Critical Flaw in UpdraftPlus Plugin Leads to CDN Exploit and JavaScript Malicious Injection
- Discovery of a vulnerability within the UpdraftPlus plugin resulted in a significant supply-chain breach on Awesome Motive’s marketing server.
- The malware specifically targeted logged-in WordPress administrators, extracting tokens and generating unauthorized accounts for complete site control.
- Website administrators are advised to verify for counterfeit admin accounts (‘developer_api1’, ‘dev_xxxxxx’), concealed backdoor plugins, and to refresh their credentials and security salts.
Over one million WordPress websites faced the dire risk of total takeover due to a vulnerability in a widely used plugin, igniting a large-scale supply-chain attack.
The ecommerce security firm Sansec detected the threat over the weekend, with subsequent confirmation from the affected entity.
According to investigative reports, hackers successfully identified and exploited a vulnerability in the UpdraftPlus plugin, specifically on a marketing server owned by Awesome Motive, the developer behind numerous well-known WordPress solutions such as OptinMonster, TrustPulse, and PushEngage.
Although the compromised server did not belong to the active production environment, it was responsible for housing credentials linked to the company’s content delivery network (CDN).
By commandeering the stolen CDN API key, the assailants modified JavaScript files disseminated through Awesome Motive’s CDN.
Strategic Targeting of Admin Users
The compromised scripts were subsequently utilized by OptinMonster, TrustPulse, and PushEngine, thereby disseminating the attackers’ JavaScript to site visitors, albeit selectively.
The malware was designed to trigger solely when a logged-in WordPress administrator accessed an affected website, thus evading detection while exclusively targeting users with heightened privileges.
The insidious script proceeded to extract administrator authentication tokens and unique WordPress nonces, employing them to fabricate additional admin accounts.
Following this, the intruders installed further malicious plugins, set up a command-and-control architecture, and initiated the exfiltration of sensitive information.
The malware also enabled web shell capabilities, arbitrary PHP code execution, file management functions, and virtually any action an authenticated admin could perform.
Even after Awesome Motive successfully purged the malicious scripts from the CDN, the attackers retained substantial control over previously compromised websites via the illicit administrator accounts and clandestine backdoor plugins.
Consequently, website proprietors at risk must scrutinize for unauthorized admin accounts such as ‘developer_api1’ or ‘dev_xxxxxx’, examine the wp-content/plugins directory for concealed backdoor plugins, and conduct thorough server-side malware inspections.
Source link: Techradar.com.
