{"id":93140,"date":"2020-09-03T07:42:03","date_gmt":"2020-09-03T05:42:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok"},"modified":"2020-09-03T07:42:03","modified_gmt":"2020-09-03T05:42:03","slug":"kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok","title":{"rendered":"Kritick\u00e1 zranite\u013enos\u0165 v plugine WordPress File Manager, ktor\u00fd m\u00e1 700 tis\u00edc in\u0161tal\u00e1ci\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Vo WordPress plugine Spr\u00e1vca s\u00faborov<\/a><\/noindex>, s viac ako 700 tis\u00edc akt\u00edvnymi in\u0161tal\u00e1ciami, bola zisten\u00e1<\/a><\/noindex> zranite\u013enos\u0165, ktor\u00e1 umo\u017e\u0148uje sp\u00fa\u0161\u0165anie \u013eubovo\u013en\u00fdch pr\u00edkazov a PHP skriptov na serveri. Probl\u00e9m sa prejavuje vo verzi\u00e1ch Spr\u00e1vca s\u00faborov od 6.0 do 6.8 a bol odstr\u00e1nen\u00fd vo verzii 6.9. <\/p>\n

Plugin Spr\u00e1vca s\u00faborov poskytuje n\u00e1stroje na spr\u00e1vu s\u00faborov pre administr\u00e1tora WordPress, pri\u010dom na n\u00edzko\u00farov\u0148ov\u00e9 manipul\u00e1cie so s\u00fabormi vyu\u017e\u00edva zabudovan\u00fa kni\u017enicu elFinder<\/a><\/noindex>. V zdrojovom k\u00f3de kni\u017enice elFinder s\u00fa s\u00fabory s pr\u00edkladmi k\u00f3du, ktor\u00e9 s\u00fa dod\u00e1van\u00e9 v pracovnom adres\u00e1ri s pr\u00edponou <.dist>. Zranite\u013enos\u0165 vznik\u00e1 t\u00fdm, \u017ee pri dodan\u00ed kni\u017enice bol s\u00fabor <connector.minimal.php.dist> premenovan\u00fd na <connector.minimal.php> a stal sa dostupn\u00fd na vykon\u00e1vanie pri odosielan\u00ed extern\u00fdch po\u017eiadaviek. Uveden\u00fd skript umo\u017e\u0148uje vykon\u00e1va\u0165 ak\u00e9ko\u013evek oper\u00e1cie so s\u00fabormi (upload, open, editor, rename, rm at\u010f.), preto\u017ee jeho parametre sa odovzd\u00e1vaj\u00fa do funkcie run() z\u00e1kladn\u00e9ho pluginu, \u010do m\u00f4\u017ee by\u0165 pou\u017eit\u00e9 na v\u00fdmenu PHP-s\u00faborov v WordPress a sp\u00fa\u0161\u0165anie \u013eubovo\u013en\u00e9ho k\u00f3du.<\/p>\n

Nebezpe\u010denstvo sa zhor\u0161uje t\u00fdm, \u017ee zranite\u013enos\u0165 je u\u017e sa pou\u017e\u00edva<\/a><\/noindex> na vykon\u00e1vanie automatizovan\u00fdch \u00fatokov, po\u010das ktor\u00fdch sa do adres\u00e1ra <plugins\/wp-file-manager\/lib\/files\/> pomocou pr\u00edkazu <upload> nahr\u00e1va obr\u00e1zok obsahuj\u00faci PHP-k\u00f3d, ktor\u00fd je n\u00e1sledne premenovan\u00fd na PHP-skript, jeho\u017e meno je vybran\u00e9 n\u00e1hodne a obsahuje text <hard> alebo <x.>, napr\u00edklad, hardfork.php, hardfind.php, x.php at\u010f.). Po spusten\u00ed PHP-k\u00f3d prid\u00e1va backdoor do s\u00faborov \/wp-admin\/admin-ajax.php a \/wp-includes\/user.php, poskytuj\u00facim \u00fato\u010dn\u00edkom pr\u00edstup do rozhrania administr\u00e1tora str\u00e1nky. Explot\u00e1cia prebieha cez odoslanie POST-\u017eiadosti k s\u00faboru <wp-file-manager\/lib\/php\/connector.minimal.php>. <\/p>\n

