WordPress at this time launched patches to repair a brand new set of vulnerabilities in its core software program, certainly one of which may enable a crafted internet hyperlink, opened by a logged-in administrator, to put in a theme from the official WordPress.org listing with out anybody clicking Set up.
The safety agency pwn.ai, whose researchers reported the flaw, calls the assault chain Click2Shell. By itself the flaw solely installs an actual theme that the attacker picks, however the safety analysis workforce confirmed it could possibly be mixed with a separate weak point in a theme to run the attacker’s personal code on the server.
The repair shipped on September 17 in WordPress 7.1.1. As a result of it is a safety launch, WordPress advises updating immediately. There isn’t a signal the flaw has been utilized in actual assaults.
The put in theme stays switched off, so the location’s personal look doesn’t change and nothing appears to be like mistaken. Reaching code execution wanted a second, separate flaw within the theme that was put in. As pwn.ai wrote of the core bug alone, “The Core bug doesn’t settle for an arbitrary theme ZIP by itself.”
The flaw works as a result of two elements of WordPress learn the identical hyperlink in another way. The WordPress.org listing treats the worth within the hyperlink as an atypical theme identify and returns an actual theme, however the administrator’s browser reuses the unique textual content, punctuation and all, inside code meant to select an merchandise on the web page. Characters the attacker provides to the hyperlink ship that code to the Set up button, and WordPress’s personal script clicks it.
As a result of the administrator is already logged in, their session provides the permission and the safety token the set up wants, so the attacker provides neither.
An put in theme is just not at all times idle. When WordPress builds a preview in its Customizer device, it will possibly load a theme’s PHP code even earlier than the theme is switched on.
The theme pwn.ai used, Cell Restore Zone, carried a second flaw: a background handler that fetched an online tackle from the request, downloaded a package deal, and ran its code, with no test on the customer’s permission or a safety token. Chained after the compelled set up, that handler ran the attacker’s code on the server.
The researchers rated the forced-install flaw by itself as excessive severity, with a CVSS rating of seven.1, and the total chain to code execution as vital, at 9.6. WordPress has not revealed a severity score of its personal, and in its launch it described the problem this fashion: “Specifically crafted URLs can robotically set up and preview an inactive theme from WordPress.org.” No CVE identifier has been assigned but, although pwn.ai says WordPress plans so as to add one.
WordPress fastened the flaw in 7.1.1, a part of a safety launch whose fixes attain supported branches again to 4.7. Its notes affirm this flaw from model 6.0 up by means of the releases simply earlier than the repair. Web site house owners ought to set up 7.1.1, or the matching replace for whichever department they run, and websites set to replace robotically will obtain it on their very own.
Should you can’t replace directly, word that neither WordPress nor pwn.ai supplied a separate workaround, and that the assault nonetheless wants a logged-in administrator to open the attacker’s hyperlink. Updating WordPress core closes the demonstrated assault no matter theme a website runs.
Click2Shell is just not the agency’s first WordPress core flaw in latest weeks. In August, WordPress fastened the same flaw pwn.ai discovered within the login display screen and likewise chained to code execution, and there too WordPress described the danger extra narrowly than the researchers did.
A completely different WordPress core flaw disclosed in July, referred to as wp2shell, is just not linked to pwn.ai’s work. That flaw wants no login and no click on, and the U.S. cybersecurity company CISA has listed it as exploited in actual assaults, which Click2Shell has not been.
