Stories
Slash Boxes
Comments

SoylentNews is people

posted by janrinok on Friday February 21 2020, @09:40PM   Printer-friendly
from the do-people-still-use-WordPress? dept.

Hackers exploit critical vulnerability found in ~100,000 WordPress sites:

Hackers are actively exploiting a critical WordPress plugin vulnerability that allows them to completely wipe all website databases and, in some cases, seize complete control of affected sites.

The flaw is in the ThemeGrill Demo Importer installed on some 100,000 sites, and it was disclosed over the weekend by Website security company WebARX. By Tuesday, WebArx reported that the flaw was under active exploit with almost 17,000 attacks blocked so far. Hanno Böck, a journalist who works for Golem.de, also spotted active attacks and reported them on Twitter.

"There's currently a severe vuln in a wordpress plugin called "themegrill demo importer" that resets the whole database," Böck wrote. "https://webarxsecurity.com/critical-issue-in-themegrill-demo-importer/ It seems attacks are starting: Some of the affected webpages show a wordpress 'hello world'-post. /cc If you use this plugin and your webpage hasn't been deleted yet consider yourself lucky. And remove the plugin. (Yes, remove it, don't just update.)"

[...] The bug stems from a failure to authenticate users before allowing them to carry out privileged administrative commands. Hackers can abuse this failure by sending Web requests that contain specially crafted text strings.

"This is a serious vulnerability and can cause a significant amount of damage," WebARX researchers wrote in this weekend's disclosure. "Since it requires no suspicious-looking payload just like our previous finding in InfiniteWP, it is not expected for any firewall to block this by default, and a special rule needs to be created to block this vulnerability."

Specifically, the vulnerability allows attackers to delete all tables and populate the database with default settings and data. Accounts named "admin," assuming any exist, are set to their previously known password. In the event accounts named admin exist, the attacker will find themselves logged in with administrative rights.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by Booga1 on Friday February 21 2020, @10:06PM (2 children)

    by Booga1 (6333) on Friday February 21 2020, @10:06PM (#960852)

    WordPress plugin programmers, is there anything they can't screw up?

    Seriously, every time I hear about WordPress and security vulnerabilities it's almost always some crappy plugin that's to blame.

    Not that WordPress is blameless. Their security record is rife with vulnerabilities. Yet, the plugins are just astronomically that much worse.

    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2  
  • (Score: 2) by Common Joe on Saturday February 22 2020, @04:53PM (1 child)

    by Common Joe (33) <{common.joe.0101} {at} {gmail.com}> on Saturday February 22 2020, @04:53PM (#961062) Journal

    Plugins are a thing with so many applications these days. It makes one wonder, how do most applications ensure their plugins are secure? Or is that possible? It's been an interesting to watch Chrome and Firefox dance with their plugin history.

    • (Score: 1, Informative) by Anonymous Coward on Sunday February 23 2020, @07:40PM

      by Anonymous Coward on Sunday February 23 2020, @07:40PM (#961521)

      If you offer a way to load 3rd party executable code there is no way to make that secure, ever. At the point the plugin is allowed to execute it's already on the other side of the hatch. Users need to be made aware of that, that's about all you can really do (anything else is snakeoil).