{"id":93140,"date":"2020-09-03T07:42:03","date_gmt":"2020-09-03T05:42:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok"},"modified":"2020-09-03T07:42:03","modified_gmt":"2020-09-03T05:42:03","slug":"kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok","title":{"rendered":"Krytyczna luka wtyczki WordPress File Manager z 700 tysi\u0105cami instalacji","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

W wtyczce WordPress Menad\u017cer plik\u00f3w<\/a><\/noindex>, kt\u00f3ra ma ponad 700 tysi\u0119cy aktywnych instalacji, wykryto<\/a><\/noindex> znaleziono luk\u0119, kt\u00f3ra umo\u017cliwia wykonywanie dowolnych polece\u0144 i skrypt\u00f3w PHP na serwerze. Problem wyst\u0119puje w wersjach Menad\u017cera plik\u00f3w od 6.0 do 6.8 i zosta\u0142 naprawiony w wersji 6.9. <\/p>\n

Wtyczka Menad\u017cer plik\u00f3w udost\u0119pnia narz\u0119dzia do zarz\u0105dzania plikami dla administratora WordPress, korzystaj\u0105c z wbudowanej biblioteki elFinder<\/a><\/noindex>. W kodzie \u017ar\u00f3d\u0142owym biblioteki elFinder znajduj\u0105 si\u0119 pliki z przyk\u0142adami kodu, kt\u00f3re dostarczane s\u0105 w katalogu roboczym z rozszerzeniem «.dist». Luka bezpiecze\u0144stwa wynika z faktu, \u017ce podczas dostawy biblioteki plik «connector.minimal.php.dist» zosta\u0142 przemianowany na «connector.minimal.php» i sta\u0142 si\u0119 dost\u0119pny do wykonania przy wysy\u0142aniu zewn\u0119trznych zapyta\u0144. Wskazany skrypt pozwala na wykonywanie wszelkich operacji na plikach (upload, open, editor, rename, rm itd.), poniewa\u017c jego parametry s\u0105 przekazywane do funkcji run() g\u0142\u00f3wnego wtyczki, co mo\u017ce by\u0107 u\u017cyte do wymiany plik\u00f3w PHP w WordPressie oraz uruchamiania dowolnego kodu.<\/p>\n

Zagro\u017cenie pot\u0119guje fakt, \u017ce luka zosta\u0142a ju\u017c jest u\u017cywane<\/a><\/noindex> do przeprowadzania zautomatyzowanych atak\u00f3w, w trakcie kt\u00f3rych do katalogu «plugins\/wp-file-manager\/lib\/files\/» za pomoc\u0105 polecenia «upload» przesy\u0142any jest obraz zawieraj\u0105cy kod PHP, kt\u00f3ry nast\u0119pnie jest przemianowywany na skrypt PHP, kt\u00f3rego nazwa jest wybierana losowo i zawiera tekst «hard» lub «x.», na przyk\u0142ad hardfork.php, hardfind.php, x.php itp.). Po uruchomieniu kod PHP dodaje backdoora do plik\u00f3w \/wp-admin\/admin-ajax.php oraz \/wp-includes\/user.php, co umo\u017cliwia hakerom dost\u0119p do panelu administratora strony. Eksploatacja odbywa si\u0119 poprzez wysy\u0142anie zapytania POST do pliku «wp-file-manager\/lib\/php\/connector.minimal.php». <\/p>\n

Co ciekawe, po w\u0142amaniach opr\u00f3cz pozostawienia backdoora wprowadzane s\u0105 zmiany maj\u0105ce na celu ochron\u0119 przed dalszymi pr\u00f3bami dost\u0119pu do pliku connector.minimal.php, w kt\u00f3rym znajduje si\u0119 luka, aby zablokowa\u0107 mo\u017cliwo\u015b\u0107 ataku na serwer przez innych intruz\u00f3w.
\nPierwsze pr\u00f3by ataku zosta\u0142y wykryte 1 wrze\u015bnia o godzinie 7:00 (UTC). W
\n12:33 (UTC) deweloperzy wtyczki File Manager opublikowali poprawk\u0119. Wed\u0142ug danych firmy Wordfence, kt\u00f3ra zidentyfikowa\u0142a luk\u0119, w ci\u0105gu jednego dnia ich zapora sieciowa zablokowa\u0142a oko\u0142o 450 tysi\u0119cy pr\u00f3b eksploatacji tej luki. Skanowanie sieci wykaza\u0142o, \u017ce 52% stron korzystaj\u0105cych z tej wtyczki nie zaktualizowa\u0142o jej i pozostaje nara\u017conych na ataki. Po zainstalowaniu aktualizacji warto sprawdzi\u0107 w logach serwera http zapytania do skryptu «connector.minimal.php» w celu ustalenia, czy system zosta\u0142 skompromitowany.<\/p>\n

Dodatkowo mo\u017cna wspomnie\u0107 o wydaniu poprawki WordPress 5.5.1<\/a><\/noindex> w kt\u00f3rej zaproponowano 40 poprawek<\/a><\/noindex>.<\/p>\n

<\/a><\/noindex><\/p>\n

\u0179r\u00f3d\u0142o: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 File Manager, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 700 \u0442\u044b\u0441\u044f\u0447 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0438 PHP-\u0441\u043a\u0440\u0438\u043f\u0442\u044b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 File Manager \u0441 6.0 \u043f\u043e 6.8 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 6.9. \u041f\u043b\u0430\u0433\u0438\u043d File Manager \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u0430\u043c\u0438 \u0434\u043b\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 WordPress, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0434\u043b\u044f \u043d\u0438\u0437\u043a\u043e\u0443\u0440\u043e\u0432\u043d\u0435\u0432\u044b\u0445 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0439 \u0441 \u0444\u0430\u0439\u043b\u0430\u043c\u0438 \u0432\u0445\u043e\u0434\u044f\u0449\u0443\u044e \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-93140","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Krytyczna luka w wtyczce File Manager dla WordPressa, maj\u0105cej 700 tysi\u0119cy instalacji | ProHoster","description":"W wtyczce File Manager dla WordPressa, kt\u00f3ra ma ponad 700 tysi\u0119cy aktywnych instalacji,","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 File Manager, \u0438\u043c\u0435\u044e\u0449\u0435\u043c 700 \u0442\u044b\u0441\u044f\u0447 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a | ProHoster","og:description":"\u0412 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 File Manager, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 700 \u0442\u044b\u0441\u044f\u0447 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a,","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-03T05:42:03+00:00","article:modified_time":"2020-09-03T05:42:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"93140","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:54:01","updated":"2022-10-04 10:43:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/93140","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=93140"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/93140\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=93140"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=93140"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=93140"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}