax“]))) == „15857d3eacb3f9894b0d2551acbbd828“){
SESSION[„connected“]=$_POST[„password_bajatax“];
…
header(‚Content-type: text/html; charset=utf-8;‘);
#Alexus(240980845) – http//\www.a-l-e-x-u-s/\ru/
#CREATED AT 15.12.2011
#UPD 02.04.2012 v 1.
#UPD 10.04.2012 v 1.2
…
#UPD 20.10.2014 v 2.0.3
define(„VERSION“, „2.0“);
define(„FULLVERSION“, „2.0.8“);
define(„RELEASEDATE“, „08-12-2014″);
$boundary=“–„.AMUtil::randomString(10);
$timezone=’Europe/Moscow‘;
/**
Запрос авторизации
Authorization request“