• Search for:
    13Dec, 2023
    50K WordPress sites exposed to RCE attacks by critical bug in backup plugin

    A critical severity vulnerability in a WordPress plugin with more than 90,000 installs can let attackers gain remote code execution to fully compromise vulnerable websites.

    Known as Backup Migration, the plugin helps admins automate site backups to local storage or a Google Drive account.

    The security bug (tracked as CVE-2023-6553 and rated with a 9.8/10 severity score) was discovered by a team of bug hunters known as Nex Team, who reported it to WordPress security firm Wordfence under a recently launched bug bounty program.

    It impacts all plugin versions up to and including Backup Migration 1.3.6, and malicious actors can exploit it in low-complexity attacks without user interaction.

    CVE-2023-6553 allows unauthenticated attackers to take over targeted websites by gaining remote code execution through PHP code injection via the /includes/backup-heart.php file.

    “This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated threat actors to easily execute code on the server,” Wordfence said on Monday.

    “By submitting a specially-crafted request, threat-actors can leverage this issue to include arbitrary, malicious PHP code and execute arbitrary commands on the underlying server in the security context of the WordPress instance.”

    In the /includes/backup-heart.php file used by the Backup Migration plugin, an attempt is made to incorporate bypasser.php from the BMI_INCLUDES directory (defined by merging BMI_ROOT_DIR with the includes string) at line 118.

    However, BMI_ROOT_DIR is defined through the content-dir HTTP header found on line 62, thereby making BMI_ROOT_DIR subject to user control.

    Patch released within hours

    Wordfence reported the critical security flaw to BackupBliss, the development team behind the Backup Migration plugin, on December 6, with the developers releasing a patch hours later.

    However, despite the release of the patched Backup Migration 1.3.8 plugin version on the day of the report, almost 50,000 WordPress websites using a vulnerable version still have to be secured nearly one week later, as WordPress.org org download stats show.

    Admins are strongly advised to secure their websites against potential CVE-2023-6553 attacks, given that this is a critical vulnerability that unauthenticated malicious actors can exploit remotely.

    WordPress administrators are also being targeted by a phishing campaign attempting to trick them into installing malicious plugins using fake WordPress security advisories for a fictitious vulnerability tracked as CVE-2023-45124 as bait.

    Last week, WordPress also fixed a Property Oriented Programming (POP) chain vulnerability that could allow attackers to gain arbitrary PHP code execution under certain conditions (when combined with some plugins in multisite installations).

    Resource : https://www.bleepingcomputer.com/news/security/50k-wordpress-sites-exposed-to-rce-attacks-by-critical-bug-in-backup-plugin/?&web_view=true

    10Oct, 2023
    Latest Balada Injector Campaign Targets Unpatched tagDiv Plugin

    A  new wave of Balada malware injection attacks has been found exploiting a vulnerable tagDiv premium theme plugin to target Newspaper and Newsmag websites. The flaw in the question is an unauthenticated XSS vulnerability in the plugin that was first disclosed in September.

    The plugin is used by over 135,000 users, which emphasizes the risk associated with the attack.

    Attack methods

    The attackers are using different tactics and techniques to stay under the radar while duping users into visiting fake websites.

    • The first wave of attacks was launched by injecting two variants of Balada injector into public WordPress pages. 
    • While the first variant was detected on over 4,000 sites, the second variant was found on another 1,000 websites.
    • In the second wave of attacks, the attackers created malicious admin usernames and email IDs for the targeted sites to initiate the infection process or to plant backdoors.
    • The third wave involved planting the malware injector in the Newspaper theme’s 404.php file. 
    • Around September 17–18, in the fourth wave, the attackers shifted the existing infection process and began using a malicious wp-zexit plugin installation that mimicked the original installation page.
    • In the fifth wave, that started on September 21, attackers changed the location of the injection to the std_live_css_local_storage option in the WordPress database. Additionally, they registered three new domains within a period of seven seconds.  
    • The sixth wave began on September 29 and involved several different scripts that loaded malware from the subdomains of promsmotion[.]com.

    A similar incident in the past

    This is not the first time that malware operators have leveraged the plugin to target websites. The malware injector was part of a massive campaign that infected over one million WordPress websites over a duration of around five years, starting in 2017. The subdomains of these WordPress sites were injected with malicious scripts that redirected visitors to scam sites including fake tech support, fraudulent lottery wins, and push notification scams.

    Ending notes

    Researchers have shared the list of malicious domains and IP addresses to help organizations detect such threats. Updating the plugin to the latest version 4.2 and using website scanners helps users prevent infection. Furthermore, it is recommended to remove all unwanted admin users and redundant plugins to stay safe.

    Resource : https://cyware.com/news/latest-balada-injector-campaign-targets-unpatched-tagdiv-plugin-37f55318