{"id":7983,"date":"2018-11-12T12:14:36","date_gmt":"2018-11-12T17:14:36","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=7983"},"modified":"2018-11-13T00:37:02","modified_gmt":"2018-11-13T05:37:02","slug":"wordpress-gdpr-compliance-plugin-flaws","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/wordpress-gdpr-compliance-plugin-flaws\/","title":{"rendered":"WordPress GDPR Compliance Plugin: Critical vulnerability, update immediately"},"content":{"rendered":"

Over 100,000 WordPress websites are potentially vulnerable to a major exploit<\/h2>\n

Since the end of May, GDPR compliance has been a key consideration for any company or organization with a footprint in Europe<\/a>. In the leadup to the GDPR enforcement date, May 25, multitudes of GDPR compliance products and services have hit the market. And while many are well-intentioned, sometimes they can cause unforeseen problems of their own. Case in point: a WordPress GDPR Compliance Plugin was recently found to be vulnerable to a pair of exploits that could give an attacker control of the website.<\/p>\n

In a report made last Thursday, WordFence, the company behind a popular WordPress security plugin<\/a>, outlined a privilege escalation flaw in the WordPress GDPR Compliance Plugin<\/a> that could endanger over 100,000 websites.<\/p>\n

After its removal from the WordPress plugin repository yesterday, the popular plugin WP GDPR Compliance<\/a>\u00a0released version 1.4.3, an update which patched multiple critical vulnerabilities. At the time of this writing, the plugin has been reinstated in the WordPress repository and has over 100,000 active installs. The reported vulnerabilities allow unauthenticated attackers to achieve privilege escalation, allowing them to further infect vulnerable sites. Any sites making use of this plugin should make it an immediate priority to update to the latest version, or deactivate and remove it if updates are not possible.<\/p><\/blockquote>\n

So, given that we\u2019ve spent more than a little time covering GDPR compliance<\/a>, today we\u2019re going to go over what the WordPress GDPR Compliance Plugin is, what it\u2019s vulnerable to and what you need to do if you\u2019re using it.<\/p>\n

Let\u2019s Hash it Out…<\/span><\/p>\n

What is the WordPress GDPR Compliance Plugin?<\/h2>\n

The WordPress GDPR Compliance Plugin<\/a> is designed to assist websites and organizations with European privacy regulations. Designed by Van Ons, it\u2019s essentially a suite of features, like support for Contact Forms, Gravity Forms, WooCommerce and WordPress comments.<\/p>\n

\"GDPR:WP GDPR Compliance helps you as a site owner take care of:<\/p>\n

– Keeping a consent log for supported plugins.
\n– Adding checkboxes to supported plugins for explicit visitor consent.
\n– \u2018Right to access\u2019 through encrypted audit logs.
\n– \u2018Right to be forgotten\u2019 by anonymising [sic] user data.<\/p>\n<\/blockquote>\n

As we covered last week<\/a>, one of the benefits of a CMS like WordPress is the ability to use plugins, which save site owners time and resources that would otherwise need to be spent developing web applications and additional functionality to their websites. The downside is that sometimes these plugins, which are designed by third parties, can cause unforeseen complications \u2013 like disabling certificate authentication<\/a>.<\/p>\n

That\u2019s what\u2019s happening in the case of the WordPress GDPR Compliance plugin.<\/p>\n

What are the WordPress GDPR Compliance plugin\u2019s critical vulnerabilities?<\/h2>\n

There are two. And these have been spotted in the wild, meaning that they have already been exploited. While WordFence says it hasn\u2019t seen any \u201cfinal payloads,\u201d clearly there is an imminent threat posed by these vulnerabilities.<\/p>\n

The first is a bit simpler, and more common:<\/p>\n

Administrator Access via Modified Settings<\/h2>\n

Distilled to its simplest, this attack lets an attacker create a new user, give it admin privileges and then change the settings it just exploited to create the new user \u2013 as a way to prevent the attack vector from being exploited again.<\/p>\n

Here\u2019s an example of the log entries from one attack<\/a>:<\/p>\n

\"attack<\/p>\n

While we\u2019re not going to go line-by-line, you can see where the attacker is able to enable the \u201cusers_can_register\u201d option, create a new account, and then disable the registration option, effectively shutting the window behind them.<\/p>\n

WordFence has seen the attackers installing a PHP webshell<\/a>, that can allow for remote access. From there, the attacker has carte blanche to upload any additional malicious payloads it wants to.<\/p>\n

Backdoor Installation via Injected Cron<\/h2>\n

The second exploit is a bit more involved, but provides the attacker with a persistent backdoor that can be replaced if it\u2019s found and removed. The attack works by injecting malicious actions into a website\u2019s WP-Cron schedule. This exploits a technology that allows a website to run scheduled tasks like checking for updates or pushing live new content.<\/p>\n

This exploit takes advantage of part of WooCommerce\u2019s functionality:<\/p>\n

..to install the\u00a02MB Autocode<\/a>\u00a0plugin, which allows the injection of arbitrary PHP code into all posts on a site. The code to be injected is stored by 2MB Autocode as an option in the database\u2026<\/p><\/blockquote>\n

That setting is then modified with a PHP backdoor script that downloads a response from the attacker\u2019s server and saves it as wp-cache.php, before covering its tracks. This makes it difficult to detect, but results in persistent backdoor access to the site.<\/p>\n

While the backdoor script seen in these cases shares the name wp-cache.php\u00a0with other methods, the contents are much different. Instead of a self-contained web shell, this script contains some decoding functions and some execution syntax, but none of the executed payload is stored in the file. Instead, the payload to be decoded and executed is stored as a POST variable or in a cookie.<\/p><\/blockquote>\n

Again, WordFence doesn\u2019t know what the intent is behind this attack is. It knows the means, it just hasn\u2019t ascertained the ends yet. Still, there\u2019s no shortage of potential dangers having admin permissions and remote access to a website can cause.<\/p>\n

How would I know if I\u2019m in trouble?<\/h2>\n

WordFence has provided the following indicators of compromise:<\/p>\n

Prevalent IP Addresses<\/strong><\/p>\n

Admin Creation<\/p>\n