{"id":93140,"date":"2020-09-03T07:42:03","date_gmt":"2020-09-03T05:42:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok"},"modified":"2020-09-03T07:42:03","modified_gmt":"2020-09-03T05:42:03","slug":"kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok","title":{"rendered":"Kritick\u00e1 zranitelnost v pluginu WordPress File Manager s 700 tis\u00edci instalacemi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V pluginu WordPress File Manager<\/a><\/noindex>, kter\u00fd m\u00e1 v\u00edce ne\u017e 700 tis\u00edc aktivn\u00edch instalac\u00ed, byla odhalena<\/a><\/noindex> existuje zranitelnost, kter\u00e1 umo\u017e\u0148uje spou\u0161t\u011bt libovoln\u00e9 p\u0159\u00edkazy a PHP skripty na serveru. Probl\u00e9m se objevuje ve verz\u00edch File Manager od 6.0 do 6.8 a byl odstran\u011bn ve verzi 6.9. <\/p>\n

Plugin File Manager poskytuje n\u00e1stroje pro spr\u00e1vu soubor\u016f pro administr\u00e1tora WordPressu, p\u0159i\u010dem\u017e pro n\u00edzko\u00farov\u0148ov\u00e9 manipulace se soubory vyu\u017e\u00edv\u00e1 vestav\u011bnou knihovnu elFinder<\/a><\/noindex>. V zdrojov\u00e9m k\u00f3du knihovny elFinder se nach\u00e1zej\u00ed soubory s p\u0159\u00edklady k\u00f3du, kter\u00e9 se dod\u00e1vaj\u00ed v pracovn\u00edm adres\u00e1\u0159i s p\u0159\u00edponou «.dist». Zranitelnost je zp\u016fsobena t\u00edm, \u017ee p\u0159i dod\u00e1n\u00ed knihovny byl soubor «connector.minimal.php.dist» p\u0159ejmenov\u00e1n na «connector.minimal.php» a stal se dostupn\u00fdm pro prov\u00e1d\u011bn\u00ed extern\u00edch po\u017eadavk\u016f. Uveden\u00fd skript umo\u017e\u0148uje prov\u00e1d\u011bt jak\u00e9koli operace se soubory (nahr\u00e1n\u00ed, otev\u0159en\u00ed, editor, p\u0159ejmenov\u00e1n\u00ed, smaz\u00e1n\u00ed atd.), proto\u017ee jeho parametry se p\u0159ed\u00e1vaj\u00ed funkci run() hlavn\u00edho pluginu, co\u017e m\u016f\u017ee b\u00fdt pou\u017eito k nahrazen\u00ed PHP soubor\u016f ve WordPressu a spu\u0161t\u011bn\u00ed libovoln\u00e9ho k\u00f3du.<\/p>\n

Nebezpe\u010d\u00ed zhor\u0161uje skute\u010dnost, \u017ee zranitelnost ji\u017e se pou\u017e\u00edv\u00e1<\/a><\/noindex> k prov\u00e1d\u011bn\u00ed automatizovan\u00fdch \u00fatok\u016f, p\u0159i kter\u00fdch je do adres\u00e1\u0159e «plugins\/wp-file-manager\/lib\/files\/» pomoc\u00ed p\u0159\u00edkazu «nahr\u00e1t» nahr\u00e1n obr\u00e1zek obsahuj\u00edc\u00ed PHP k\u00f3d, kter\u00fd je pot\u00e9 p\u0159ejmenov\u00e1n na PHP skript, jeho\u017e n\u00e1zev je vybr\u00e1n n\u00e1hodn\u011b a obsahuje text «hard» nebo «x.», nap\u0159\u00edklad hardfork.php, hardfind.php, x.php atd.). Po spu\u0161t\u011bn\u00ed PHP k\u00f3du p\u0159id\u00e1v\u00e1 zadn\u00ed vr\u00e1tka do soubor\u016f \/wp-admin\/admin-ajax.php a \/wp-includes\/user.php, co\u017e \u00fato\u010dn\u00edk\u016fm poskytuje p\u0159\u00edstup do administra\u010dn\u00edho rozhran\u00ed webu. Exploatace je realizov\u00e1na pomoc\u00ed zasl\u00e1n\u00ed POST po\u017eadavku na soubor «wp-file-manager\/lib\/php\/connector.minimal.php». <\/p>\n

