Privilege Escalation Vulnerability In WordPress GDPR Compliance Plugin
Contents of This Guide
- 1 WordPress GDPR Compliance Plugin Exploit
- 2 Vulnerability in the GDPR Plugin
- 3 Two Types of WordPress GDPR Exploit
- 4 Symptoms of Attack
- 4.1 Via Admin Method:
- 4.2 Via Cron Injection Procedure
- 4.3 Outside Links to Domains
- 4.4 Malware Hashes
- 4.5 Backdoor via Admin Creation Method
- 4.6 Backdoor via Cron Injection Method
- 4.7 Unauthorized database transactions
- 4.8 Plugins installed illegally
WordPress GDPR Compliance Plugin Exploit
The WordPress GDPR Compliance Plugin has made it easier for users to make their websites compliant with the new General Data Protection Regulation (GDPR) laws in the EU. The older versions (1.4.2 and below) of the plugin contains some vulnerabilities due to which websites using it have been affected by the WordPress GDPR exploit in recent times. The vulnerabilities enable the unauthenticated attackers to escalate their privileges, permitting them to further infect vulnerable sites. Hence, a site using this plugin should make it a priority to update to the most recent version. They can also deactivate it and thereby remove the affected plugin if the update don’t safeguard against the exploits. In this article, we cover how the vulnerability is exploited by hackers and how to safeguard against such attacks. In recent times, we have also seen how the WooCommerce Plugin can be exploited to get admin access in WordPress. You can secure the plugin by following the instructions here.
Vulnerability in the GDPR Plugin
Normally, the plugin handles a variety of actions which might be submitted via WordPress’s admin-ajax.php file. These actions require creating requests which need authorization for access and deletion operations by the GDPR plugin. The above file dynamically changes the plugin’s settings from the WordPress admin dashboard. If not validated correctly, this functionality could lead to a security risk.
However, unpatched versions of WordPress GDPR Compliance Plugin (up to version 1.4.2) fail to perform capability checks during execution of its internal action
save_setting to create such configuration changes. If a malicious user submits random choices and values to the current point, then the input fields will be exactly copied to the
options table of the affected site’s database. WordPress uses the options table to store user role information, so this vulnerability could be exploited in order to make any user in WordPress an administrator.
Facing security issues with your WordPress website? Drop us a message on the chat widget and we’d be happy to help you. Fix my WordPress website now.
The plugin stores the arbitrary values of the options in the table and also perform the
do_action call using the given name and the value. This allows the attackers to steal sensitive information and perform various unauthorized actions on the WordPress site.
This is how the WordPress GDPR exploit makes your site vulnerable.
Two Types of WordPress GDPR Exploit
Admin Access by Modifying Settings
The most common attacks against this flaw directly exploit the power to switch arbitrary settings on victim websites. By allowing new user registration and dynamically changing the default role of the recent users to Administrator, attackers can easily create an entirely new privileged user, then log in and take any actions on the recently compromised website. Basically, it is a kind of privilege escalation through the WordPress GDPR Plugin.
Check our detailed blog on How to Fix WordPress Admin Hack
Interestingly, automatic systems are making an attempt to perform this activity. They are basically reversing the settings modifications being created. The subsequent screenshot contains relevant access log entries for one such attack.
In this log, we initially see a GET request to the site’s homepage. This initial request is important to supply the “ajaxSecurity” which is needed by the plugin to perform AJAX actions. Next, two POST requests are sent to /wp-admin/admin-ajax.php. The access logs don’t show data held in POST bodies.
The attacker creates two more AJAX requests which helps in closing the door behind the attacker and disables any new registrations to WordPress.
For more information on how hackers can perform backdoor hacks on WordPress, you can follow this article.
WordPress Site URL changed to Pastebin or Erealitatea[.]net
In this GDPR Compliance Plugin Exploit, we have observed that the site URL is changed to
hxxps://pastebin[.]com/raw/V8SVyu2P? or hxxp://erealitatea[.]net
The most important thing to note in Pastebin is that it has ‘?’ at the end. It is used to generate static content URLs in WordPress.
Scripts: hxps://pastebin[.]com/raw/V8SVyu2P?/wp-includes/js/jquery/jquery_js&ver=1.12.4 Css: hxxps://pastebin[.]com/raw/V8SVyu2P?/wp-content/plugins/revslider/public/assets/css/settings_css&ver=5.4.8 Images: hxxps://pastebin[.]com/raw/V8SVyu2P?/wp-content/plugins/revslider/admin/assets/images/dummy.png
Following URLs are used:
Attack through WordPress Cron Schedule
The second sort of exploit we are seeing is even more harder to spot. By injecting malicious actions into a site’s WP-Cron schedule, these attackers are able to install a persistent backdoor that can reinstall itself if removed. We generally see such attacks through WP-Cron but nowadays they are using another popular WordPress plugin, WooCommerce.
The following line contains the AJAX request body blocked by a firewall for trying to insert a malicious WP-Cron task:
The next step injects the following code:
The PHP script in the <
malicious> placeholder executes the following steps:
- Receive encoded input within the attacker’s request as “HTTP_X_AUTH” header, which declares the locations used in the subsequent steps.
- Sends a request to
- Decode the response and save the PHP backdoor as wp-cache.php
- Include the core file
- Deactivate and delete the
- Clear the WP-Cron event related to the attack
- Delete the
2mb_autocode_topstringchoice containing this code
The malicious code submitted by the attacker eventually gets passed to the dangerous eval() function, allowing arbitrary code to be executed by the backdoor.
Astra Security Suite is highly tailored for WordPress. Drop us a message on the chat widget and we’d be happy to help you. Secure my WordPress website now.
If you find any such files with the eval() function, you can follow our article to fix this issue.
Symptoms of Attack
Via Admin Method:
You might have seen multiple admin unauthorized users added to WordPress
Common IP Addresses:
Via Cron Injection Procedure
Common IP Addresses:
Outside Links to Domains
Backdoor via Admin Creation Method
- MD5: b6eba59622630b18235ba2d0ce4fcb65
- SHA1: 577293e035cce3083f2fc68f684e014bf100faf3
Backdoor via Cron Injection Method
- MD5: c62180f0d626d92e29e83778605dd8be
- SHA1: 83d9688605a948943b05df5c548bea6e1a7fe8da
Presence of these automated users:
Plugins installed illegally
- 2MB Autocode
In order to patch the WordPress GDPR Exploit, it is best that you install the latest version of the WordPress GDPR Compliance Plugin which is version 1.4.3 at the time of writing. If you believe your site has been affected by this hack, please do not hesitate to reach out to our WordPress malware cleaning team to begin the remediation process. Also, please share this post with your peers to spread awareness of this issue.
Worried about WordPress security? Drop us a message on the chat widget and we’d be happy to help you. Secure my WordPress website now.