• Search for:
    13Dec, 2023
    50K WordPress sites exposed to RCE attacks by critical bug in backup plugin

    A critical severity vulnerability in a WordPress plugin with more than 90,000 installs can let attackers gain remote code execution to fully compromise vulnerable websites.

    Known as Backup Migration, the plugin helps admins automate site backups to local storage or a Google Drive account.

    The security bug (tracked as CVE-2023-6553 and rated with a 9.8/10 severity score) was discovered by a team of bug hunters known as Nex Team, who reported it to WordPress security firm Wordfence under a recently launched bug bounty program.

    It impacts all plugin versions up to and including Backup Migration 1.3.6, and malicious actors can exploit it in low-complexity attacks without user interaction.

    CVE-2023-6553 allows unauthenticated attackers to take over targeted websites by gaining remote code execution through PHP code injection via the /includes/backup-heart.php file.

    “This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated threat actors to easily execute code on the server,” Wordfence said on Monday.

    “By submitting a specially-crafted request, threat-actors can leverage this issue to include arbitrary, malicious PHP code and execute arbitrary commands on the underlying server in the security context of the WordPress instance.”

    In the /includes/backup-heart.php file used by the Backup Migration plugin, an attempt is made to incorporate bypasser.php from the BMI_INCLUDES directory (defined by merging BMI_ROOT_DIR with the includes string) at line 118.

    However, BMI_ROOT_DIR is defined through the content-dir HTTP header found on line 62, thereby making BMI_ROOT_DIR subject to user control.

    Patch released within hours

    Wordfence reported the critical security flaw to BackupBliss, the development team behind the Backup Migration plugin, on December 6, with the developers releasing a patch hours later.

    However, despite the release of the patched Backup Migration 1.3.8 plugin version on the day of the report, almost 50,000 WordPress websites using a vulnerable version still have to be secured nearly one week later, as WordPress.org org download stats show.

    Admins are strongly advised to secure their websites against potential CVE-2023-6553 attacks, given that this is a critical vulnerability that unauthenticated malicious actors can exploit remotely.

    WordPress administrators are also being targeted by a phishing campaign attempting to trick them into installing malicious plugins using fake WordPress security advisories for a fictitious vulnerability tracked as CVE-2023-45124 as bait.

    Last week, WordPress also fixed a Property Oriented Programming (POP) chain vulnerability that could allow attackers to gain arbitrary PHP code execution under certain conditions (when combined with some plugins in multisite installations).

    Resource : https://www.bleepingcomputer.com/news/security/50k-wordpress-sites-exposed-to-rce-attacks-by-critical-bug-in-backup-plugin/?&web_view=true

    3Jul, 2023
    The Top ChatGPT Plugins for Developers in 2023

    As a software developer, you know that staying ahead of the curve and increasing productivity are crucial to prosperity in a constantly evolving tech industry. But with so many tools and platforms available, it can be overwhelming to figure out where to turn. That’s where ChatGPT comes in. This superstar chatbot offers a range of plugins specifically designed to help developers streamline their work and increase productivity. With the plethora of ChatGPT plugins available, you can leverage the power of artificial intelligence and automation to optimise your workflow, solve complex problems, and streamline your development process. These plugins offer various functionalities, from language translation and job search assistance to diagramming tools and aviation data.

    So, embrace the power of ChatGPT and its impressive plugin lineup. Let this AI-powered virtual assistant be your trusted ally in the quest for increased productivity and success. With ChatGPT, the possibilities are limitless, and your journey as a software developer can reach new heights.

    1. There is an AI for That

    Meet There is an AI for That — the AI plugin that makes finding the right AI tools a breeze. Think of it as a search engine specifically designed for developers looking to streamline their work and optimise their productivity. With access to over 700 AIs across nearly 100 categories, you can easily browse and find the perfect tool to fit your needs. 

    Don’t waste time scouring the Internet for the right AI tool for your project. With There is an AI for That, you can find what you require with just a few clicks. It’s a straightforward and user-friendly plugin that helps you stay ahead of the curve regarding the latest advancements in AI technology. So why complicate things? Simplify your AI search and try There is an AI for That.

    2. Ambition

    Sifting through millions of job openings can be daunting for tech workers. Ambition eliminates this hassle by acting as a job search assistant. This powerful plugin sorts through millions of job openings, providing only the best matches that fit your skillset and interests. Simply specify your desired roles; this plugin will swiftly scan the web for the best opportunities. Whether you seek employment locally or internationally, Ambition will present you with the most relevant job options, saving you precious time.

    3. Show Me

    Visual learners rejoice! In the fast-paced world of technology, where complex concepts and intricate workflows abound, the Show Me plugin emerges as a powerful diagramming tool that seamlessly integrates with ChatGPT. With this plugin at your fingertips, you can effortlessly create and edit diagrams directly within the chat interface, revolutionising the way you communicate and understand complex information.

    Gone are the days of relying solely on text-based explanations to convey intricate ideas. Show Me takes visualisation to a new level by providing an intuitive and user-friendly platform to express your thoughts visually. Whether you’re a software developer illustrating the architecture of a new system, a project manager mapping out workflows, or a data scientist visualising complex data relationships, Show Me empowers you to bring your ideas to life engagingly and understandably. Visual communication has proven to be an effective way to engage and educate and Show Me understands the importance of visual learners in the tech industry. By harnessing the power of diagrams, this plugin enables you to simplify complex concepts, foster efficient communication, and enhance overall understanding.

