{"id":103386,"date":"2022-02-19T09:36:57","date_gmt":"2022-02-19T07:36:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok"},"modified":"2022-02-19T09:36:57","modified_gmt":"2022-02-19T07:36:57","slug":"utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok","title":{"rendered":"Database leak in the WordPress plugin UpdraftPlus, which has 3 million installations.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A dangerous vulnerability (CVE-2022-0633) has been identified in the UpdraftPlus WordPress plugin, which has over 3 million active installations. This vulnerability allows an unauthorized user to download a copy of the site's database, which contains not only the content but also user parameters and password hashes. The issue has been resolved in versions 1.22.3 and 2.22.3, which are recommended for all UpdraftPlus users to install as soon as possible. <\/p>\n
UpdraftPlus is presented as the most popular backup plugin for websites powered by the WordPress platform. Due to improper access control checks, the plugin allowed backups of the site and associated databases to be downloaded not only by administrators but by any registered user of the site, such as those with subscriber status. <\/p>\n
To download backups in UpdraftPlus, an identifier is generated based on the creation time of the backup and a random sequence (nonce). The problem lies in the fact that due to the lack of proper checks in the WordPress heartbeat request handler, an attacker can retrieve information about the latest backup through a specially formatted request, which includes details about the time and the associated random sequence. <\/p>\n
Based on the obtained information, an identifier can be formed, and a backup can be uploaded using the email upload method. The function maybe_download_backup_from_email used in this method requires accessing the options-general.php page, which is available only to the administrator. However, an attacker can bypass this restriction by spoofing the $pagenow variable used in the check and sending a request through a service page that allows access to non-privileged users. For example, one could access it through the administrator's message sending page by sending a request in the form of 'wp-admin\/admin-post.php\/\/wp-admin\/options-general.php?page=updraftplus'. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"