Zauj\u00edmav\u00e9 je, \u017ee po hacknut\u00ed okrem zanechania zadn\u00e9ho vchodu doch\u00e1dza k zmen\u00e1m na ochranu \u010fal\u0161\u00edch pokusov o pr\u00edstup k s\u00faboru connector.minimal.php, v ktorom sa nach\u00e1dza zranite\u013enos\u0165, s cie\u013eom zablokova\u0165 mo\u017enos\u0165 \u00fatoku na server in\u00fdmi \u00fato\u010dn\u00edkmi.
\nPrv\u00e9 pokusy o \u00fatok boli zisten\u00e9 1. septembra o 7:00 r\u00e1no (UTC). V
\n12:33 (UTC) v\u00fdvoj\u00e1ri pluginu File Manager vydali opravu. Pod\u013ea \u00fadajov spolo\u010dnosti Wordfence, ktor\u00e1 zranite\u013enos\u0165 odhalila, ich firewall zablokoval pribli\u017ene 450 000 pokusov o zneu\u017eitie zranite\u013enosti za jeden de\u0148. Skenovanie siete uk\u00e1zalo, \u017ee 52% str\u00e1nok, ktor\u00e9 pou\u017e\u00edvaj\u00fa tento plugin, e\u0161te nebolo aktualizovan\u00fdch a zost\u00e1vaj\u00fa zranite\u013en\u00e9. Po in\u0161tal\u00e1cii aktualiz\u00e1cie m\u00e1 zmysel skontrolova\u0165 v logu http-servera pr\u00edstupy k skriptu <connector.minimal.php> na potvrdenie faktu kompromit\u00e1cie syst\u00e9mu.<\/p>\n

Navy\u0161e m\u00f4\u017eeme spomen\u00fa\u0165 opravn\u00e9 vydanie WordPress 5.5.1<\/a><\/noindex> v ktorom s\u00fa navrhnut\u00e9 40 opr\u00e1v<\/a><\/noindex>.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 File Manager, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 700 \u0442\u044b\u0441\u044f\u0447 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0438 PHP-\u0441\u043a\u0440\u0438\u043f\u0442\u044b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 File Manager \u0441 6.0 \u043f\u043e 6.8 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 6.9. \u041f\u043b\u0430\u0433\u0438\u043d File Manager \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u0430\u043c\u0438 \u0434\u043b\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 WordPress, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0434\u043b\u044f \u043d\u0438\u0437\u043a\u043e\u0443\u0440\u043e\u0432\u043d\u0435\u0432\u044b\u0445 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0439 \u0441 \u0444\u0430\u0439\u043b\u0430\u043c\u0438 \u0432\u0445\u043e\u0434\u044f\u0449\u0443\u044e \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-93140","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kritick\u00e1 zranite\u013enos\u0165 v pluginu File Manager pre WordPress s 700 tis\u00edc in\u0161tal\u00e1ciami | ProHoster","description":"V pluginu File Manager pre WordPress, ktor\u00fd m\u00e1 viac ako 700 tis\u00edc akt\u00edvnych in\u0161tal\u00e1ci\u00ed,","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 File Manager, \u0438\u043c\u0435\u044e\u0449\u0435\u043c 700 \u0442\u044b\u0441\u044f\u0447 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a | ProHoster","og:description":"\u0412 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d\u0435 File Manager, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 700 \u0442\u044b\u0441\u044f\u0447 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a,","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/kriticheskaya-uyazvimost-v-wordpress-plagine-file-manager-imeyushhem-700-tysyach-ustanovok","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-03T05:42:03+00:00","article:modified_time":"2020-09-03T05:42:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"93140","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:54:01","updated":"2022-10-04 10:43:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/93140","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=93140"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/93140\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=93140"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=93140"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=93140"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}