Flaw Exploitation: Massive Attack On Woocommerce Payments

This article discusses a significant vulnerability in WooCommerce Payments that has been exploited in a massive attack affecting approximately 600,000 websites. The attack occurred between July 14-16, 2023, with over 1.3 million attacks on 157,000 sites. Automattic, the company responsible for WordPress, has addressed security issues for WordPress sites, but researchers have warned of potential future exploitation due to a critical bug. The flaw in WooCommerce Payments allowed attackers to gain control by utilizing the WP Console plugin to execute code remotely. By adding a specific header, the attackers compromised vulnerable sites using a proof-of-concept exploit. The attackers created admin accounts with randomized passwords, specifically targeting a small group of websites. The attacks originated from various IP addresses, with the most active ones being 194.169.175.93 and 2a10:cc45:100::5474:5a49:bfd6:2007. Users of WooCommerce Payments are strongly advised to update their installations promptly, and site administrators should perform scans to identify any suspicious files or accounts. This vulnerability, identified as CVE-2023-28121, poses a significant risk. Additionally, hackers have been utilizing WebAPK to install malware on Android devices.

Key Takeaways

• The WooCommerce Payments flaw allowed attackers to gain control of vulnerable websites.
• Attackers used the WP Console plugin to execute code remotely and create admin accounts with random passwords.
• The attacks targeted a small group of websites, with a total of 1.3 million attacks on 157,000 sites.
• Users of WooCommerce Payments should update their installations immediately and scan for odd PHP files and suspicious admin accounts to mitigate the vulnerability.

Vulnerability Description

The vulnerability in WooCommerce Payments allowed attackers to gain control of vulnerable sites through the execution of PHP code using the WP Console plugin as a backdoor, as detailed in the pre-existing knowledge. This flaw had a significant impact on the affected websites, with over 1.3 million attacks occurring within a span of just three days. The attackers exploited the critical bug to create admin accounts with random passwords, compromising the security of these sites. The motive behind these attacks remains unclear, but the sheer number of targeted websites suggests a deliberate and coordinated effort. It is essential for users of WooCommerce Payments to update their installations immediately and scan for any suspicious PHP files or admin accounts to mitigate the vulnerability. The risk posed by this vulnerability, identified as CVE-2023-28121, underscores the importance of proactive security measures.

Attack Method

The method utilized by the attackers involved the addition of a specific header, resulting in compromised websites and potential control by malicious actors. By adding the X-WCPAY-PLATFORM-CHECKOUT-USER header, vulnerable sites were exploited through a proof-of-concept exploit. This exploit leveraged the WP Console plugin, allowing the execution of PHP code and providing a persistent file uploader backdoor. Additionally, the attackers sought the readme.txt file through plugin enumeration requests. This method facilitated the creation of admin accounts with random passwords, further compromising the targeted websites. The impact assessment revealed that a small group of websites were specifically targeted, with a significant number of IP addresses involved in the attacks. It is crucial for users of WooCommerce Payments to promptly update their installations and scan for any suspicious files or admin accounts to mitigate the vulnerability posed by CVE-2023-28121.

Risk Mitigation

To mitigate the risks associated with the critical vulnerability (CVE-2023-28121), it is essential for users of WooCommerce Payments to promptly update their installations and conduct scans for any suspicious files or admin accounts. Following security best practices is crucial in ensuring the safety of websites and protecting against potential exploitation. Timely updates play a significant role in addressing security issues and patching vulnerabilities that can be exploited by attackers. By regularly updating their installations, users can benefit from the latest security enhancements and fixes provided by Automattic. Additionally, conducting scans for any odd PHP files or suspicious admin accounts can help identify and mitigate potential threats. Implementing these risk mitigation strategies is crucial in maintaining the security and integrity of WooCommerce Payments websites.

Frequently Asked Questions

How can attackers gain control through the WooCommerce Payments flaw?

Attackers can gain control through the WooCommerce Payments flaw by exploiting the vulnerability and executing code remotely using the WP Console plugin. They can create admin accounts with random passwords and upload persistent backdoors to compromise vulnerable sites. Security measures include updating installations, scanning for suspicious files and accounts, and mitigating the vulnerability.

What is the purpose of the WP Console plugin in the exploit method?

The wp console plugin is used in the exploit method to execute PHP code remotely. It allows attackers to gain control by adding a specific header and uploading a persistent file uploader as a backdoor. Understanding its functions helps in analyzing the vulnerability and implementing security measures.

How did attackers create admin accounts on vulnerable sites?

Attackers created admin accounts on vulnerable sites by scanning for the /wp-content/plugins/woocommerce-payments/readme.txt file. They then used random passwords to create the accounts. To secure admin accounts on websites, best practices include using strong passwords, enabling two-factor authentication, and regularly monitoring account activity. Common vulnerabilities in e-commerce platforms should be addressed by keeping software up to date, regularly scanning for vulnerabilities, and implementing security measures such as firewalls and intrusion detection systems.

Which IP addresses were detected in the attacks?

The IP addresses detected in the attacks on vulnerable sites using WooCommerce Payments include 194.169.175.93, 2a10:cc45:100::5474:5a49:bfd6:2007, 103.102.153.17, 79.137.202.106, 193.169.194.63, 79.137.207.224, and 193.169.195.64. These IP addresses were involved in executing the exploitation methods, such as adding a specific header and creating admin accounts.

What other types of attacks were mentioned in the article?

The article mentions different attack vectors, including hackers using WebAPK to install malware on Android devices. It also advises readers to stay updated with cyber security news and follow the Cyber Security News channel for the latest updates.