    4. Speak

    Whether you’re working with international teams or simply looking to expand your language skills, Speak has got your back. Multilingualism is increasingly valuable in our globalised world. The Speak plugin facilitates language learning by providing examples, context, and multiple translation options. Say goodbye to language barriers and hello to seamless communication.

    Through this plugin, users can effortlessly ask questions like “How do I say [phrase] in [language]?” and receive comprehensive answers about translations and different potential meanings. This language learning tool equips tech workers with the linguistic skills to succeed in diverse professional environments.

    5. C3 Glide

    For pilots and aviation enthusiasts, the C3 Glide plugin is a game-changer that brings real-time aviation data directly to ChatGPT. This powerful plugin provides access to vital information such as METARs (Meteorological Aerodrome Reports), TAFs (Terminal Aerodrome Forecasts), and NOTAMs (Notice to Airmen). Users can access crucial flight planning information by simply querying the plugin, ensuring safe and informed journeys through the skies.

    The C3 Glide plugin’s ability to provide real-time aviation data directly within ChatGPT is a significant advantage for pilots. With the convenience of accessing this information in a familiar interface, pilots can streamline their flight planning process and enhance overall situational awareness. Whether they are preparing for a short domestic flight or a long international journey, having accurate and accessible aviation data at their fingertips is invaluable.

    6. Zapier

    In today’s fast-paced world of technology, automation has become the holy grail of productivity. Tech workers and developers constantly seek ways to reduce manual efforts and optimise their workflows. This is where Zapier steps in, revolutionising the way tasks are automated within ChatGPT and empowering professionals to achieve more in less time. Zapier is a game-changing plugin that seamlessly integrates with ChatGPT, allowing users to automate a myriad of tasks without ever leaving the chat interface. With its extensive integration capabilities spanning over 5,000 apps, including popular platforms like Google Sheets, Gmail, and many more, Zapier enables effortless data transfer and workflow automation like never before.

    The versatility of Zapier is genuinely remarkable. Whether you need to automatically save email attachments to a designated Google Drive folder, update customer information across multiple systems when a new lead is added, or send personalised follow-up emails based on specific triggers, Zapier has you covered. Zapier’s user-friendly interface makes automation accessible to users of all technical backgrounds — you don’t need to be a seasoned developer or possess extensive coding knowledge to leverage the power of automation.

    7. Link Reader

    Remember when you texted your class’s ace-high student with something like “Can you help me interpret the main points of this deadening scientific paper?” followed by the URL or an attachment? Tell her she’s just been replaced with Link Reader.

    There are several ways in which programmers may benefit from using the Link Reader ChatGPT Plugin. Programmers may utilise the plugin to glean crucial principles from code documentation and programming courses without reviewing the article (so don’t try it at home). Developers that need to rapidly locate and apply specific portions of code for their projects will appreciate the plugin’s ability to extract code snippets from URLs. 

    The plugin is compatible with other development tools, facilitating data extraction from code repositories and similar resources. 

    • Extracting code snippets from GitHub repositories
    • Extracting relevant information from online forums (especially if it starts with Stack…)
    • Extracting data from that terribly indexed API document

    In a nutshell, the Link Reader ChatGPT Plugin may be a helpful tool for developers that need to effectively and rapidly extract data from various sources.

    Wrapping up…

    In conclusion, ChatGPT and its suite of powerful plugins offer software developers an unparalleled opportunity to enhance productivity and streamline their work processes. With features ranging from language translation to aviation data and automation, ChatGPT empowers developers to overcome challenges, communicate effectively, and stay ahead in a rapidly evolving tech industry. By harnessing the capabilities of ChatGPT and its plugins, developers can unlock new levels of efficiency and achieve more tremendous success in their software development endeavours. Don’t wait — embrace the power of ChatGPT and experience the transformative impact it can have on your work and day-to-day.

    Resource : https://www.wearedevelopers.com/magazine/top-chatgpt-plugins-for-developers

    3Jan, 2023
    Over 30 WordPress Plugins and Themes Can be Abused by New Linux Malware

    A security firm has disclosed a malicious Linux threat that hacks websites built on a WordPress CMS. The malware exploits 30 vulnerabilities in different plugins and themes for WordPress.

    Unseen malware variants

    According to Dr. Web, the malware targets 32-bit and 64-bit Linux systems, and has remote command capabilities. 

    • If a site is detected using outdated versions of add-ons, the web pages are injected with malicious JavaScript codes. Click on the page redirects uses to pages of hackers’ choice.
    • The malware, identified as Linux.BackDoor.WordPressExploit.1, can attack a specific webpage, switch to standby mode, shut itself down, and even pause its logging actions.
    • Additionally, the experts have spotted an updated version of the malware (Linux.BackDoor.WordPressExploit.2) It has a different C&C server, and domain address for downloading malicious JavaScript, and impacts more vulnerabilities.

    Infection process

    • Pages infected with malicious JavaScript act as redirects to the location of the attacker, and always get loaded first irrespective of the site’s original content.
    • These redirections serve phishing, malware distribution, and malvertising campaigns to avoid detection.
    • Further, the operators behind the auto-injector could be selling their services to other threat groups.

    Ending notes

    Owing to its massive popularity, WordPress has always been a lucrative target for cybercriminals. The admins of WordPress websites are suggested to stay updated with the latest available version of the themes and plugins running on the site. Further, replace those which are no longer developed. Finally, always use strong passwords and enable two-factor authentication.

    Resource : https://cyware.com/news/over-30-wordpress-plugins-and-themes-can-be-abused-by-new-linux-malware-8fbd82e6