{"id":93140,"date":"2020-09-03T07:42:03","date_gmt":"2020-09-03T05:42:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok"},"modified":"2020-09-03T07:42:03","modified_gmt":"2020-09-03T05:42:03","slug":"kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok","title":{"rendered":"Kriitiline haavatavus WordPressi plugina File Manageris, millel on 700 tuhat paigaldust.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

WordPressi pistikprogrammis Failihaldur<\/a><\/noindex>, millel on rohkem kui 700 000 aktiivset installatsiooni, tuvastatud<\/a><\/noindex> on haavatavus, mis v\u00f5imaldab serveris k\u00e4ivitada mis tahes k\u00e4ske ja PHP-skripte. Probleem ilmneb Failihalduri versioonides 6.0 kuni 6.8 ja on lahendatud versioonis 6.9. <\/p>\n

Failihalduri pistikprogramm pakub WordPressi administraatorile failihalduse t\u00f6\u00f6riistu, kasutades madalama taseme failimanipulatsioonide jaoks kaasasolevat teeki elFinder<\/a><\/noindex>. El Finder'i teekonna l\u00e4htekoodis on faile, mis sisaldavad koodin\u00e4iteid, mis tarnitakse t\u00f6\u00f6kaartides laiendusega «.dist». Haavatavus tuleneb sellest, et teegi tarnimise k\u00e4igus nimetati fail «connector.minimal.php.dist» \u00fcmber failiks «connector.minimal.php» ja see sai v\u00e4liste p\u00e4ringute saatmise korral k\u00e4ivitatavaks. Antud skript lubab teha k\u00f5iki toiminguid failidega (\u00fcleslaadimine, avamine, redigeerimine, taasnimetamine, kustutamine jne), kuna selle parameetrid edastatakse p\u00f5hilisete pluginate run() funktsiooni, mis v\u00f5ib kasutada PHP faile WordPressis ja t\u00e4ita suvalist koodi.<\/p>\n

Oht s\u00fcveneb, kuna haavatavust on juba kasutatakse<\/a><\/noindex> automaatsete r\u00fcnnakute l\u00e4biviimiseks, mille k\u00e4igus laaditakse katalooge «plugins\/wp-file-manager\/lib\/files\/» kaudu \u00fcles pilt, mis sisaldab PHP-koodi, mis muudetakse seej\u00e4rel PHP-skriptiks, mille nimi valitakse juhuslikult ja sisaldab teksti «hard» v\u00f5i «x.», n\u00e4iteks hardfork.php, hardfind.php, x.php jne.). P\u00e4rast PHP-koodi k\u00e4ivitamist lisatakse tagauks failidesse \/wp-admin\/admin-ajax.php ja \/wp-includes\/user.php, mis v\u00f5imaldab kurjategijatel p\u00e4\u00e4seda saidi administraatori liidesesse. Ekspluateerimine toimub, saates POST-p\u00e4ringu failile «wp-file-manager\/lib\/php\/connector.minimal.php». <\/p>\n

On t\u00e4helepanuv\u00e4\u00e4rne, et p\u00e4rast h\u00e4kkimist ei j\u00e4eta ainult backdoorit, vaid tehakse muudatusi, et kaitsta edasiste juurdep\u00e4\u00e4sude eest failile connector.minimal.php, kus haavatavus asub, eesm\u00e4rgiga blokeerida teiste kurjategijate v\u00f5imalus serverit r\u00fcnnata.
\nEsimesed r\u00fcnnaku katse tuvastati 1. septembril kell 7 hommikul (UTC).
\n12:33 (UTC) vabastas File Manageri plugina arendaja plaastri. Vastavalt haavatavust tuvastanud ettev\u00f5tte Wordfence andmetele blokeeris nende tulem\u00fc\u00fcr \u00fche p\u00e4eva jooksul umbes 450 000 ekspluateerimise katset. V\u00f5rgus skanneerimine n\u00e4itas, et 52% selle plugina kasutavatest veebisaitidest ei ole veel uuendust teinud ja j\u00e4\u00e4vad haavatavaks. Uuenduse installimise j\u00e4rel on m\u00f5istlik kontrollida http-serveri logisid, et n\u00e4ha, kas «connector.minimal.php» skripti on kutsutud, et m\u00e4\u00e4rata s\u00fcsteemi kompromiteerimise fakt.<\/p>\n

Lisaks v\u00f5ib m\u00e4rkida ka parandava v\u00e4ljaande WordPress 5.5.1<\/a><\/noindex> milles on tehtud 40 parandust<\/a><\/noindex>.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 File Manager, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 700 \u0442\u044b\u0441\u044f\u0447 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0438 PHP-\u0441\u043a\u0440\u0438\u043f\u0442\u044b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 File Manager \u0441 6.0 \u043f\u043e 6.8 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 6.9. \u041f\u043b\u0430\u0433\u0438\u043d File Manager \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u0430\u043c\u0438 \u0434\u043b\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 WordPress, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0434\u043b\u044f \u043d\u0438\u0437\u043a\u043e\u0443\u0440\u043e\u0432\u043d\u0435\u0432\u044b\u0445 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0439 \u0441 \u0444\u0430\u0439\u043b\u0430\u043c\u0438 \u0432\u0445\u043e\u0434\u044f\u0449\u0443\u044e \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-93140","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kriitiline haavatavus WordPressi pluginas File Manager, millel on 700 000 installatsiooni | ProHoster","description":"WordPressi pluginas File Manager, millel on \u00fcle 700 000 aktiivse installatsiooni,","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 File Manager, \u0438\u043c\u0435\u044e\u0449\u0435\u043c 700 \u0442\u044b\u0441\u044f\u0447 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a | ProHoster","og:description":"\u0412 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 File Manager, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 700 \u0442\u044b\u0441\u044f\u0447 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a,","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-03T05:42:03+00:00","article:modified_time":"2020-09-03T05:42:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"93140","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:54:01","updated":"2022-10-04 10:43:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/93140","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=93140"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/93140\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=93140"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=93140"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=93140"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}