Hackers Actively Exploiting Widely
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-9978 | Stored XSS in WordPress Social Warfare Plugin (CVE-2019-9978) Exploited in the Wild CVE-2019-9978 is a stored cross-site scripting (CWE-79) flaw in the Social Warfare social-sharing plugin for WordPress: the plugin's debug routine at wp-admin/admin-post.php?swp_debug=load_options accepts an unauthenticated swp_url parameter and uses it to pull in attacker-controlled settings/content that is then persisted on the site. An attacker triggers the flaw by simply sending an unauthenticated request to admin-post.php with swp_debug=load_options and a crafted swp_url; the injected content later executes in the browsers of WordPress administrators when they view the affected dashboard or pages. Successful exploitation lets an attacker run arbitrary JavaScript in admin sessions, change plugin and site settings, and inject malicious scripts, redirects, or content into the site; public PoCs and the in-the-wild exploits were described as escalating to remote code execution. Any WordPress site running Social Warfare or Social Warfare Pro before version 3.5.3 is affected. The flaw was exploited as a zero-day in March 2019, is on CISA's KEV (added 2021-11-03) with a 72.9% EPSS (99th percentile), and related reporting indicates widespread active exploitation with follow-on web shell activity. Do: Upgrade Social Warfare and Social Warfare Pro to version 3.5.3 or later immediately (apply updates per vendor instructions) and verify the installed version under Plugins in wp-admin. If updating is not possible right away, deactivate the plugin or block unauthenticated requests to admin-post.php that include the swp_debug parameter. Review plugin settings, posts, and pages for injected JavaScript, check administrator accounts for additions or changes, and hunt for web shells given reported follow-on deployments. | 6.1 | 73% | KEV PoC ×5 |
| largeroughly tens of thousands of sites (≈60,000–70,000 WordPress installs at the time of the March 2019 disclosure) |
Full article455 words · extracted from thehackernews.com · click to collapse
Swati KhandelwalApr 23, 2019
Hackers have been found exploiting a pair of critical security vulnerabilities in one of the popular social media sharing plugins to take control over WordPress websites that are still running a vulnerable version of the plugin.
The vulnerable plugin in question is Social Warfare which is a popular and widely deployed WordPress plugin with more than 900,000 downloads. It is used to add social share buttons to a WordPress website or blog.
Late last month, maintainers of Social Warfare for WordPress released an updated version 3.5.3 of their plugin to patch two security vulnerabilities—stored cross-site scripting (XSS) and remote code execution (RCE)—both tracked by a single identifier, i.e., CVE-2019-9978.
Hackers can exploit these vulnerabilities to run arbitrary PHP code and take complete control over websites and servers without authentication, and then use the compromised sites to perform digital coin mining or host malicious exploit code.
However, the same day when Social Warfare released the patched version of its plugin, an unnamed security researcher published a full disclosure and a proof-of-concept for the stored Cross-Site Scripting (XSS) vulnerability.
Soon after the full disclosure and PoC release, attackers started attempting to exploit the vulnerability, but fortunately, it was only limited to the injected JavaScript redirect activity, with researchers finding no in-the-wild attempts to exploit the RCE vulnerability.
Now, Palo Alto Network Unit 42 researchers found several exploits taking advantage of these vulnerabilities in the wild, including an exploit for the RCE vulnerability which allows the attacker to control the affected website and an exploit for the XSS vulnerability which redirects victims to an ads site.
Though both flaws originated because of improper input handling, using a wrong, insufficient function eventually made it possible for remote attackers to exploit them without requiring any authentication.
"The root cause of each of these two vulnerabilities is the same: the misuse of the is_admin() function in WordPress," the researchers say in a blog post. "Is_admin only checks if the requested page is part of admin interface and won't prevent any unauthorized visit."
At the time of writing, more than 37,000 WordPress websites out of 42,000 active sites, including education, finance, and news sites (some Alexa's top ranking websites), are still using an outdated, vulnerable version of the Social Warfare plugin, leaving hundreds of millions of their visitors at the risk of hacking through various other vectors.
Since it is likely the attackers will continue to exploit the vulnerabilities to target WordPress users, website administrators are highly recommended to update the Social Warfare plugin to 3.5.3 or newer version as soon as possible.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2019/04/wordpress-plugin-hacking.html