Immediate Threat Posed by Newly Discovered WordPress Vulnerability, Warns Defiant
Defiant has raised alarms regarding a newly identified high-severity vulnerability within WordPress that began attracting the attention of malicious actors merely hours following the release of patches.
This critical flaw, patched on October 28 in WordPress version 7.1.4, significantly impacts the WordPress update process and holds the potential for remote code execution.
As Defiant explains, the vulnerability is characterized by a race condition within WordPress’s Core update process, which can be manipulated without the need for authentication.
However, the complexity involved in executing such an attack is notably high, and as of now, no Common Vulnerabilities and Exposures (CVE) identifier has been designated for this issue.
The root of this vulnerability lies in the predictable and web-accessible staging paths utilized during the update process. New files are unpacked into a directory that many servers leave exposed to the web.
“For an attacker to succeed, they require access to a full-package update with the necessary installer files, public web and PHP access to the staging tree, a predictable or discovered staging path, and ample time to execute the attack prior to WordPress purging the temporary files,” Defiant elucidates.
The cyber security firm reports that threat actors are already engaged in attempts to exploit this vulnerability, continuously probing the affected paths as they strive to capitalize on the fleeting window of exploitability that lasts mere seconds.
Interestingly, while it is not necessary for perpetrators to possess an account on the site to exploit this vulnerability, they must target a very precise timeframe when WordPress is in the process of unpacking a Core update, according to Defiant.
In response to this identified security flaw, WordPress has implemented measures to randomize the staging directory, introduced an index guard, and curtailed the unsafe promotion of staged configuration data.
Our Wordfence telemetry indicates that threat actors are proactively attempting to take advantage of this vulnerability.
Our first alarm triggered just nine minutes after the new firewall rule was introduced. Within the initial 21 hours, our systems logged over 18,500 requests aimed specifically at staged setup-config.php installer paths, Defiant revealed.
It is noteworthy that Wordfence has yet to report any successful breaches related to this vulnerability.
Remedies for the flaw were included in WordPress version 7.1.4 and were backported to earlier branches, extending as far back as WordPress 4.7.
In addition to resolving this critical defect, WordPress 7.1.4 incorporates patches for 22 other security flaws, which include several cross-site scripting (XSS) vulnerabilities, interactivity API issues, an unauthenticated information disclosure weakness, and an authorization flaw.
The update also refreshes bundled root certificates in light of the recent eMudhra revocation.
Source link: Securityweek.com.