Je zaj\u00edmav\u00e9, \u017ee po \u00fatoku, krom\u011b zanech\u00e1n\u00ed backdooru, jsou provedeny zm\u011bny pro ochranu p\u0159ed dal\u0161\u00edm p\u0159\u00edstupem k souboru connector.minimal.php, ve kter\u00e9m se nach\u00e1z\u00ed zranitelnost, s c\u00edlem zablokovat mo\u017enost \u00fatoku na server dal\u0161\u00edmi \u00fato\u010dn\u00edky.
\nPrvn\u00ed pokusy o \u00fatok byly zji\u0161t\u011bny 1. z\u00e1\u0159\u00ed v 7 hodin r\u00e1no (UTC). V
\n12:33 (UTC) v\u00fdvoj\u00e1\u0159i pluginu File Manager vydali opravu. Podle \u00fadaj\u016f spole\u010dnosti Wordfence, kter\u00e1 zranitelnost odhalila, jejich firewall zablokoval za den p\u0159ibli\u017en\u011b 450 tis\u00edc pokus\u016f o zneu\u017eit\u00ed zranitelnosti. Skener uk\u00e1zal, \u017ee 52 % web\u016f pou\u017e\u00edvaj\u00edc\u00edch tento plugin je\u0161t\u011b neprovedlo aktualizaci a z\u016fst\u00e1vaj\u00ed zraniteln\u00e9. Po instalaci aktualizace m\u00e1 smysl zkontrolovat v logu http serveru po\u017eadavky na skript «connector.minimal.php» pro ur\u010den\u00ed faktu kompromitace syst\u00e9mu.<\/p>\n

D\u00e1le lze zm\u00ednit opravn\u00fd vyd\u00e1n\u00ed WordPress 5.5.1<\/a><\/noindex> ve kter\u00e9m je navr\u017eeno 40 oprav<\/a><\/noindex>.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 File Manager, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 700 \u0442\u044b\u0441\u044f\u0447 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0438 PHP-\u0441\u043a\u0440\u0438\u043f\u0442\u044b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 File Manager \u0441 6.0 \u043f\u043e 6.8 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 6.9. \u041f\u043b\u0430\u0433\u0438\u043d File Manager \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u0430\u043c\u0438 \u0434\u043b\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 WordPress, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0434\u043b\u044f \u043d\u0438\u0437\u043a\u043e\u0443\u0440\u043e\u0432\u043d\u0435\u0432\u044b\u0445 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0439 \u0441 \u0444\u0430\u0439\u043b\u0430\u043c\u0438 \u0432\u0445\u043e\u0434\u044f\u0449\u0443\u044e \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-93140","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kritick\u00e1 zranitelnost v pluginu WordPress File Manager, kter\u00fd m\u00e1 700 tis\u00edc instalac\u00ed | ProHoster","description":"V pluginu WordPress File Manager, kter\u00fd m\u00e1 v\u00edce ne\u017e 700 tis\u00edc aktivn\u00edch instalac\u00ed,","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 File Manager, \u0438\u043c\u0435\u044e\u0449\u0435\u043c 700 \u0442\u044b\u0441\u044f\u0447 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a | ProHoster","og:description":"\u0412 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 File Manager, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 700 \u0442\u044b\u0441\u044f\u0447 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a,","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-03T05:42:03+00:00","article:modified_time":"2020-09-03T05:42:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"93140","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:54:01","updated":"2022-10-04 10:43:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/93140","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=93140"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/93140\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=93140"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=93140"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=93140"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}