Duplicator WordPress Plugin Vulnerability Exploited in the Wild
Attackers are targeting a recently patched flaw in a popular WordPress plugin with over 1 million active installations.
Background
On February 12, Snap Creek, makers of the popular WordPress plugin Duplicator, released version 1.3.28 and Duplicator Pro version 3.8.7.1 to address a serious vulnerability.
Duplicator is a plugin used by WordPress site administrators to “migrate and copy WordPress sites.” According to statistics from WordPress.org, Duplicator has over 1 million active installations, and according to Snap Creek, it has been downloaded over 15 million times.
التحليل
According to researchers at Wordfence, an unauthenticated arbitrary file download vulnerability exists in Duplicator versions 1.3.26 and below and Duplicator Pro versions 3.8.7 and below.
The vulnerability exists due to the implementation of a pair of functions, duplicator_download and duplicator_init. The functions can be accessed by unauthenticated users because they were implemented using the wp_ajax_nopriv_ hook. Researchers note that because the functions were “hooked into init,” they would be executed on every WordPress page that’s loaded, whether the user is logged in or not.
Within these functions, the file parameter was sanitized but not validated, so an attacker could use path traversal to access files outside of Duplicator’s specified path.
An unauthenticated, remote attacker could exploit this vulnerability by sending a specially crafted request to a WordPress site using the vulnerable version of the Duplicator plugin. This would allow them to download files outside of the intended directory. An attacker would need some knowledge of the target file structure or attempt to download commonly known files.
These files could include the wp-config.php file, referred to as “one of the most important files” in a WordPress installation. This is because the configuration file contains database credentials and authentication keys and salts. An attacker could use this information to create their own administrator account on the vulnerable site or “inject content or harvest data.”
Wordfence has reportedly blocked over 60,000 attempts to download the wp-config.php file using this vulnerability. They note that of the 60,000 attempts, 50,000 occurred before February 12, prior to Snap Creek releasing a fix for the vulnerability, indicating this was exploited in the wild as a zero-day.
Proof of concept
At the time this blog post was published, there was no proof of concept (PoC) available for this vulnerability. However, there is enough information available in Wordfence’s blog post along with the indicators of compromise to easily craft a PoC.
Solution
Snap Creek addressed this vulnerability in Duplicator version 1.3.28 and Duplicator Pro version 3.8.7.1 on February 12. Duplicator and Duplicator Pro users are strongly encouraged to upgrade to versions 1.3.28 and 3.8.7.1 or greater as soon as possible.
Wordfence provided indicators of compromise to identify attacks exploiting this vulnerability. The bulk of the attacks they’ve seen originate from the following IP address:
- 77.71.115.52
Additionally, review HTTP logs for requests that include the following query strings:
- action=duplicator_download
- file=/../wp-config.php
The most reliable indicator is whether the request contains the file parameter, as that is required to exploit this vulnerability.
Identifying affected systems
A list of Tenable plugins to identify this vulnerability will appear here as they’re released.
الحصول على مزيد من المعلومات
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 30-day trial of Tenable.io Vulnerability Management.
مقالات ذات صلة
CVE-2024-5806: Progress MOVEit Transfer Authentication Bypass Vulnerability
June 25, 2024Progress Software has patched a high severity authentication bypass in the MOVEit managed file transfer (MFT) solution. As MOVEit has been a popular target for ransomware gangs and other threat actors, we strongly recommend prioritizing patching of this vulnerability.
CVE-2024-28995: SolarWinds Serv-U Path/Directory Traversal Vulnerability Exploited in the Wild
June 21, 2024Following the publication of proof-of-concept exploit details for a high-severity flaw in SolarWinds Serv-U, researchers have observed both automated and manual in-the-wild exploitation attempts; patching is strongly advised.
Cybersecurity Snapshot: FTC Believes TikTok Broke U.S. Law, Asks Justice Dept. To Intervene, while French Cyber Agency Warns About Nobelium / Midnight Blizzard
June 21, 2024TikTok’s legal troubles in the U.S. could get thornier after the FTC refers complaint to the DOJ. Meanwhile, France says Russia-backed Nobelium / Midnight Blizzard is a major cyber espionage threat to European governments. Plus, check out a Tenable poll about dealing with vulnerabilities without patches. And did LockBit 3.0 make a comeback in May? Maybe – or maybe not. And much more!
How the regreSSHion Vulnerability Could Impact Your Cloud Environment
July 5, 2024With growing concern over the recently disclosed regreSSHion vulnerability, we’re explaining here what it is, why it’s so significant, what it could mean for your cloud environment and how Tenable Cloud Security can help.
Cybersecurity Snapshot: Malicious Versions of Cobalt Strike Taken Down, While Microsoft Notifies More Orgs About Midnight Blizzard Email Breach
July 5, 2024Check out the results of a multinational operation against illegal instances of Cobalt Strike. Plus, more organizations are learning that Midnight Blizzard accessed their email exchanges with Microsoft. Meanwhile, Carnegie Mellon has a new report about how to fix and mitigate API vulnerabilities. And two new reports shed light on cyber insurance trends. And much more!
Cybersecurity Snapshot: Memory Bugs Pervasive in Open Source SW, While Car Dealership Chaos Persists After Ransomware Attack
June 28, 2024Check out why memory vulnerabilities are widespread in open source projects. Plus, get the latest on the ransomware attack that’s disrupted car sales in North America. In addition, find out why a majority of organizations grew their cyber budgets this year. And learn how confidential data from U.S. chemical facilities may have been accessed by hackers. And much more!
- Vulnerability Management