{"id":93140,"date":"2020-09-03T07:42:03","date_gmt":"2020-09-03T05:42:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok"},"modified":"2020-09-03T07:42:03","modified_gmt":"2020-09-03T05:42:03","slug":"kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok","title":{"rendered":"Vulnerabilit\u00e0 critica nel plugin File Manager di WordPress, che conta 700.000 installazioni.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Nel plugin WordPress <noindex><a rel=\"nofollow\" href=\"https:\/\/wordpress.org\/plugins\/wp-file-manager\/\">File Manager<\/a><\/noindex>, che conta oltre 700.000 installazioni attive, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.wordfence.com\/blog\/2020\/09\/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin\/\">\u00e8 stata rilevata<\/a><\/noindex> \u00e8 stata trovata una vulnerabilit\u00e0 che consente di eseguire comandi arbitrari e script PHP sul server. Il problema si manifesta nelle versioni di File Manager dalla 6.0 alla 6.8 ed \u00e8 stato risolto nella versione 6.9. <\/p>\n<p>Il plugin File Manager offre strumenti per la gestione dei file per gli amministratori di WordPress, utilizzando per le manipolazioni a basso livello dei file la libreria integrata <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Studio-42\/elFinder\">elFinder<\/a><\/noindex>. Nel codice sorgente della libreria elFinder ci sono file con esempi di codice, che vengono forniti nella cartella di lavoro con estensione &#171;.dist&#187;. La vulnerabilit\u00e0 \u00e8 causata dal fatto che, durante la fornitura della libreria, il file &#171;connector.minimal.php.dist&#187; \u00e8 stato rinominato in &#171;connector.minimal.php&#187; ed \u00e8 diventato accessibile per l'esecuzione tramite richieste esterne. Lo script indicato consente di eseguire qualsiasi operazione con i file (upload, open, editor, rename, rm, ecc.), poich\u00e9 i suoi parametri vengono passati alla funzione run() del plugin principale, il che pu\u00f2 essere utilizzato per sostituire i file PHP in WordPress e per eseguire codice arbitrario.<\/p>\n<p>Il pericolo \u00e8 aggravato dal fatto che la vulnerabilit\u00e0 \u00e8 gi\u00e0 <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.nintechnet.com\/critical-zero-day-vulnerability-fixed-in-wordpress-file-manager-700000-installations\/\">viene utilizzato<\/a><\/noindex> per effettuare attacchi automatizzati, durante i quali viene caricato nella directory &#171;plugins\/wp-file-manager\/lib\/files\/&#187; un'immagine contenente codice PHP, utilizzando il comando &#171;upload&#187;, che viene poi rinominata in script PHP, il cui nome viene scelto casualmente e contiene il testo &#171;hard&#187; o &#171;x.&#187;, ad esempio, hardfork.php, hardfind.php, x.php, ecc.). Una volta avviato, il codice PHP aggiunge un backdoor ai file \/wp-admin\/admin-ajax.php e \/wp-includes\/user.php, fornendo agli aggressori l'accesso all'interfaccia di amministrazione del sito. Lo sfruttamento avviene tramite l'invio di una richiesta POST al file &#171;wp-file-manager\/lib\/php\/connector.minimal.php&#187;. <\/p>\n<p>\u00c8 interessante notare che dopo l'hacking, oltre a lasciare un backdoor, vengono apportate modifiche per proteggere ulteriori accessi al file connector.minimal.php, nel quale risiede la vulnerabilit\u00e0, al fine di bloccare la possibilit\u00e0 di attacchi al server da parte di altri aggressori.<br \/>\nLe prime tentativi di attacco sono stati rilevati il 1 settembre alle 7:00 (UTC). Alle<br \/>\n12:33 (UTC) gli sviluppatori del plugin File Manager hanno rilasciato una patch. Secondo i dati dell'azienda Wordfence, che ha rilevato la vulnerabilit\u00e0, nel giro di un giorno il loro firewall ha bloccato circa 450.000 tentativi di sfruttamento della vulnerabilit\u00e0. La scansione della rete ha mostrato che il 52% dei siti che utilizzano questo plugin non ha ancora effettuato aggiornamenti e rimangono vulnerabili. Dopo l'installazione dell'aggiornamento, \u00e8 opportuno controllare nel log del server HTTP le richieste allo script &#171;connector.minimal.php&#187; per determinare se ci sono stati compromissioni nel sistema.<\/p>\n<p>\u00c8 inoltre possibile notare il rilascio correttivo di <noindex><a rel=\"nofollow\" href=\"https:\/\/wordpress.org\/news\/2020\/09\/wordpress-5-5-1-maintenance-release\/\">WordPress 5.5.1<\/a><\/noindex> nel quale sono stati proposti <noindex><a rel=\"nofollow\" href=\"https:\/\/core.trac.wordpress.org\/query?status=closed&#038;milestone=5.5.1&#038;group=status&#038;col=id&#038;col=summary&#038;col=milestone&#038;col=owner&#038;col=type&#038;col=status&#038;col=priority&#038;order=priority\">40 correttivi.<\/a><\/noindex>.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Fonte: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53646\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 File Manager, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 700 \u0442\u044b\u0441\u044f\u0447 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0438 PHP-\u0441\u043a\u0440\u0438\u043f\u0442\u044b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 File Manager \u0441 6.0 \u043f\u043e 6.8 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 6.9. \u041f\u043b\u0430\u0433\u0438\u043d File Manager \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u0430\u043c\u0438 \u0434\u043b\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 WordPress, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0434\u043b\u044f \u043d\u0438\u0437\u043a\u043e\u0443\u0440\u043e\u0432\u043d\u0435\u0432\u044b\u0445 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0439 \u0441 \u0444\u0430\u0439\u043b\u0430\u043c\u0438 \u0432\u0445\u043e\u0434\u044f\u0449\u0443\u044e \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-93140","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 File Manager, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 700 \u0442\u044b\u0441\u044f\u0447 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a,\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/it\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"it_IT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 File Manager, \u0438\u043c\u0435\u044e\u0449\u0435\u043c 700 \u0442\u044b\u0441\u044f\u0447 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 File Manager, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 700 \u0442\u044b\u0441\u044f\u0447 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a,\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/it\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-09-03T05:42:03+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-09-03T05:42:03+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilit\u00e0 critica nel plugin WordPress File Manager, con 700.000 installazioni | ProHoster","description":"Nel plugin File Manager per WordPress, che conta oltre 700.000 installazioni attive,","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 File Manager, \u0438\u043c\u0435\u044e\u0449\u0435\u043c 700 \u0442\u044b\u0441\u044f\u0447 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a | ProHoster","og:description":"\u0412 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 File Manager, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 700 \u0442\u044b\u0441\u044f\u0447 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a,","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-03T05:42:03+00:00","article:modified_time":"2020-09-03T05:42:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"93140","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:54:01","updated":"2022-10-04 10:43:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/93140","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=93140"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/93140\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=93140"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=93140"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=93140"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}