{"id":1153,"date":"2020-02-21T18:37:52","date_gmt":"2020-02-21T13:07:52","guid":{"rendered":"https:\/\/www.hostnamaste.com\/blog\/?post_type=news&p=1153"},"modified":"2020-02-21T18:40:02","modified_gmt":"2020-02-21T13:10:02","slug":"zero-day-wordpress-duplicator-plugin-vulnerability-affects-over-1-million-sites","status":"publish","type":"news","link":"https:\/\/www.hostnamaste.com\/blog\/news\/zero-day-wordpress-duplicator-plugin-vulnerability-affects-over-1-million-sites\/","title":{"rendered":"Zero-day WordPress Duplicator Plugin Vulnerability Affects Over 1 Million Sites"},"content":{"rendered":"
\"Zero-day
Zero-day WordPress Duplicator Plugin Vulnerability Affects Over 1 Million Sites – HostNamaste<\/span><\/figcaption><\/figure>\n

On 19 February 2020, Wordfence<\/a> reported a highly critical vulnerability found in the popular Duplicator plugin for WordPress. A critical security update was recently issued for\u00a0Duplicator<\/a>, one of the most popular plugins in the WordPress ecosystem. Over a million WordPress sites were affected by a vulnerability allowing attackers to download arbitrary files from victim sites. We urge all Duplicator users to update to version 1.3.28 as soon as possible.<\/span><\/p>\n

We are detecting active exploitation of this vulnerability in the wild, and estimate more than half a million sites are still running a vulnerable version. Built-in firewall protection prevents these attacks for all Wordfence users, both Premium and those still on the free version of Wordfence. As always, it\u2019s still important to perform security updates regardless of other protections.<\/span><\/p>\n

In today\u2019s post, we\u2019ll take a brief look at the vulnerable code, discuss its severity, and share details of the ongoing attacks against it.<\/span><\/p>\n\n

\n

File Download Vulnerability Analysis<\/span><\/h2>\n<\/blockquote>\n

The Duplicator plugin helps site administrators migrate and copy WordPress sites. Part of this functionality involves exporting database and file content into portable archives. When an administrator creates a new copy of their site, Duplicator lets them download the generated files from their WordPress dashboard.<\/span><\/p>\n

\"File
File Download Vulnerability Analysis – HostNamaste<\/span><\/figcaption><\/figure>\n

This was implemented as an AJAX request within Duplicator\u2019s admin interface. The download buttons each trigger a call to the WordPress AJAX handler with the action\u00a0duplicator_download<\/code>\u00a0and a\u00a0file<\/code>\u00a0parameter, indicating the location of the file to be downloaded. When clicked, the requested file is downloaded and the user doesn\u2019t need to leave or reload their current page.<\/span><\/p>\n

\n
\n\n\n\n
\n
85<\/span><\/div>\n
86<\/span><\/div>\n
87<\/span><\/div>\n
88<\/span><\/div>\n
89<\/span><\/div>\n
90<\/span><\/div>\n
91<\/span><\/div>\n
92<\/span><\/div>\n
93<\/span><\/div>\n
94<\/span><\/div>\n
95<\/span><\/div>\n
96<\/span><\/div>\n
97<\/span><\/div>\n
98<\/span><\/div>\n
99<\/span><\/div>\n
100<\/span><\/div>\n
101<\/span><\/div>\n
102<\/span><\/div>\n
103<\/span><\/div>\n
104<\/span><\/div>\n
105<\/span><\/div>\n
106<\/span><\/div>\n
107<\/span><\/div>\n
108<\/span><\/div>\n
109<\/span><\/div>\n
110<\/span><\/div>\n
111<\/span><\/div>\n
112<\/span><\/div>\n
113<\/span><\/div>\n
114<\/span><\/div>\n
115<\/span><\/div>\n
116<\/span><\/div>\n
117<\/span><\/div>\n
118<\/span><\/div>\n
119<\/span><\/div>\n
120<\/span><\/div>\n<\/td>\n
\n
\n
public<\/code> static<\/code> function<\/code> duplicator_download() {<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>$file<\/code> = sanitize_text_field(<\/code>$_GET<\/code>[<\/code>'file'<\/code>]);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>$filepath<\/code> = DUPLICATOR_SSDIR_PATH.<\/code>'\/'<\/code>.<\/code>$file<\/code>;<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>\/\/ Process download<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>if<\/code>(<\/code>file_exists<\/code>(<\/code>$filepath<\/code>)) {<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>\/\/ Clean output buffer<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>if<\/code> (ob_get_level() !== 0 && @ob_end_clean() === FALSE) {<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>@ob_clean();<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/span><\/div>\n
<\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>header(<\/code>'Content-Description: File Transfer'<\/code>);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>header(<\/code>'Content-Type: application\/octet-stream'<\/code>);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>header(<\/code>'Content-Disposition: attachment; filename=\"'<\/code>.<\/code>basename<\/code>(<\/code>$filepath<\/code>).<\/code>'\"'<\/code>);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>header(<\/code>'Expires: 0'<\/code>);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>header(<\/code>'Cache-Control: must-revalidate'<\/code>);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>header(<\/code>'Pragma: public'<\/code>);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>header(<\/code>'Content-Length: '<\/code> . <\/code>filesize<\/code>(<\/code>$filepath<\/code>));<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>flush<\/code>(); <\/code>\/\/ Flush system output buffer<\/code><\/span><\/div>\n
<\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>try<\/code> {<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>$fp<\/code> = @<\/code>fopen<\/code>(<\/code>$filepath<\/code>, <\/code>'r'<\/code>);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>if<\/code> (false === <\/code>$fp<\/code>) {<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>throw<\/code> new<\/code> Exception(<\/code>'Fail to open the file '<\/code>.<\/code>$filepath<\/code>);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>while<\/code> (!<\/code>feof<\/code>(<\/code>$fp<\/code>) && (<\/code>$data<\/code> = <\/code>fread<\/code>(<\/code>$fp<\/code>, DUPLICATOR_BUFFER_READ_WRITE_SIZE)) !== FALSE) {<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>echo<\/code> $data<\/code>;<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>@fclose(<\/code>$fp<\/code>);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>} <\/code>catch<\/code> (Exception <\/code>$e<\/code>) {<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>readfile(<\/code>$filepath<\/code>);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>exit<\/code>;<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>} <\/code>else<\/code> {<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>wp_die(<\/code>'Invalid installer file name!!'<\/code>);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

