WordPress shopping sites under attack
WordPress-based shopping sites are under attack from a hacker group abusing a vulnerability in a shopping cart plugin to plant backdoors and take over vulnerable sites.
Attacks are currently ongoing, according to Defiant, the company behind Wordfence, a firewall plugin for WordPress sites.
Hackers are targeting WordPress sites that use the “Abandoned Cart Lite for WooCommerce,” a plugin installed on over 20,000 WordPress sites, according to the official WordPress Plugins repository.
How the vulnerability works
These attacks are one of those rare cases where a mundane and usually harmless cross-site scripting (XSS) vulnerability can actually lead to serious hacks. XSS flaws are rarely weaponized in such a dangerous manner.
These hacks are occurring because of the plugin and vulnerability’s mode of operation, both of which combine to create the perfect storm.
The plugin, as its name implies, allows site administrators to view abandoned shopping carts –what products users added in their carts before they suddenly left the site. Site owners use this plugin to infer a list of potentially popular products that a store might want to have on stock in the future.
These lists of abandoned carts are only accessible in the WordPress site’s backend, and usually only to admins or other users with high-privileged accounts.
How hackers are exploiting the flaw
According to a report from Defiant security researcher Mikey Veenstra, hackers are automating operations against WordPress WooCommerce-based stores to generate shopping carts that contain products with malformed names.
They add exploit code in one of the shopping cart’s fields, then leave the site, an action that ensures the exploit code gets stored in the shop’s database.
When an admin accesses the shop’s backend to view a list of abandoned carts, the hackers’ exploit code is executed as soon as a particular backend page is loaded on the user’s screen.
Veenstra said that Wordfence has detected several exploitation attempts against using this technique in the past few weeks.
The attacks the company spotted used exploit code that loaded a JavaScript file from a bit.ly link. This code tried to plant two different backdoors on sites running the vulnerable plugin.
The first backdoor takes the form of a new admin account that hackers create on the site. This new admin user is named “woouser,” is registered with the “woouser401a@mailinator.com” email address, and uses a password of “K1YPRka7b0av1B”.
The second backdoor is very clever, and is a technique that’s been rarely seen. Veenstra told ZDNet the malicious code lists all the site’s plugins and looks for the first one that’s been disabled by the site admin.
Hackers don’t re-enable it, but instead, they replace the content of its main file with a malicious script that works as a backdoor for future access. The plugin will remain deactivated, but since its files are still on disk and reachable by web requests, the hackers can send malicious instructions to this second backdoor in case site owners remove the “woouser” account.
Image: ZDNet
The bit.ly link used for this campaign has been accessed more than 5,200 times, suggesting that the number of infected sites is most likely in the thousands.
However, the 5,200+ number isn’t entirely accurate. Veenstra explains.
“The Bit.ly stats can be misleading because one infected site can source that link several times if the XSS payload stays in the abandoned cart dashboard and the admin frequents it,” Veenstra told ZDNet in an interview.
“It’s also hard to tell how many successful XSS injections are sitting around waiting for an admin to open that page for the first time,” the researcher also added, suggesting that many sites might have already attacked, but a backdoor has yet to be deployed on them, and hence the bit.ly link has not yet been loaded.
Right now, Veenstra and the rest of the Defiant staff can’t say for sure what hackers are trying to achieve by hacking into all these WordPress-based shopping carts.
“We don’t have a lot of data about successful exploits because our WAF stopped any of our active users from getting compromised,” Veenstra said.
Hackers could be using these sites for anything from SEO spam to planting card skimmers.
The “Abandoned Cart Lite for WooCommerce” plugin received a fix for the XSS attack vector hackers are exploiting during these recent attacks in version 5.2.0, released on February 18.
WordPress shopping sites owners using the plugin are advised to update their sites and review their control panel’s admin account list for suspicious entries. The “woouser” might not be present, but hackers could have also changed it to something else.
More vulnerability reports:
READ MORE HERE