Para panyerang junun ngalebetkeun backdoor kana 40 plugins sareng 53 téma pikeun sistem manajemen eusi WordPress, dikembangkeun ku AccessPress, anu nyatakeun yén tambihanana dianggo dina langkung ti 360 rébu situs. Hasil analisa kajadian éta henteu acan disayogikeun, tapi dianggap yén kode jahat diwanohkeun nalika kompromi situs wéb AccessPress, ngajantenkeun parobihan kana arsip anu ditawarkeun pikeun diunduh kalayan sékrési anu parantos dileupaskeun, sabab aya backdoor. ngan dina kode nu disebarkeun ngaliwatan ramatloka resmi AccessPress, tapi teu aya dina eta kaluaran sarua add-on disebarkeun ngaliwatan diréktori WordPress.org.
Parobahan jahat kapanggih ku panalungtik di JetPack (divisi pangembang WordPress Otomatis) bari nalungtik kode jahat kapanggih dina ramatloka klien urang. Analisis kaayaan némbongkeun yén parobahan jahat anu hadir dina WordPress nambahkeun-on diundeur ti ramatloka resmi AccessPress. tambihan séjén ti produsén anu sarua ogé tunduk kana modifikasi jahat anu ngamungkinkeun aksés pinuh ka loka kalawan hak administrator.
Salila modifikasi, panyerang nambihan file "initial.php" kana arsip sareng plugins sareng téma, anu dihubungkeun ku diréktif "kalebet" dina file "functions.php". Pikeun ngalieurkeun jalan satapak, eusi jahat dina file "initial.php" disamarankeun salaku blok data anu disandi base64. The sisipan jahat, dina kedok pikeun meunangkeun gambar ti ramatloka wp-theme-connect.com, langsung dimuat kodeu backdoor kana file wp-includes/vars.php.
Situs munggaran anu kalebet parobihan jahat kana tambihan AccessPress diidentifikasi dina Séptémber 2021. Hal ieu dianggap yén éta lajeng backdoor ieu diselapkeun kana add-ons. Bewara munggaran ka AccessPress ngeunaan masalah anu diidentifikasi henteu kajawab, sareng AccessPress ngan ukur tiasa nampi perhatian saatos ngalibetkeun tim WordPress.org dina panalungtikan. Dina 15 Oktober 2021, arsip anu kapangaruhan ku panto tukang dipiceun tina situs wéb AccessPress, sareng versi énggal tina tambihan dileupaskeun dina 17 Januari 2022.
Sucuri sacara misah nalungtik situs dimana versi anu kapangaruhan tina AccessPress dipasang sareng ngaidentipikasi ayana modul jahat anu dimuat ngaliwatan backdoor anu ngirimkeun spam sareng dialihkeun rujukan ka situs curang (modulna tanggal 2019 sareng 2020). Hal ieu dianggap yén pangarang backdoor anu ngajual aksés ka situs compromised.
Téma dimana substitusi backdoor dirékam:
- accessbuddy 1.0.0
- accesspress-dasar 3.2.1
- accesspress-lite 2.92
- accesspress-mag 2.6.5
- accesspress-parallax 4.5
- accesspress-ray 1.19.5
- accesspress-root 2.5
- accesspress-pokok 1.9.1
- accesspress-toko 2.4.9
- agénsi-lite 1.1.6
- aplite 1.0.6
- bingle 1.0.4
- blogger 1.2.6
- konstruksi-lite 1.2.5
- doko 1.0.27
- enlighten 1.3.5
- fashstore 1.2.1
- fotografi 2.4.0
- gaga-corp 1.0.8
- gaga-lite 1.4.2
- hiji-spasi 2.2.8
- parallax-blog 3.1.1574941215
- parallaxsome 1.3.6
- punte 1.1.2
- revolve 1.3.1
- ripple 1.2.0
- scrollme 2.1.0
- sportsmag 1.2.1
- storevilla 1.4.1
- ayun-lite 1.1.9
- nu-launcher 1.3.2
- éta-Senén 1.4.1
- uncode-lite 1.3.1
- unicon-lite 1.2.6
- vmag 1.2.7
- vmagazine-lite 1.3.5
- vmagazine-warta 1.0.5
- zigcy-orok 1.0.6
- zigcy-kosmétik 1.0.5
- zigcy-lite 2.0.9
Plugins dimana substitusi backdoor dideteksi:
- accesspress-anonim-pos 2.8.0 2.8.1 1
- accesspress-custom-css 2.0.1 2.0.2
- accesspress-custom-post-type 1.0.8 1.0.9
- accesspress-facebook-otomatis-pos 2.1.3 2.1.4
- accesspress-instagram-feed 4.0.3 4.0.4
- accesspress-pinterest 3.3.3 3.3.4
- accesspress-sosial-counter 1.9.1 1.9.2
- accesspress-sosial-ikon 1.8.2 1.8.3
- accesspress-sosial-login-lite 3.4.7 3.4.8
- accesspress-sosial-share 4.5.5 4.5.6
- accesspress-twitter-otomatis-pos 1.4.5 1.4.6
- accesspress-twitter-feed 1.6.7 1.6.8
- ak-menu-ikon-lite 1.0.9
- ap-pendamping 1.0.7 2
- ap-kontak-formulir 1.0.6 1.0.7
- ap-custom-testimonial 1.4.6 1.4.7
- ap-mega-menu 3.0.5 3.0.6
- ap-harga-tabél-lite 1.1.2 1.1.3
- Apex-bewara-bar-lite 2.0.4 2.0.5
- cf7-toko-to-db-lite 1.0.9 1.1.0
- komentar-nonaktipkeun-accesspress 1.0.7 1.0.8
- gampang-sisi-tab-cta 1.0.7 1.0.8
- everest-admin-téma-lite 1.0.7 1.0.8
- everest-datang-geura-lite 1.1.0 1.1.1
- everest-komentar-rating-lite 2.0.4 2.0.5
- everest-counter-lite 2.0.7 2.0.8
- everest-faq-manajer-lite 1.0.8 1.0.9
- everest-galeri-lite 1.0.8 1.0.9
- everest-google-tempat-ulasan-lite 1.0.9 2.0.0
- everest-review-lite 1.0.7
- everest-tab-lite 2.0.3 2.0.4
- everest-timeline-lite 1.1.1 1.1.2
- inline-panggero-ka-aksi-pembina-lite 1.1.0 1.1.1
- product-slider-pikeun-woocommerce-lite 1.1.5 1.1.6
- pinter-logo-showcase-lite 1.1.7 1.1.8
- pinter-gulung-tulisan 2.0.8 2.0.9
- pinter-gulung-ka-luhur-lite 1.0.3 1.0.4
- total-gdpr-minuhan-lite 1.0.4
- total-tim-lite 1.1.1 1.1.2
- pamungkas-panulis-kotak-lite 1.1.2 1.1.3
- pamungkas-formulir-pembina-lite 1.5.0 1.5.1
- woo-badge-desainer-lite 1.1.0 1.1.1
- wp-1-slider 1.2.9 1.3.0
- wp-blog-manager-lite 1.1.0 1.1.2
- wp-comment-designer-lite 2.0.3 2.0.4
- wp-cookie-user-info 1.0.7 1.0.8
- wp-facebook-review-showcase-lite 1.0.9
- wp-fb-messenger-button-lite 2.0.7
- wp-ngambang-menu 1.4.4 1.4.5
- wp-media-manager-lite 1.1.2 1.1.3
- wp-popup-spanduk 1.2.3 1.2.4
- wp-popup-lite 1.0.8
- wp-produk-galeri-lite 1.1.1
sumber: opennet.ru