Unfortunately the\u00a0duplicator_download<\/code>\u00a0action was registered via\u00a0wp_ajax_nopriv_<\/code>\u00a0and was accessible to unauthenticated users. To make things worse, no validation limited the filepaths being downloaded. The\u00a0file<\/code>\u00a0parameter is passed through\u00a0sanitize_text_field<\/code>\u00a0and appended to the plugin constant\u00a0DUPLICATOR_SSDIR_PATH<\/code>, but directory traversal was still possible. An attacker could access files outside of Duplicator\u2019s intended directory by submitting values like\u00a0..\/..\/..\/file.php<\/code>\u00a0to navigate throughout the server\u2019s file structure.<\/span><\/p>\n

In addition to the AJAX action, the same vulnerability existed in Duplicator\u2019s\u00a0duplicator_init()<\/code>\u00a0function, which is called by WordPress\u2019s\u00a0init<\/code>\u00a0hook.<\/span><\/p>\n

\n
\n\n\n\n
\n
154<\/span><\/div>\n
155<\/span><\/div>\n
156<\/span><\/div>\n
157<\/span><\/div>\n
158<\/span><\/div>\n
159<\/span><\/div>\n
160<\/span><\/div>\n
161<\/span><\/div>\n
162<\/span><\/div>\n
163<\/span><\/div>\n
164<\/span><\/div>\n
165<\/span><\/div>\n
166<\/span><\/div>\n
167<\/span><\/div>\n
168<\/span><\/div>\n
169<\/span><\/div>\n
170<\/span><\/div>\n
171<\/span><\/div>\n
172<\/span><\/div>\n
173<\/span><\/div>\n
174<\/span><\/div>\n
175<\/span><\/div>\n
176<\/span><\/div>\n
177<\/span><\/div>\n
178<\/span><\/div>\n
179<\/span><\/div>\n
180<\/span><\/div>\n
181<\/span><\/div>\n
182<\/span><\/div>\n
183<\/span><\/div>\n
184<\/span><\/div>\n
185<\/span><\/div>\n
186<\/span><\/div>\n
187<\/span><\/div>\n
188<\/span><\/div>\n
189<\/span><\/div>\n
190<\/span><\/div>\n
191<\/span><\/div>\n
192<\/span><\/div>\n<\/td>\n
\n
\n
function<\/code> duplicator_init() {<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>if<\/code> (isset(<\/code>$_GET<\/code>[<\/code>'action'<\/code>]) && <\/code>$_GET<\/code>[<\/code>'action'<\/code>] == <\/code>'duplicator_download'<\/code>) {<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>$file<\/code> = sanitize_text_field(<\/code>$_GET<\/code>[<\/code>'file'<\/code>]);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>$filepath<\/code> = DUPLICATOR_SSDIR_PATH.<\/code>'\/'<\/code>.<\/code>$file<\/code>;<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>\/\/ Process download<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>if<\/code>(<\/code>file_exists<\/code>(<\/code>$filepath<\/code>)) {<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>\/\/ Clean output buffer<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>if<\/code> (ob_get_level() !== 0 && @ob_end_clean() === FALSE) {<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>@ob_clean();<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/span><\/div>\n
<\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>header(<\/code>'Content-Description: File Transfer'<\/code>);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>header(<\/code>'Content-Type: application\/octet-stream'<\/code>);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>header(<\/code>'Content-Disposition: attachment; filename=\"'<\/code>.<\/code>basename<\/code>(<\/code>$filepath<\/code>).<\/code>'\"'<\/code>);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>header(<\/code>'Expires: 0'<\/code>);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>header(<\/code>'Cache-Control: must-revalidate'<\/code>);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>header(<\/code>'Pragma: public'<\/code>);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>header(<\/code>'Content-Length: '<\/code> . <\/code>filesize<\/code>(<\/code>$filepath<\/code>));<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>flush<\/code>(); <\/code>\/\/ Flush system output buffer<\/code><\/span><\/div>\n
