{"id":103386,"date":"2022-02-19T09:36:57","date_gmt":"2022-02-19T07:36:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok"},"modified":"2022-02-19T09:36:57","modified_gmt":"2022-02-19T07:36:57","slug":"utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok","title":{"rendered":"WordPressi plugina UpdraftPlus andmebaasi lekkimine, millel on 3 miljonit installi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

WordPress'i lisas UpdraftPlus, millel on rohkem kui 3 miljonit aktiivset installatsiooni, on avastatud ohtlik haavatavus (CVE-2022-0633), mis v\u00f5imaldab kolmandatel isikutel laadida alla saidi andmebaasi koopia, milles lisaks sisule on ka k\u00f5igi kasutajate parameetrid ja paroolide r\u00e4si. Probleem on lahendatud versioonides 1.22.3 ja 2.22.3, mille paigaldamist soovitatakse k\u00f5igile UpdraftPlus kasutajatele niipea kui v\u00f5imalik. <\/p>\n

UpdraftPlus esitleb ennast kui k\u00f5ige populaarsemat lisandmoodulit veebisaitide varundamiseks, mis toimivad WordPress'i platvormil. Vale juurdep\u00e4\u00e4su kontrollimise t\u00f5ttu v\u00f5imaldas lisa laadida mitte ainult administraatoritele, vaid ka igale saidil registreeritud kasutajale, n\u00e4iteks tellijast kasutajale, saidi varukoopia ja sellega seotud andmebaasi. <\/p>\n

UpdraftPlus'is varukoopiate laadimiseks kasutatakse identifikaatorit, mis genereeritakse varukoopia loomise kuup\u00e4eva ja juhusliku j\u00e4rjestuse (nonce) p\u00f5hjal. Probleem on selles, et WordPress'i heartbeat-p\u00e4ringute t\u00f6\u00f6tlejas puudub korralik kontroll ja h\u00e4kitud p\u00e4ringu kaudu saab iga kasutaja teavet viimasest varukoopiest, mis sisaldab ka aega ja sellega seotud juhuslikku j\u00e4rjestust. <\/p>\n

Edasi on saadud teabe p\u00f5hjal v\u00f5imalik luua identifikaator ja laadida varukoopia, kasutades e-posti kaudu laadimise meetodit. Selle meetodi puhul n\u00f5uab funktsioon maybe_download_backup_from_email, et p\u00e4\u00e4seda lehele options-general.php, mis on saadaval ainult administraatorile. Siiski v\u00f5ib r\u00fcndaja selle piiri \u00fcletada, pettes kasutatava kontrollmuutuja $pagenow ja saates p\u00e4ringu kaudu teenuslehe, mis lubab madala privileegiga kasutajate juurdep\u00e4\u00e4su. N\u00e4iteks v\u00f5ib p\u00f6\u00f6rduda administraatori s\u00f5numite saatmise lehe kaudu, saates p\u00e4ringu kujul 'wp-admin\/admin-post.php\/\/wp-admin\/options-general.php?page=updraftplus'.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 WordPress-\u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 UpdraftPlus, \u0438\u043c\u0435\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 3 \u043c\u043b\u043d \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-0633), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043a\u043e\u043f\u0438\u044e \u0431\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0430\u0439\u0442\u0430, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043a\u0440\u043e\u043c\u0435 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442\u0441\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0432\u0441\u0435\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u0445\u044d\u0448\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 1.22.3 \u0438 2.22.3, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0432\u0441\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c UpdraftPlus. UpdraftPlus \u043f\u0440\u0435\u043f\u043e\u0434\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a\u0430\u043a \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0434\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103386","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Andmebaasi lekkimine WordPress'i lisas UpdraftPlus, millel on 3 miljonit installatsiooni | ProHoster","description":"WordPress'i lisas UpdraftPlus, millel on rohkem kui 3 miljonit aktiivset installatsiooni, on avastatud ohtlik haavatavus (CVE-2022-0633), mis v\u00f5imaldab kolmandatel isikutel laadida alla saidi andmebaasi koopia, milles lisaks sisule.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0442\u0435\u0447\u043a\u0430 \u0411\u0414 \u0432 WordPress-\u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 UpdraftPlus, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c 3 \u043c\u043b\u043d \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a | ProHoster","og:description":"\u0412 WordPress-\u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 UpdraftPlus, \u0438\u043c\u0435\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 3 \u043c\u043b\u043d \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-0633), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043a\u043e\u043f\u0438\u044e \u0431\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0430\u0439\u0442\u0430, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043a\u0440\u043e\u043c\u0435 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/utechka-bd-v-wordpress-dopolnenii-updraftplus-naschityvayushhem-3-mln-ustanovok","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-02-19T07:36:57+00:00","article:modified_time":"2022-02-19T07:36:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103386","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-02-19 07:37:38","updated":"2022-10-06 02:55:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103386","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=103386"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103386\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=103386"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=103386"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=103386"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}