<\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>try<\/code> {<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>$fp<\/code> = @<\/code>fopen<\/code>(<\/code>$filepath<\/code>, <\/code>'r'<\/code>);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>if<\/code> (false === <\/code>$fp<\/code>) {<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>throw<\/code> new<\/code> Exception(<\/code>'Fail to open the file '<\/code>.<\/code>$filepath<\/code>);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>while<\/code> (!<\/code>feof<\/code>(<\/code>$fp<\/code>) && (<\/code>$data<\/code> = <\/code>fread<\/code>(<\/code>$fp<\/code>, DUPLICATOR_BUFFER_READ_WRITE_SIZE)) !== FALSE) {<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>echo<\/code> $data<\/code>;<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>@fclose(<\/code>$fp<\/code>);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>} <\/code>catch<\/code> (Exception <\/code>$e<\/code>) {<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>readfile(<\/code>$filepath<\/code>);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>exit<\/code>;<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>} <\/code>else<\/code> {<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>wp_die(<\/code>'Invalid installer file name!!'<\/code>);<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/span><\/div>\n
}<\/code><\/span><\/div>\n
add_action(<\/code>'init'<\/code>, <\/code>'duplicator_init'<\/code>);<\/code><\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

Because it was hooked into\u00a0init<\/code>, this function was executed on every WordPress page load for logged-in users and unauthenticated visitors alike. This means an attacker could trigger a file download by adding query strings to any path on a vulnerable site, bypassing AJAX-specific monitoring.<\/span><\/p>\n

Both of these vulnerable cases have been patched as of Duplicator 1.3.28. The AJAX action has been updated to properly validate filenames, and now requires a matching ID and hash to allow the file download. The\u00a0duplicator_init()<\/code>\u00a0function has been removed entirely.<\/span><\/p>\n

\n

Attackers Stealing Database Credentials<\/span><\/h2>\n<\/blockquote>\n

Arbitrary file download vulnerabilities can be a critical issue regardless of the vulnerable site\u2019s platform, but such attacks against WordPress sites largely target one file:\u00a0wp-config.php<\/code>.<\/span><\/p>\n

Depending on the site,\u00a0wp-config.php<\/code>\u00a0can contain any amount of custom code, but attackers target it to access a site\u2019s database credentials. With these credentials, an attacker can directly access the victim site\u2019s database if it allows remote connections. This access can be used by an attacker to create their own Administrator account and further compromise the site, or simply to inject content or harvest data.<\/span><\/p>\n

Sites with local databases still have cause for concern, however. On shared hosting environments, it\u2019s possible for one user on a shared server to access the local database of another site on the same server. This certainly limits the attack surface of the vulnerable site, but is still a severe issue.<\/span><\/p>\n

At the time of this writing, Wordfence has blocked more than 60,000 attempts to download\u00a0wp-config.php<\/code>\u00a0files with this vulnerability. About 50,000 of these events took place before Duplicator patched the flaw, making this a zero-day vulnerability.<\/span><\/p>\n

Nearly all of these attacks were issued from the same IP address:\u00a077.71.115.52<\/code>. This IP points to a webserver located in Bulgaria, owned by Varna Data Center EOOD. A handful of websites are hosted on this server, suggesting the attacker could be proxying their attacks through a compromised website. We have associated this IP address with other malicious activity against WordPress recently, and research into its activity is ongoing.<\/span><\/p>\n

\n

Indicators Of Compromise (IOCs)<\/span><\/h2>\n<\/blockquote>\n

The following Indicators of Compromise (IOCs) can be used to determine if your site may have been attacked.<\/span><\/p>\n